joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008567
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400214a4
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
xor ebx, ebx
mov dword [rsp + 0x20], 0x7361736c
xor edx, edx
mov dword [rsp + 0x24], 0x78652e73
mov word [rsp + 0x28], 0x65
lea ecx, [rbx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002152f
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x130
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x140021526
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x5c]
call fcn.14000776b
test eax, eax
je 0x140021522
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
jmp 0x1400214fc
mov ebx, dword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x160]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x14000856c
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140074bcc
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov sil, dl
mov ecx, dword [0x140156850]
call fcn.140002f95
mov rdi, rax
test rax, rax
je 0x140074c14
cmp qword [rax + 0x38], rbx
je 0x140074c48
cmp byte [rax + 0x88], 0
jne 0x140074c0c
lea rcx, [rax - 0x10]
call fcn.140007536
mov rcx, rdi
call fcn.1400055e2
mov rcx, rbx
call fcn.140006e1f
mov dl, sil
mov rcx, rbx
call fcn.140004d77
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call fcn.140005691
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
lea rcx, [rsp + 0x20]
call fcn.1400043d1
lea rdx, [0x14014e9d0]
lea rcx, [rsp + 0x20]
call fcn.140007829
int3

Function at 0x140008706
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x14007e2a0
mov rdx, rcx
mov ecx, dword [0x140156850]
jmp fcn.140003936
Function at 0x1400087c9
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400ed434
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov r14, rdx
mov rbx, rcx
call fcn.140005943
mov bpl, al
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edi, edi
test eax, eax
je 0x1400ed487
test rbx, rbx
je 0x1400ed478
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bpl, bpl
je 0x1400ed487
mov edi, 4
jmp 0x1400ed530
call fcn.140001cbc
test al, al
jne 0x1400ed4a4
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb edi, edi
neg edi
add edi, 3
jmp 0x1400ed530
test bpl, bpl
je 0x1400ed507
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
lea r8, [0x1400ed1ec]
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rsp + 0x30], r14
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400ed530
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rcx, rbx
test eax, eax
je 0x1400ed501
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400ed530
mov edi, dword [rsp + 0x44]
jmp 0x1400ed4f9
call fcn.140008486
test al, al
jne 0x1400ed518
bts esi, 0x15
xor ecx, ecx
jmp 0x1400ed520
call fcn.1400037d3
mov rcx, rax
mov r9d, esi
mov r8, r14
mov rdx, rbx
call fcn.140006ad7
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret

Function at 0x14000885f
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140092b4c
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx]
mov rsi, rcx
mov rbp, r8
mov r14, rdx
mov rdi, qword [rax + 0x28]
mov rcx, rdi
call fcn.140004b51
mov r8b, 1
lea rdx, [rsi + 0x38]
mov rcx, rsi
call rdi
mov r8, rbp
mov rdx, r14
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp 0x140006b45

Function at 0x1400089c7
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x14007a970
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rsi, [rcx + 0x218]
mov rdi, rcx
mov rcx, rsi
mov rbx, rdx
call fcn.140003f49
mov eax, dword [rdi + 0x228]
cmp dword [rbx], eax
je 0x14007a9b8
mov ecx, 1
mov eax, ecx
lock xadd dword [rdi + 0x228], eax
add eax, ecx
inc eax
test eax, 0xfffffffe
je 0x14007a9a3
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14000563c

