joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400141e8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
movdqa xmm0, xmmword [0x1400591f0]
lea rdx, [0x1400589df]
mov rbx, rcx
mov byte [rbp + 0x17], 0
lea rcx, [rbp + 0x17]
movdqu xmmword [rbp + 0x27], xmm0
call fcn.14000e208
movdqa xmm0, xmmword [0x1400591f0]
lea rdx, [0x1400589df]
lea rcx, [rbp + 0x37]
mov byte [rbp + 0x37], 0
movdqu xmmword [rbp + 0x47], xmm0
call fcn.14000e208
xorps xmm0, xmm0
lea rcx, [rbp - 9]
mov rdx, rbx
movdqu xmmword [rbp + 7], xmm0
call fcn.14000c9e8
mov edi, 2
lea r8, [rbp + 0x17]
mov r9d, edi
lea rdx, [rbp + 0x37]
lea rcx, [rbp - 9]
call fcn.140013238
lea rcx, [rbp - 9]
xorps xmm0, xmm0
mov rdx, rbx
movdqu xmmword [rbp + 7], xmm0
cmp eax, 1
jne 0x1400142be
call fcn.14000c9e8
lea r8, [rbp - 9]
mov edx, 0xd2
mov ecx, edi
call fcn.14001f228
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400142af
mov rcx, qword [rbx]
inc rdx
call fcn.1400038b4
and qword [rbx + 0x10], 0
mov eax, 1
jmp 0x14001439e
call fcn.14000c9e8
lea r8, [rbp - 9]
mov edx, 0xd1
mov ecx, edi
call fcn.14001f228
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
and qword [rsp + 0x28], 0
lea r8, [0x14001dec0]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0x1388
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xorps xmm0, xmm0
lea rcx, [rbp - 9]
mov rdx, rbx
movdqu xmmword [rbp + 7], xmm0
test eax, eax
je 0x140014340
cmp eax, 0x102
je 0x140014334
call fcn.14000c9e8
mov edx, 0x2908
jmp 0x14001434a
call fcn.14000c9e8
mov edx, 0x2907
jmp 0x14001434a
call fcn.14000c9e8
mov edx, 0x2906
lea r8, [rbp - 9]
mov ecx, 0x15
call fcn.14001f228
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140014397
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140014392
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400143be
mov rcx, r8
call fcn.14002fcfc
and qword [rbx + 0x10], 0
xor eax, eax
lea r11, [rsp + 0x90]
mov byte [rbx], 0
mov rdi, qword [r11 + 0x20]
mov qword [rbx + 0x18], 0xf
mov rbx, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.1400360bc
int3
Function at 0x140014484
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rdi, rcx
mov rbx, rdx
lea rcx, [rbp - 0x79]
call fcn.140006148
xor r14d, r14d
cmp byte [rax + 8], r14b
je 0x1400144d5
mov rdx, rax
lea ecx, [r14 + 9]
xor byte [rdx], 0x48
inc rdx
sub rcx, 1
jne 0x1400144c9
mov r15d, 0xf
mov qword [rbp - 0x61], r14
mov rdx, rax
mov qword [rbp - 0x59], r15
lea rcx, [rbp - 0x71]
mov byte [rbp - 0x71], r14b
call fcn.14000e208
lea r8, [0x140058ccc]
lea rdx, [rbp - 0x71]
lea rcx, [rbp + 0xf]
call fcn.1400035f0
mov rdx, rax
lea rcx, [rbp - 0x51]
mov r8, rdi
call fcn.140003450
mov rdx, rax
lea r8, [0x140058cc8]
lea rcx, [rbp - 0x11]
call fcn.1400034b8
mov rdx, rax
lea rcx, [rbp - 0x31]
mov r8, rbx
call fcn.140003450
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x14001454e
mov rcx, qword [rbp - 0x11]
inc rdx
call fcn.1400038b4
mov rdx, qword [rbp - 0x39]
mov qword [rbp - 1], r14
mov qword [rbp + 7], r15
mov byte [rbp - 0x11], r14b
cmp rdx, 0x10
jb 0x140014570
mov rcx, qword [rbp - 0x51]
inc rdx
call fcn.1400038b4
mov rdx, qword [rbp + 0x27]
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x39], r15
mov byte [rbp - 0x51], r14b
cmp rdx, 0x10
jb 0x140014592
mov rcx, qword [rbp + 0xf]
inc rdx
call fcn.1400038b4
movdqa xmm0, xmmword [0x1400591f0]
lea rdx, [0x1400589df]
lea rcx, [rbp - 0x51]
mov byte [rbp - 0x51], r14b
movdqu xmmword [rbp - 0x41], xmm0
call fcn.14000e208
xorps xmm0, xmm0
lea rdx, [rbp - 0x31]
lea rcx, [rbp + 0xf]
movdqu xmmword [rbp + 0x1f], xmm0
call fcn.14000c9e8
lea r9, [rbp - 0x51]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0xf]
call fcn.14000c148
mov rdx, qword [rbp - 0x19]
mov esi, eax
cmp rdx, 0x10
jb 0x1400145f2
mov rcx, qword [rbp - 0x31]
inc rdx
call fcn.1400038b4
mov rdx, qword [rbp - 0x59]
mov qword [rbp - 0x21], r14
mov qword [rbp - 0x19], r15
mov byte [rbp - 0x31], r14b
cmp rdx, 0x10
jb 0x140014635
mov rcx, qword [rbp - 0x71]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014630
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400146a6
call fcn.14002fcfc
mov rdx, qword [rdi + 0x18]