Function at 0x140008a9e
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140075bf4
sub rsp, 0x28
mov ecx, dword [0x140156850]
call fcn.140002f95
mov rcx, rax
xor eax, eax
test rcx, rcx
je 0x140075c12
call fcn.140003aa8
add rsp, 0x28
ret
Function at 0x140008f03
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x14007f464
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, rdx
mov rbx, rcx
or dword [rcx + 8], 0xfffffff
mov qword [rcx + 0x10], rdx
and dword [rcx + 0x20], 0
mov dword [rcx + 0x24], 0x80000000
and qword [rcx + 0x28], 0
mov dword [rcx + 0x58], 0
add rcx, 0x60
call fcn.140002d06
nop
and qword [rbx + 0xb0], 0
and qword [rbx + 0xb8], 0
mov dword [rbx + 0xc8], 0
and dword [rbx + 0xd4], 0
and qword [rbx + 0xd8], 0
test rdi, 0xfffffffffffffffd
je 0x14007f4e8
lock inc dword [rdi + 8]
test dword [0x140150328], 0x80000000
je 0x14007f504
mov ecx, dword [0x140156850]
call fcn.140002f95
test rax, rax
jne 0x14007f509
call fcn.140009ae3
mov qword [rbx + 0x18], rax
mov rax, qword [rax + 0x60]
mov qword [rbx], rax
mov rcx, rbx
call fcn.1400024e1
lea rcx, [rbx + 0x60]
call fcn.140002964
mov qword [rbx + 0xa8], rbx
call fcn.140001073
mov rdi, rax
cmp qword [rax + 0x40], 0
jne 0x14007f543
mov rcx, rax
call fcn.140009bab
mov rax, qword [rdi + 0x40]
mov ecx, dword [rax + 0xa0]
mov dword [rbx + 0xd0], ecx
and dword [rbx + 8], 0xfffffff
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14000908e
Capabilities:
Create thread

Disassembly:
jmp 0x140069278
jmp qword [sym.imp.KERNEL32.dll_CreateThread]

Function at 0x14000925f
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140094970
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1401569a8], eax
cmp eax, 0xffffffff
je 0x14009498a
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140004381
lea rdx, [0x14014e7f0]
lea rcx, [rsp + 0x20]
call fcn.140007829
int3

Function at 0x14000986d
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400653c4
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov edi, edx
mov rbx, rcx
call fcn.1400019c4
mov r8d, dword [rbx + 0x10]
mov ecx, eax
shr r8d, 2
test r8b, 1
jne 0x140065462
mov r8d, dword [rbx + 0x10]
shr r8d, 1
test r8b, 1
je 0x140065402
mov eax, dword [rbx + 0x10]
shr eax, 3
shr edi, 3
sub eax, edi
jmp 0x140065407
mov eax, 1
lea r8d, [rcx + 2]
cmp eax, r8d
ja 0x140065462
dec eax
lea rcx, [0x1400075a9]
imul eax, dword [0x140150310]
xor edx, edx
mov qword [rsp + 0x30], rcx
div r8d
add eax, dword [0x140150310]
jne 0x14006543c
mov dword [rsp + 0x28], 4
jmp 0x14006544d
and dword [rsp + 0x24], 0
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 1
mov eax, dword [rbx + 0x10]
test al, 1
je 0x140065462
lea rcx, [rsp + 0x20]
call fcn.140006b09
test al, al
jne 0x14006544d
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp fcn.140007e5a

Function at 0x14001f748
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x14001f748
push rbx
sub rsp, 0x20
mov r9d, 0x6c078965
or r8d, 0xffffffff
mov rbx, rcx
call fcn.14000321f
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14001fe30
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x14001fe30
push rbx
sub rsp, 0x20
cmp dword [rcx], 0x270
mov rbx, rcx
jne 0x14001fe48
call fcn.140004237
jmp 0x14001fe55
cmp dword [rcx], 0x4e0
jb 0x14001fe55
call fcn.1400054e3
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x140020114
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x140020114
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
movdqa xmm0, xmmword [str.RtlAdjustPrivile]
mov esi, ecx
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x6c64746e
movdqu xmmword [rbp - 0x20], xmm0
mov ebx, r8d
mov dword [rbp - 0x2c], 0x6c642e6c
mov edi, edx
mov word [rbp - 0x28], 0x6c
mov word [rbp - 0x10], 0x6567
mov byte [rbp - 0xe], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp - 0x20]
call fcn.140002ce8
lea r9, [rbp + 0x28]
mov r8b, bl
mov dl, dil
mov ecx, esi
call rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret

Function at 0x1400201b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x1400201b8
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r15, rcx
mov dword [rbp - 0x20], 0x730075
xor r12d, r12d
mov dword [rbp - 0x1c], 0x720065
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], r12w
mov edi, r9d
mov dword [rbp - 0x18], 0x320033
mov rsi, r8
mov dword [rbp - 0x14], 0x64002e
mov r14, rdx
mov dword [rbp - 0x10], 0x6c006c
mov dword [rbp - 0x30], 0x7373654d
mov dword [rbp - 0x2c], 0x42656761
mov dword [rbp - 0x28], 0x57786f
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x140020260
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140020257
mov r9d, edi
mov r8, rsi
mov rdx, r14
mov rcx, r15
call rax
jmp 0x140020262
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140020748
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x140020748
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
movdqa xmm0, xmmword [str.CheckRemoteDebug]
lea rcx, [rbp - 0x40]
xor ebx, ebx
mov dword [rbp - 0x40], 0x65006b
mov word [rbp - 0x28], bx
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 6], bl
mov dword [rbp - 0x3c], 0x6e0072
mov dword [rbp - 0x38], 0x6c0065
mov dword [rbp - 0x34], 0x320033
mov dword [rbp - 0x30], 0x64002e
mov dword [rbp - 0x2c], 0x6c006c
mov dword [rbp - 0x10], 0x50726567
mov dword [rbp - 0xc], 0x65736572
mov word [rbp - 8], 0x746e
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
jne 0x1400207d2
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne al
jmp 0x14002080f
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140020802
test rdi, rdi
je 0x140020804
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call rdi
test eax, eax
je 0x140020804
mov bl, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, bl
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14002085c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x14002085c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
xor ebx, ebx
mov dword [rbp - 0x19], 0x6e72656b
lea rcx, [rbp - 0x19]
mov byte [rbp - 0xd], bl
mov dword [rbp - 0x15], 0x32336c65
mov dword [rbp - 0x11], 0x6c6c642e
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400208fa
movdqa xmm0, xmmword [str.GlobalMemoryStat]
lea rdx, [rbp - 9]
mov rcx, rax
mov dword [rbp + 7], 0x78457375
movdqu xmmword [rbp - 9], xmm0
mov byte [rbp + 0xb], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400208ef
lea rcx, [rbp + 0x17]
mov dword [rbp + 0x17], 0x40
call rax
test eax, eax
je 0x1400208ef
movzx eax, bl
mov ecx, 0x80000000
cmp qword [rbp + 0x1f], rcx
mov edx, 1
cmovb eax, edx
mov bl, al
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, bl
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140020b94
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x140020b94
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rdi, rcx
mov dword [rsp + 0x20], 0x6e72656b
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x24], 0x32336c65
mov dword [rsp + 0x28], 0x6c6c642e
mov byte [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x140020be5
xor al, al
jmp 0x140020c67
movdqa xmm0, xmmword [str.GetModuleFileNam]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov word [rsp + 0x40], 0x4165
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x42], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140020c1d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140020bde
mov r8d, 0x104
lea rdx, [rsp + 0x70]
xor ecx, ecx
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140009b56
xor r8d, r8d
lea rcx, [rsp + 0x48]
mov rdx, rdi
call fcn.140005bff
cmp rax, 0xffffffffffffffff
lea rcx, [rsp + 0x48]
setne bl
call fcn.140002a22
mov al, bl
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140020ec4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x140020ec4
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa8
movdqa xmm0, xmmword [str.QueryPerformance]
lea rcx, [rbp - 0x29]
xor edi, edi
movaps xmmword [rax - 0x48], xmm6
mov word [rbp - 0x11], di
movdqu xmmword [rbp - 9], xmm0
mov byte [rbp - 0x43], dil
movdqu xmmword [rbp - 0x41], xmm0
mov dword [rbp - 0x29], 0x65006b
mov dword [rbp - 0x25], 0x6e0072
mov dword [rbp - 0x21], 0x6c0065
mov dword [rbp - 0x1d], 0x320033
mov dword [rbp - 0x19], 0x64002e
mov dword [rbp - 0x15], 0x6c006c
mov dword [rbp + 7], 0x71657246
mov dword [rbp + 0xb], 0x636e6575
mov word [rbp + 0xf], 0x79
mov dword [rbp - 0x31], 0x6e756f43
mov dword [rbp - 0x2d], 0x726574
mov dword [rbp - 0x51], 0x54746547
mov dword [rbp - 0x4d], 0x436b6369
mov dword [rbp - 0x49], 0x746e756f
mov word [rbp - 0x45], 0x3436
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140021087
lea rdx, [rbp - 9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x41]
mov rcx, rsi
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x51]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test r15, r15
je 0x14002107e
test rbx, rbx
je 0x14002107e
test rax, rax
je 0x14002107e
lea rcx, [rbp + 0x7f]
call r15
lea rcx, [rbp + 0x77]
call rbx
lea r15d, [rdi + 0x37]
lea rdx, [rbp + 0x67]
mov dword [rbp + 0x67], r15d
lea rcx, [rbp - 0x59]
call fcn.140001b5e
mov rcx, rax
call fcn.1400098a4
lea rcx, [rbp + 0x6f]
call rbx
mov rax, qword [rbp + 0x6f]
xorps xmm6, xmm6
sub rax, qword [rbp + 0x77]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rbp + 0x7f]
cvtsi2sd xmm6, rax
divsd xmm6, xmm0
call r14
lea rdx, [rbp + 0x67]
mov dword [rbp + 0x67], r15d
lea rcx, [rbp - 0x59]
mov rbx, rax
call fcn.140001b5e
mov rcx, rax
call fcn.1400098a4
call r14
sub rax, rbx
mulsd xmm6, qword [0x14010ee38]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
jns 0x14002104e
addsd xmm1, qword [0x14010ee48]
movaps xmm0, xmm1
mulsd xmm0, qword [0x14010ee18]
comisd xmm0, xmm6
ja 0x14002106d
mulsd xmm1, qword [0x14010ee28]
comisd xmm6, xmm1
jbe 0x140021070
mov dil, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, dil
jmp 0x140021089
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140021184
Capabilities:
Encode data using base64

Disassembly:
jmp 0x140021184
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 8], 0xfffffffffffffffe
mov r15, rdx
mov rdi, rcx
and dword [rbp - 0x10], 0
mov rcx, rdx
call fcn.140007e69
mov r14, rax
xor ebx, ebx
xor r12d, r12d
mov rcx, rdi
call fcn.140006947
mov dword [rbp - 0x10], 1
test r14d, r14d
je 0x140021349
dec r14d
movsxd rsi, r12d
mov rdx, rsi
mov rcx, r15
call fcn.1400069a1
cmp byte [rax], 0x3d
je 0x1400212a6
mov rdx, rsi
mov rcx, r15
call fcn.1400069a1
mov cl, byte [rax]
call fcn.14000811b
test al, al
je 0x1400212a6
mov rdx, rsi
mov rcx, r15
call fcn.1400069a1
movsxd rcx, ebx
mov al, byte [rax]
mov byte [rbp + rcx + 0x58], al
inc ebx
inc r12d
cmp ebx, 4
jne 0x14002129d
xor ebx, ebx
lea rsi, [rbp + 0x58]
xor r8d, r8d
mov dl, byte [rsi]
lea rcx, [0x140155200]
call fcn.1400081d9
sub al, bl
and al, 0x3f
mov byte [rsi], al
inc ebx
inc rsi
cmp ebx, 4
jl 0x14002122c
mov dl, byte [rbp + 0x59]
mov cl, dl
shr cl, 4
and cl, 3
mov al, byte [rbp + 0x58]
shl al, 2
add cl, al
mov byte [rbp + 0x50], cl
mov cl, byte [rbp + 0x5a]
mov al, cl
shr al, 2
and al, 0xf
shl dl, 4
add al, dl
mov byte [rbp + 0x51], al
shl cl, 6
add cl, byte [rbp + 0x5b]
mov byte [rbp + 0x52], cl
lea rbx, [rbp + 0x50]
mov esi, 3
mov rdx, rbx
mov rcx, rdi
call fcn.140001460
inc rbx
sub rsi, 1
jne 0x140021287
xor ebx, ebx
test r14d, r14d
jne 0x1400211d4
test ebx, ebx
je 0x140021349
cmp ebx, 4
jge 0x1400212cd
movsxd rax, ebx
lea rcx, [rbp + 0x58]
add rcx, rax
mov r8d, 4
sub r8d, ebx
xor edx, edx
call fcn.1400054a7
xor esi, esi
lea r14, [rbp + 0x58]
xor r8d, r8d
mov dl, byte [r14]
lea rcx, [0x140155200]
call fcn.1400081d9
sub al, sil
and al, 0x3f
mov byte [r14], al
inc esi
inc r14
cmp esi, 4
jl 0x1400212d3
mov dl, byte [rbp + 0x59]
mov cl, dl
shr cl, 4
and cl, 3
mov al, byte [rbp + 0x58]
shl al, 2
add cl, al
mov byte [rbp + 0x50], cl
mov cl, byte [rbp + 0x5a]
mov al, cl
shr al, 2
and al, 0xf
shl dl, 4
add al, dl
mov byte [rbp + 0x51], al
shl cl, 6
add cl, byte [rbp + 0x5b]
mov byte [rbp + 0x52], cl
lea eax, [rbx - 1]
test eax, eax
jle 0x140021349
lea rbx, [rbp + 0x50]
mov esi, eax
mov rdx, rbx
mov rcx, rdi
call fcn.140001460
inc rbx
sub rsi, 1
jne 0x140021335
mov rax, rdi
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400213d4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1400213d4
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
mov rbp, rdx
mov rcx, rdx
call fcn.140007a18
mov rcx, rsi
mov r14, rax
xor edi, edi
call fcn.140007a18
test rax, rax
je 0x14002145e
mov rdx, rdi
mov rcx, rsi
call fcn.1400065fa
mov rdx, rdi
mov rcx, rsi
mov rbx, rax
call fcn.1400065fa
mov cl, byte [rbx]
mov rdx, rdi
ror cl, 1
mov byte [rax], cl
mov rcx, rsi
call fcn.1400065fa
mov rbx, rax
xor edx, edx
mov rax, rdi
mov rcx, rbp
div r14
call fcn.140001e06
inc rdi
mov cl, byte [rax]
xor byte [rbx], cl
mov rcx, rsi
call fcn.140007a18
cmp rdi, rax
jb 0x14002140d
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400214a4
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
jmp 0x1400214a4
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
xor ebx, ebx
mov dword [rsp + 0x20], 0x7361736c
xor edx, edx
mov dword [rsp + 0x24], 0x78652e73
mov word [rsp + 0x28], 0x65
lea ecx, [rbx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002152f
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x130
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x140021526
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x5c]
call fcn.14000776b
test eax, eax
je 0x140021522
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
jmp 0x1400214fc
mov ebx, dword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x160]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140021cdc
Capabilities:
Contain obfuscated stackstrings
Reference processor manufacturer constants