mov qword [rbp - 0x61], r14
mov qword [rbp - 0x59], r15
mov byte [rbp - 0x71], r14b
cmp rdx, 0x10
jb 0x140014656
mov rcx, qword [rdi]
inc rdx
call fcn.1400038b4
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r15
mov byte [rdi], r14b
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140014676
mov rcx, qword [rbx]
inc rdx
call fcn.1400038b4
mov qword [rbx + 0x10], r14
mov eax, esi
mov qword [rbx + 0x18], r15
mov byte [rbx], r14b
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140030560
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400360bc
int3
Function at 0x140017138
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x1c]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor ecx, ecx
test eax, eax
js 0x1400171f4
mov qword [rsp + 0x40], rcx
mov word [rsp + 0x30], cx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x48], 7
call fcn.1400367a0
mov r8, rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14000e284
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002d2dc
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140017211
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400171ed
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001722d
call fcn.14002fcfc
jmp 0x140017211
mov qword [rbx + 0x10], rcx
lea rdx, [0x1400589df]
mov byte [rbx], cl
mov rcx, rbx
mov qword [rbx + 0x18], 0xf
call fcn.14000e208
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140030560
add rsp, 0x270
pop rbx
ret
call fcn.1400360bc
int3
Function at 0x1400182b4
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rdx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x10
lea rcx, [rbp + 0x2f]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor ebx, ebx
test eax, eax
je 0x14001839b
lea rcx, [rbp + 0x2f]
mov qword [rbp - 1], rbx
mov qword [rbp + 7], 7
mov word [rbp - 0x11], bx
call fcn.1400367a0
mov r8, rax
lea rdx, [rbp + 0x2f]
lea rcx, [rbp - 0x11]
call fcn.14000e284
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0xf]
call fcn.14002d2dc
mov rdx, rax
lea rcx, [0x14006f630]
call fcn.140006048
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x14001834e
mov rcx, qword [rbp + 0xf]
inc rdx
call fcn.1400038b4
mov rdx, qword [rbp + 7]
mov qword [rbp + 0x1f], rbx
mov qword [rbp + 0x27], 0xf
mov byte [rbp + 0xf], bl
cmp rdx, 8
jb 0x1400183ae
mov rcx, qword [rbp - 0x11]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018394
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400183cb
call fcn.14002fcfc
jmp 0x1400183ae
lea rdx, [0x140058cb8]
lea rcx, [0x14006f630]
call fcn.14000e208
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140030560
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
call fcn.1400360bc
int3
Function at 0x1400183d4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp + 0x3f], rax
and qword [rcx + 0x10], 0
lea rdx, [0x1400589df]
mov r12d, 0xf
mov byte [rcx], 0
mov qword [rcx + 0x18], r12
mov rbx, rcx
call fcn.14000e208
lea rcx, [rbp - 0x29]
call fcn.140008f5c
mov rdx, rax
cmp byte [rax + 0x1a], 0
je 0x140018440
lea ecx, [r12 + 0xc]
xor byte [rax], 0x48
inc rax
sub rcx, 1
jne 0x140018434
and qword [rbp + 0x2f], 0
lea rcx, [rbp + 0x1f]
mov qword [rbp + 0x37], r12
mov byte [rbp + 0x1f], 0
call fcn.14000e208
and qword [rbp + 0xf], 0
mov rdx, r12
movsxd rsi, dword [rbp + 0x2f]
mov qword [rbp + 0x17], rdx
mov byte [rbp - 1], 0
test rsi, rsi
jle 0x14001851a
xor edi, edi
cmp qword [rbp + 0x37], 0x10
lea rax, [rbp + 0x1f]
lea r8, [0x140058d10]
cmovae rax, qword [rbp + 0x1f]
cmp rdx, 0x10
lea rdx, [rbp - 1]
mov cl, byte [rdi + rax]
lea rax, [rbp - 1]
cmovae rax, qword [rbp - 1]
mov qword [rbp + 0xf], 1
mov byte [rax], cl
lea rcx, [rbp - 0x21]
mov byte [rax + 1], 0
call fcn.1400035f0
mov rcx, rax
call fcn.14001e048
test al, al
je 0x1400184db
cmp qword [rbp + 0x17], 0x10
lea rdx, [rbp - 1]
mov r8, qword [rbp + 0xf]
mov rcx, rbx
cmovae rdx, qword [rbp - 1]
call fcn.14000e108
mov rdx, qword [rbp + 0x17]
inc rdi
cmp rdi, rsi
jl 0x140018475
cmp rdx, 0x10
jb 0x14001851a
mov rcx, qword [rbp - 1]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018515
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018585
call fcn.14002fcfc
and qword [rbp + 0xf], 0
mov rdx, qword [rbp + 0x37]
mov qword [rbp + 0x17], r12
mov byte [rbp - 1], 0
cmp rdx, 0x10
jb 0x14001855e
mov rcx, qword [rbp + 0x1f]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018559
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018585
call fcn.14002fcfc
mov rax, rbx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140030560
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
call fcn.1400360bc
int3
Function at 0x14001897c
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rcx, [rbp - 0x19]
call fcn.14000a188
xor r8d, r8d
cmp byte [rax + 0x12], r8b
je 0x1400189bd
mov rcx, rax
lea edx, [r8 + 0x13]
xor byte [rcx], 0x48
inc rcx
sub rdx, 1
jne 0x1400189b1
mov rdx, rax
mov qword [rbp + 0x1f], r8
lea rcx, [rbp + 0xf]
mov qword [rbp + 0x27], 0xf
mov byte [rbp + 0xf], r8b
call fcn.14000e208
xorps xmm0, xmm0
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x11]
movdqu xmmword [rbp - 1], xmm0
call fcn.14000c9e8
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0x2f]
call fcn.14000c420
mov rdx, rax
lea rcx, [0x14006f550]
call fcn.140006048
mov rdx, qword [rbp + 0x47]
cmp rdx, 0x10
jb 0x140018a20
mov rcx, qword [rbp + 0x2f]
inc rdx
call fcn.1400038b4
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x140018a57
mov rcx, qword [rbp + 0xf]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018a52
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018a6c
call fcn.14002fcfc
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140030560
add rsp, 0x90
pop rbp
ret
call fcn.1400360bc
int3
Function at 0x140019f8c
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x2d0]
sub rsp, 0x3d0
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
xor edx, edx
lea rcx, [rbp - 0x7c]
mov r8d, 0x12c
mov rdi, rax
call fcn.1400313e0
mov dword [rbp - 0x80], 0x130
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rbp - 0x80]
mov rcx, rdi
mov esi, eax
call sub.KERNEL32.dll_Process32First
xor r15d, r15d
jmp 0x14001a01b
mov eax, dword [0x140070a20]
lea rdx, [rbp - 0x80]
cmp dword [rbp - 0x78], esi
cmove eax, dword [rbp - 0x60]
mov dword [0x140070a20], eax
call sub.KERNEL32.dll_Process32Next
mov rcx, rdi
test eax, eax
jne 0x140019fff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [0x140070a20]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12d, 0xf
mov qword [rsp + 0x30], r15
lea rdx, [0x1400589df]
mov qword [rsp + 0x38], r12
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x20], r15b
mov r14, rax
call fcn.14000e208
test r14, r14
je 0x14001a1bc
mov r9d, 0x104
lea r8, [rbp + 0xb0]
xor edx, edx
mov rcx, r14
call sub.PSAPI.DLL_GetModuleFileNameExW
lea edi, [r12 + 0x11]
test eax, eax
je 0x14001a1ae
lea rcx, [rbp + 0xb0]
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r15w
call fcn.1400367a0
mov r8, rax
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x40]
call fcn.14000e284
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14002d2dc
mov rsi, rax
lea rax, [rsp + 0x20]
cmp rax, rsi
je 0x14001a149
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001a11f
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a11a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a205
call fcn.14002fcfc
mov r8, rdi
mov qword [rsp + 0x30], r15
mov rdx, rsi
mov qword [rsp + 0x38], r12
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x20], r15b
call fcn.140030fd0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r12
mov byte [rsi], r15b
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14001a161
mov rcx, qword [rsp + 0x60]
inc rdx
call fcn.1400038b4
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r12
mov byte [rsp + 0x60], r15b
cmp rdx, 8
jb 0x14001a1ae
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a1a9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a205
call fcn.14002fcfc
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, rdi
jmp 0x14001a1c2
mov r8d, 0x20
mov qword [rbx + 0x10], r15
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov qword [rbx + 0x18], r15
call fcn.140030fd0
mov rax, rbx
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.140030560
lea r11, [rsp + 0x3d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400360bc
int3
Function at 0x14001a37c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [rsp + 0x30]
call fcn.1400097bc
xor r8d, r8d
mov r9d, 0xf
cmp byte [rax + 0xe], r8b
je 0x14001a3b0
mov rcx, rax
mov edx, r9d
xor byte [rcx], 0x48
inc rcx
sub rdx, 1
jne 0x14001a3a4
mov rdx, rax
mov qword [rbx + 0x10], r8
mov rcx, rbx
mov qword [rbx + 0x18], r9
mov byte [rbx], r8b
call fcn.14000e208
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14001b5a4
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rsp + 0x80], rax
and qword [rcx + 0x10], 0
mov rbx, rcx
mov edi, 0xf
mov dword [rsp + 0x40], 0x40
mov qword [rcx + 0x18], rdi
mov byte [rcx], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x14001b6e7
mov rcx, qword [rsp + 0x48]
xorps xmm0, xmm0
test rcx, rcx
js 0x14001b606
cvtsi2ss xmm0, rcx
jmp 0x14001b61b
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mulss xmm0, dword [0x1400591d0]
call fcn.14003b228
cvttss2si edx, xmm0
lea rcx, [rsp + 0x20]
call fcn.140003f68
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x14001b6ab
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14001b67a
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14001b675
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001b71a
mov rcx, r8
call fcn.14002fcfc
and qword [rbx + 0x10], 0
lea rdx, [rsp + 0x20]
mov r8d, 0x20
mov qword [rbx + 0x18], rdi
mov rcx, rbx
mov byte [rbx], 0
call fcn.140030fd0
and qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x20], 0
jmp 0x14001b6b0
mov rdi, qword [rsp + 0x38]
cmp rdi, 0x10
jb 0x14001b6f6
mov rcx, qword [rsp + 0x20]
lea rdx, [rdi + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b6e0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b71a
call fcn.14002fcfc
jmp 0x14001b6f6
lea rdx, [0x1400589df]
mov rcx, rbx
call fcn.14000e208
mov rax, rbx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140030560
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
call fcn.1400360bc
int3

Function at 0x14001b9dc
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp + 0x180], rax
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x101
lea rcx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor ebx, ebx
mov qword [rsp + 0x40], 7
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x28], bx
call fcn.1400367a0
mov r8, rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.14000e284
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x48]
call fcn.14002d2dc
mov rdx, rax
lea rcx, [0x14006f610]
call fcn.140006048
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14001ba81
mov rcx, qword [rsp + 0x48]
inc rdx
call fcn.1400038b4
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], bl
cmp rdx, 8
jb 0x14001bad1
mov rcx, qword [rsp + 0x28]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bacc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001baf1
call fcn.14002fcfc
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140030560
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x290
pop rbp
ret
call fcn.1400360bc
int3
Function at 0x14001e048
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400287a4
cmp qword [rsp + 0x38], 8
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov rdx, qword [rsp + 0x38]
xor esi, esi
test eax, eax
setne dil
cmp rdx, 8
jb 0x14001e0b2
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
call fcn.1400038b4
mov rdx, qword [rbx + 0x18]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], si
cmp rdx, 0x10
jb 0x14001e0da
mov rcx, qword [rbx]
inc rdx
call fcn.1400038b4
mov qword [rbx + 0x10], rsi
mov al, dil
mov qword [rbx + 0x18], 0xf
mov byte [rbx], sil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140030560
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x14001e80c
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x20]
call fcn.14000a05c
xor r8d, r8d
cmp byte [rax + 0xa], r8b
je 0x14001e845
mov rcx, rax
lea edx, [r8 + 0xb]
xor byte [rcx], 0x48
inc rcx
sub rdx, 1
jne 0x14001e839
mov rdx, rax
mov qword [rsp + 0x58], r8
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], r8b
call fcn.14000e208
xorps xmm0, xmm0
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
movdqu xmmword [rsp + 0x38], xmm0
call fcn.14000c9e8
lea rcx, [rsp + 0x28]
call fcn.14001ebbc
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14001e8c0
mov rcx, qword [rsp + 0x48]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e8bb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e8d2
call fcn.14002fcfc
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140030560
add rsp, 0x78
ret
call fcn.1400360bc
int3
Function at 0x14001ec24
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov edi, ecx
lea rcx, [rbp - 0x19]
call fcn.14000721c
xor ebx, ebx
cmp byte [rax + 0x11], bl
je 0x14001ec6e
mov rcx, rax
lea r8d, [rbx + 0x12]
xor byte [rcx], 0x48
inc rcx
sub r8, 1
jne 0x14001ec62
mov rdx, rax
mov qword [rbp + 0x3f], rbx
lea rcx, [rbp + 0x2f]
mov qword [rbp + 0x47], 0xf
mov byte [rbp + 0x2f], bl
call fcn.14000e208
mov edx, edi
lea rcx, [rbp + 0xf]
call fcn.140003f68
cmp qword [rbp + 0x27], 0x10
lea rdx, [rbp + 0xf]
mov r8, qword [rbp + 0x1f]
lea rcx, [rbp + 0x2f]
cmovae rdx, qword [rbp + 0xf]
call fcn.14000e108
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x14001ecc5
mov rcx, qword [rbp + 0xf]
inc rdx
call fcn.1400038b4
movdqa xmm0, xmmword [0x1400591f0]
lea rdx, [0x1400589df]
lea rcx, [rbp + 0xf]
mov byte [rbp + 0xf], bl
movdqu xmmword [rbp + 0x1f], xmm0
call fcn.14000e208
xorps xmm0, xmm0
lea rdx, [rbp + 0x2f]
lea rcx, [rbp - 0x11]
movdqu xmmword [rbp - 1], xmm0
call fcn.14000c9e8
lea r9, [rbp + 0xf]
mov r8b, 1
xor edx, edx
lea rcx, [rbp - 0x11]
call fcn.14000c148
mov rdx, qword [rbp + 0x47]
test eax, 0xffffff7f
setne bl
cmp rdx, 0x10
jb 0x14001ed4b
mov rcx, qword [rbp + 0x2f]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ed46
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ed6e
call fcn.14002fcfc
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140030560
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.1400360bc
int3
Function at 0x14001effc
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
xor edx, edx
mov dword [rbp - 0x80], 0x238
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
xor edi, edi
mov qword [rsp + 0x78], 0xf
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x70], rdi
mov rcx, rax
mov byte [rsp + 0x60], dil
mov rbx, rax
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x14001f162
lea rdx, [rbp - 0x80]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x14001f162
lea rcx, [rbp - 0x54]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], di
call fcn.1400367a0
mov r8, rax
lea rdx, [rbp - 0x54]
lea rcx, [rsp + 0x20]
call fcn.14000e284
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14002d2dc
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001f0f8
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f0f3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f221
call fcn.14002fcfc
lea r8, [0x140070e10]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14000358c
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x14001f11b
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rsp + 0x60]
call fcn.14000e108
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001f141
mov rcx, qword [rsp + 0x20]
inc rdx
call fcn.1400038b4
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14001f065
mov rcx, qword [rsp + 0x40]
inc rdx
call fcn.1400038b4
jmp 0x14001f065
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movdqa xmm0, xmmword [0x1400591f0]
lea rdx, [0x1400589df]
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x40], dil
movdqu xmmword [rsp + 0x50], xmm0
call fcn.14000e208
xorps xmm0, xmm0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x30], xmm0
call fcn.14000c9e8
lea r9, [rsp + 0x40]
mov r8b, 1
lea rdx, [rsp + 0x20]
mov ecx, 0x13
call fcn.14001cda0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14001f1f7
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f1f2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f21b
call fcn.14002fcfc
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140030560
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.1400360bc
int3
call fcn.1400360bc
int3