Disassembly:
jmp 0x140021cdc
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov dword [rsp + 0x40], 0x6e72656b
mov dword [rsp + 0x44], 0x32336c65
mov dword [rsp + 0x48], 0x6c6c642e
xor ebx, ebx
mov byte [rsp + 0x4c], bl
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140021edb
movdqa xmm0, xmmword [str.GetComputerNameA]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x78], bl
movdqa xmm1, xmmword [str.GetVolumeInforma]
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x6e6f6974
mov word [rsp + 0x64], 0x41
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test r14, r14
je 0x140021ed2
test rax, rax
je 0x140021ed2
mov dword [rbp + 0x90], 0x80
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x30]
call r14
test eax, eax
je 0x140021ed2
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x58]
call fcn.140009b56
nop
mov word [rbp + 0x80], 0x4d56
mov byte [rbp + 0x82], bl
xor r8d, r8d
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x58]
call fcn.1400078ba
cmp rax, 0xffffffffffffffff
je 0x140021df3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140021eb7
mov dword [rbp + 0x88], 0x5c3a43
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8d, 0x80
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x88]
call rsi
test eax, eax
je 0x140021ebb
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x80]
call fcn.140009b56
mov dword [rbp + 0x80], 0x61774d56
mov word [rbp + 0x84], 0x6572
mov byte [rbp + 0x86], bl
mov dword [rbp + 0x98], 0x74726956
mov dword [rbp + 0x9c], 0x6c6175
xor r8d, r8d
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x80]
call fcn.1400078ba
cmp rax, 0xffffffffffffffff
jne 0x140021ea5
xor r8d, r8d
lea rdx, [rbp + 0x98]
lea rcx, [rbp - 0x80]
call fcn.1400078ba
cmp rax, 0xffffffffffffffff
jne 0x140021ea5
lea rcx, [rbp - 0x80]
call fcn.140002a22
jmp 0x140021ebb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rbp - 0x80]
call fcn.140002a22
mov bl, 1
jmp 0x140021ec5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rbp - 0x58]
call fcn.140002a22
mov al, bl
jmp 0x140021edd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
add rsp, 0x150
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret