joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11c70
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbp, rcx
mov qword [rax + 0x20], rdi
lea rcx, [0x00013890]
mov rdi, r8
mov rsi, rdx
xor bx, bx
call sub.ntoskrnl.exe_DbgPrint
cmp dword [rdi + 0x10], 0x34
jne 0x11d99
cmp dword [rdi + 8], 0x34
jne 0x11d99
mov rcx, qword [rbp + 0x40]
mov rax, qword [rsi + 0x18]
xor ebp, ebp
mov qword [rsi + 0x38], rbp
movzx esi, word [rax]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
nop
cmp bx, 0xa
ja 0x11d8a
movzx eax, bx
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x3c], eax
movzx eax, si
mov dword [rsp + 0x4c], ebp
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], ebp
mov dword [rsp + 0x38], 0x113e
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x40], ebp
call fcn.00011112
test word [rsp + 0x38], 0xff00
jne 0x11d1f
cmp word [rsp + 0x48], 0xb
je 0x11d24
inc bx
jmp 0x11cd0
movzx edi, bx
lea rcx, [rsp + 0x38]
movzx ebx, si
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x4c], ebp
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x54], ebp
mov dword [rsp + 0x38], 0x113e
mov dword [rsp + 0x3c], edi
mov dword [rsp + 0x40], 4
call fcn.00011112
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x4c], ebp
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], ebp
mov dword [rsp + 0x38], 0x113f
mov dword [rsp + 0x3c], edi
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], ebx
call fcn.00011112
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
xor eax, eax
jmp 0x11d9e
mov eax, 0xc000000d
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x11fb0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea rcx, [0x000138b0]
mov rbx, r8
mov rsi, rdx
call sub.ntoskrnl.exe_DbgPrint
cmp dword [rbx + 0x10], 0x34
jne 0x12195
cmp dword [rbx + 8], 0x34
jne 0x12195
mov rcx, qword [rdi + 0x40]
mov rdi, qword [rsi + 0x18]
mov qword [rsp + 0x78], rbp
lea rdx, [rsp + 0x20]
xor ebp, ebp
mov qword [rsi + 0x38], rbp
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
mov dword [rsp + 0x44], ebp
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x4c], ebp
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], ebp
mov dword [rsp + 0x38], 0x113e
mov dword [rsp + 0x3c], ebp
movzx eax, word [rdi]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x44], eax
call fcn.00011112
test dword [rsp + 0x38], 0xff00
je 0x12078
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
mov eax, 0xc0000001
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
mov ecx, dword [rsp + 0x40]
mov eax, ecx
or eax, 0xff00
shr eax, 8
je 0x12049
or ecx, 0xff
je 0x12049
cmp eax, ecx
ja 0x12049
mov dword [rsp + 0x44], ebp
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x4c], ebp
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], ebp
mov dword [rsp + 0x38], 0x113e
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x40], ebp
movzx eax, word [rdi]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x44], eax
call fcn.00011112
mov r11d, dword [rsp + 0x48]
and r11d, 5
cmp r11d, 5
jne 0x120e2
mov bx, 1
jmp 0x12137
mov dword [rsp + 0x44], ebp
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x4c], ebp
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], ebp
mov dword [rsp + 0x38], 0x113e
mov dword [rsp + 0x3c], 2
mov dword [rsp + 0x40], ebp
movzx eax, word [rdi]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x44], eax
call fcn.00011112
mov r11d, dword [rsp + 0x48]
and r11d, 5
cmp r11d, 5
mov dword [rsp + 0x48], r11d
jne 0x12049
mov bx, 2
movzx eax, bx
mov dword [rsp + 0x44], ebp
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x4c], ebp
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], ebp
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x38], 0x113f
mov dword [rsp + 0x40], ebp
movzx eax, word [rdi]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x48], 7
mov dword [rsp + 0x44], eax
call fcn.00011112
lea rcx, [rsp + 0x20]
mov word [rdi + 0x16], bx
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
mov qword [rsi + 0x38], 0x34
xor eax, eax
jmp 0x12059
mov eax, 0xc000000d
jmp 0x1205e
Function at 0x121b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
sub rsp, 0x68
cmp dword [r8 + 0x10], 0x34
mov qword [rax + 0x20], rdi
mov rdi, rdx
jne 0x122aa
cmp dword [r8 + 8], 0x34
jne 0x122aa
mov rcx, qword [rcx + 0x40]
mov qword [rax + 0x10], rbx
mov rbx, qword [rdx + 0x18]
mov qword [rax + 0x18], rsi
xor esi, esi
mov qword [rdx + 0x38], rsi
lea rdx, [rax - 0x48]
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
mov dword [rsp + 0x3c], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x4c], esi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x54], esi
mov dword [rsp + 0x38], 0x113e
movzx eax, word [rbx + 0x16]
mov dword [rsp + 0x40], 6
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x3c], eax
movzx eax, word [rbx]
mov dword [rsp + 0x44], eax
call fcn.00011112
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
test word [rsp + 0x38], 0xff00
movzx r11d, word [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
jne 0x12282
mov word [rbx + 0xc], 0
mov word [rbx + 0x14], r11w
mov rbx, qword [rsp + 0x78]
mov qword [rdi + 0x38], 0x34
xor eax, eax
mov rdi, qword [rsp + 0x88]
add rsp, 0x68
ret
mov word [rbx + 0xc], 0x100
mov word [rbx + 0x14], 0
mov rbx, qword [rsp + 0x78]
mov qword [rdi + 0x38], 0x34
xor eax, eax
mov rdi, qword [rsp + 0x88]
add rsp, 0x68
ret
mov eax, 0xc000000d
mov rdi, qword [rsp + 0x88]
add rsp, 0x68
ret

Function at 0x123d0
Capabilities:
Print debug messages
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, rcx
mov qword [rax + 0x20], rdi
lea rcx, [0x000138d0]
mov rbx, r8
mov rdi, rdx
call sub.ntoskrnl.exe_DbgPrint
cmp dword [rbx + 0x10], 0x34
jne 0x1249b
cmp dword [rbx + 8], 0x34
jne 0x1249b
mov rcx, qword [rsi + 0x40]
mov rbx, qword [rdi + 0x18]
lea rdx, [rsp + 0x20]
xor esi, esi
mov qword [rdi + 0x38], rsi
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
mov dword [rsp + 0x3c], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x4c], esi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x54], esi
mov dword [rsp + 0x38], 0x113f
movzx eax, word [rbx + 0x16]
mov dword [rsp + 0x3c], eax
movzx ecx, word [rbx + 0x12]
movzx eax, word [rbx + 0x10]
add ecx, eax
mov dword [rsp + 0x40], ecx
movzx eax, word [rbx]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x44], eax
movzx eax, word [rbx + 0x14]
mov dword [rsp + 0x48], eax
call fcn.00011112
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
mov r11d, dword [rsp + 0x38]
and r11d, 0xff00
neg r11d
sbb eax, eax
and eax, 0xc0000001
jmp 0x124a0
mov eax, 0xc000000d
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x68
ret
Function at 0x12710
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
sub rsp, 0x38
mov qword [rsp + 0x30], rbx
mov qword [rdx + 0x38], 0
mov qword [rsp + 0x28], rsi
mov rsi, qword [rdx + 0x18]
mov qword [rsp + 0x20], rdi
mov rdi, rdx
mov ebx, dword [rsi]
lea rcx, [0x00013af0]
mov edx, ebx
call sub.ntoskrnl.exe_DbgPrint
xor r11d, r11d
lea ecx, [rbx + 0xfff]
mov dword [rsp + 0x54], r11d
mov dword [rsp + 0x50], 0xffffff
mov rdx, qword [rsp + 0x50]
and ecx, 0xfffff000
call qword [sym.imp.ntoskrnl.exe_MmAllocateContiguousMemory]
mov rbx, qword [rsp + 0x30]
test rax, rax
mov qword [rsi + 8], rax
je 0x1279c
lea rcx, [0x00013a80]
mov r8d, 8
mov rdx, rax
mov qword [rsi], rax
call sub.ntoskrnl.exe_DbgPrint
mov qword [rdi + 0x38], 8
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
xor eax, eax
add rsp, 0x38
ret

Function at 0x127c0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
mov eax, dword [r8 + 0x10]
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp eax, 4
mov qword [rsp + 0x28], rdi
mov rdi, qword [rdx + 0x18]
mov qword [rdx + 0x38], rbx
jae 0x12801
lea rcx, [0x00013b10]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc000009a
mov rdi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
lea rcx, [0x00013a60]
movzx edx, al
call sub.ntoskrnl.exe_DbgPrint
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x12843
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmFreeContiguousMemory]
mov eax, ebx
mov rdi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rdi, qword [rsp + 0x28]
mov ebx, 0xc000000d
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret

Function at 0x12860
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
mov rax, qword [rdx + 0x18]
mov qword [rdx + 0x38], 0
test rax, rax
je 0x128d5
mov qword [rsp + 0x30], rbx
mov rbx, qword [rax]
mov qword [rsp + 0x28], rsi
mov esi, dword [rax + 0x10]
mov qword [rsp + 0x20], rdi
mov rdi, qword [rax + 8]
lea rcx, [0x00013ad0]
mov r8, rdi
mov r9d, esi
mov rdx, rbx
call sub.ntoskrnl.exe_DbgPrint
test esi, esi
je 0x128bf
sub rdi, rbx
mov rdx, rsi
nop
movzx ecx, byte [rdi + rbx]
inc rbx
dec rdx
mov byte [rbx - 1], cl
jne 0x128b0
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x38
ret
mov eax, 0xc000000d
add rsp, 0x38
ret
Function at 0x128f0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbp
mov rbp, qword [rdx + 0x18]
mov qword [rdx + 0x38], 0
mov qword [rsp + 0x30], rsi
mov rsi, rdx
mov qword [rsp + 0x28], rdi
mov rdi, qword [rbp]
lea rcx, [0x00013b70]
mov rdx, rdi
call sub.ntoskrnl.exe_DbgPrint
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
lea rcx, [0x00013ab0]
mov r8, rdi
mov rdx, rax
mov rbx, rax
call sub.ntoskrnl.exe_DbgPrint
test ebx, ebx
mov rdi, qword [rsp + 0x28]
je 0x12980
lea rcx, [0x00013b50]
mov edx, ebx
call sub.ntoskrnl.exe_DbgPrint
mov dword [rbp], ebx
mov qword [rsi + 0x38], 4
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, 0xc000000d
add rsp, 0x48
ret

Function at 0x12c00
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x58], rbx
lea rcx, [0x00013c00]
mov qword [rsp + 0x30], rdi
mov rbx, r8
mov rdi, rdx
call sub.ntoskrnl.exe_DbgPrint
cmp dword [rbx + 0x10], 0xc
jne 0x12ce0
cmp dword [rbx + 8], 1
jne 0x12ce0
mov rbx, qword [rdi + 0x18]
movzx ecx, word [rbx + 6]
movzx eax, word [rbx + 8]
movzx r9d, word [rbx + 4]
movzx r8d, word [rbx + 2]
movzx edx, word [rbx]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rcx, [0x00013bb0]
call sub.ntoskrnl.exe_DbgPrint
movzx r11d, word [rbx]
test r11w, r11w
jne 0x12c8f
movzx eax, word [rbx + 0xa]
movzx r9d, word [rbx + 8]
movzx r8d, word [rbx + 6]
movzx edx, word [rbx + 4]
movzx ecx, word [rbx + 2]
mov word [rsp + 0x20], ax
call fcn.000129a0
mov byte [rbx], al
jmp 0x12cb8
cmp r11w, 1
jne 0x12cb8
movzx eax, word [rbx + 0xa]
movzx r9d, word [rbx + 8]
movzx r8d, word [rbx + 6]
movzx edx, word [rbx + 4]
movzx ecx, word [rbx + 2]
mov word [rsp + 0x20], ax
call fcn.00012ac0
mov byte [rbx], al
movzx edx, byte [rbx]
lea rcx, [0x00013ba0]
call sub.ntoskrnl.exe_DbgPrint
mov qword [rdi + 0x38], 1
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
add rsp, 0x38
ret
lea rcx, [0x00013b80]
call sub.ntoskrnl.exe_DbgPrint
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
mov eax, 0xc000000d
add rsp, 0x38
ret

Function at 0x17010
Capabilities:
Create device object

Disassembly:
mov rax, qword [0x00015110]
movabs r9, 0x2b992ddfa232
test rax, rax
je 0x1702b
cmp rax, r9
jne 0x1705a
lea r8, [0x00015110]
movabs rax, 0xfffff78000000320
mov rax, qword [rax]
xor rax, r8
movabs r8, 0xffffffffffff
and rax, r8
cmove rax, r9
mov qword [0x00015110], rax
not rax
mov qword [0x00015108], rax
jmp 0x13320
Function at 0x14000917e
Capabilities:
Create thread
Inject thread

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400c34d4]
mov qword [0x1400c388c], rax
mov rcx, qword [0x1400c34fc]
push qword [0x1400c4620]
sub rsp, 0x28
call fcn.14001e410
add rsp, 0x28
lea rcx, [0x1400c3894]
pop rdx
call fcn.14001e350
push qword [0x1400c3894]
pop rcx
call fcn.14000f260
mov r15, rax
inc r15
mov qword [0x1400c389c], r15
push qword [0x1400c388c]
push 0
push 0x1f0fff
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_OpenProcess
mov qword [0x1400c38a4], rax
cmp qword [0x1400c38a4], 0
je 0x14000938c
sub rsp, 8
push 4
push 0x1000
push qword [0x1400c389c]
push 0
push qword [0x1400c38a4]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_VirtualAllocEx
add rsp, 0x30
mov qword [0x1400c38ac], rax
cmp qword [0x1400c38ac], 0
je 0x140009380
sub rsp, 8
lea rax, [0x1400c38b4]
mov rax, rax
push rax
push qword [0x1400c389c]
push qword [0x1400c3894]
push qword [0x1400c38ac]
push qword [0x1400c38a4]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov r15, qword [0x1400c38b4]
cmp r15, qword [0x1400c389c]
jl 0x14000935e
movabs rax, str.Kernel32.dll
push rax
push 0
pop rcx
pop rdx
call fcn.140013560
and rax, rax
je 0x14000935e
movabs rax, 0x140072752
push rax
push 0
pop rcx
pop rdx
call fcn.1400135c8
mov qword [0x1400c38bc], rax
push 0
pop rcx
call fcn.14001344c
cmp qword [0x1400c38bc], 0
je 0x14000935e
sub rsp, 8
push 0
push 0
push qword [0x1400c38ac]
push qword [0x1400c38bc]
push 0
push 0
push qword [0x1400c38a4]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_CreateRemoteThread
add rsp, 0x40
mov qword [0x1400c38c4], rax
cmp qword [0x1400c38c4], 0
je 0x14000935e
push 0xffffffffffffffff
push qword [0x1400c38c4]
pop rcx
pop rdx
call sub.KERNEL32.dll_WaitForSingleObject
lea rax, [0x1400c347c]
mov rax, rax
push rax
push qword [0x1400c38c4]
pop rcx
pop rdx
call sub.KERNEL32.dll_GetExitCodeThread
push 0x4000
push qword [0x1400c389c]
push qword [0x1400c38ac]
push qword [0x1400c38a4]
pop rcx
pop rdx
pop r8
pop r9
call sub.KERNEL32.dll_VirtualFreeEx
push qword [0x1400c38a4]
pop rcx
call sub.KERNEL32.dll_CloseHandle
push qword [0x1400c34fc]
pop rcx
call fcn.140019744
mov qword [0x1400c347c], rax
add rsp, 0x28
ret
Function at 0x14000d9f7
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push r15
xor rax, rax
push rax
sub rsp, 0x28
movsxd rax, dword [rsp + 0x40]
mov rax, rax
push rax
pop rcx
call sub.USER32.DLL_GetAsyncKeyState
mov r15, rax
and r15, 0x8000
and r15, r15
je 0x14000da3e
mov qword [rsp + 0x28], 1
jmp 0x14000da4f
mov qword [rsp + 0x28], 0
xor rax, rax
jmp 0x14000dbb7
movsxd r15, dword [rsp + 0x48]
cmp r15, 1
je 0x14000da90
push 0x10
pop rcx
call sub.USER32.DLL_GetAsyncKeyState
mov r15, rax
and r15, 0x8000
and r15, r15
je 0x14000da7f
mov qword [rsp + 0x28], 1
jmp 0x14000da90
mov qword [rsp + 0x28], 0
xor rax, rax
jmp 0x14000dbb7
movsxd r15, dword [rsp + 0x50]
cmp r15, 1
je 0x14000dad1
push 0x11
pop rcx
call sub.USER32.DLL_GetAsyncKeyState
mov r15, rax
and r15, 0x8000
and r15, r15
je 0x14000dac0
mov qword [rsp + 0x28], 1
jmp 0x14000dad1
mov qword [rsp + 0x28], 0
xor rax, rax
jmp 0x14000dbb7
movsxd r15, dword [rsp + 0x58]
cmp r15, 1
je 0x14000db12
push 0x12
pop rcx
call sub.USER32.DLL_GetAsyncKeyState
mov r15, rax
and r15, 0x8000
and r15, r15
je 0x14000db01
mov qword [rsp + 0x28], 1
jmp 0x14000db12
mov qword [rsp + 0x28], 0
xor rax, rax
jmp 0x14000dbb7
movsxd r15, dword [rsp + 0x48]
cmp r15, 1
jne 0x14000db45
push 0x10
pop rcx
call sub.USER32.DLL_GetAsyncKeyState
mov r15, rax
and r15, 0x8000
and r15, r15
je 0x14000db45
mov qword [rsp + 0x28], 0
xor rax, rax
jmp 0x14000dbb7
movsxd r15, dword [rsp + 0x50]
cmp r15, 1
jne 0x14000db78
push 0x11
pop rcx
call sub.USER32.DLL_GetAsyncKeyState
mov r15, rax
and r15, 0x8000
and r15, r15
je 0x14000db78
mov qword [rsp + 0x28], 0
xor rax, rax
jmp 0x14000dbb7
movsxd r15, dword [rsp + 0x58]
cmp r15, 1
jne 0x14000dbab
push 0x12
pop rcx
call sub.USER32.DLL_GetAsyncKeyState
mov r15, rax
and r15, 0x8000
and r15, r15
je 0x14000dbab
mov qword [rsp + 0x28], 0
xor rax, rax
jmp 0x14000dbb7
mov rax, 1
jmp 0x14000dbb7
add rsp, 0x30
pop r15
ret
Function at 0x14001168c
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rbx, rdx
xor edi, edi
mov ebp, r8d
mov qword [rax - 0x28], rdi
mov r13, rcx
mov dword [rax - 0x30], 0x80
lea r8d, [rdi + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rbx
mov dword [rax - 0x38], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400117ca
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rsi, eax
test bpl, 1
je 0x14001176b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140012570
mov rsi, rax
test rax, rax
je 0x1400117c1
mov rcx, qword [0x1400c40b0]
mov rdx, r13
call fcn.14001d874
mov r13d, 0x10000
mov rcx, rsi
mov dword [rax + 0x28], r13d
mov rbp, rax
call fcn.140012514
mov rcx, rsi
mov rbx, rax
call fcn.1400124ec
mov r8d, r13d
mov edx, ebx
mov rcx, rax
call fcn.140011ff4
mov qword [rbp], rax
test rax, rax
je 0x140011761
mov qword [rbp + 0x20], rsi
mov rdi, rbp
jmp 0x1400117c1
mov rcx, rsi
call fcn.140012528
jmp 0x1400117c1
mov rcx, qword [0x1400c3454]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1400117c1
lea r9, [rsp + 0x78]
mov r8d, esi
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, esi
mov rdx, rbx
mov rcx, r13
call fcn.140011fec
mov rcx, qword [0x1400c3454]
mov r8, rbx
xor edx, edx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rax, rdi
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
jmp 0x14001168c
Function at 0x1400117e8
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rbx, rdx
xor edi, edi
mov ebp, r8d
mov qword [rax - 0x28], rdi
mov r13, rcx
mov dword [rax - 0x30], 0x80
lea r8d, [rdi + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rbx
mov dword [rax - 0x38], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400117ca
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rsi, eax
test bpl, 1
je 0x14001176b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140012570
mov rsi, rax
test rax, rax
je 0x1400117c1
mov rcx, qword [0x1400c40b0]
mov rdx, r13
call fcn.14001d874
mov r13d, 0x10000
mov rcx, rsi
mov dword [rax + 0x28], r13d
mov rbp, rax
call fcn.140012514
mov rcx, rsi
mov rbx, rax
call fcn.1400124ec
mov r8d, r13d
mov edx, ebx
mov rcx, rax
call fcn.140011ff4
mov qword [rbp], rax
test rax, rax
je 0x140011761
mov qword [rbp + 0x20], rsi
mov rdi, rbp
jmp 0x1400117c1
mov rcx, rsi
call fcn.140012528
jmp 0x1400117c1
mov rcx, qword [0x1400c3454]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1400117c1
lea r9, [rsp + 0x78]
mov r8d, esi
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, esi
mov rdx, rbx
mov rcx, r13
call fcn.140011fec
mov rcx, qword [0x1400c3454]
mov r8, rbx
xor edx, edx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rax, rdi
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
jmp 0x14001168c
Function at 0x140011b80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov r14d, edx
mov r13, rcx
mov rdx, rcx
mov rcx, qword [0x1400c40b0]
mov edi, r8d
xor r12d, r12d
call fcn.14001d914
mov rbx, rax
test rax, rax
je 0x140011b64
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
cmp qword [rax + 0x20], r12
je 0x140011a62
mov rcx, r13
call fcn.14001217c
jmp 0x1400119e0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rbx + 0x2d], r12b
jne 0x1400119d5
mov rcx, qword [rbx + 0x20]
call fcn.14001254c
mov esi, 1
xor edx, edx
mov rcx, rbx
mov dword [rbx + 0x30], r14d
mov byte [rbx + 0x2c], sil
call fcn.1400117f0
lea r11, [rsp + 0x88]
lea r8, [0x14001189c]
mov qword [rsp + 0x28], r11
and dword [rsp + 0x20], r12d
mov r9, rbx
mov edx, 0x2000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140011a3d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xffffffff
je 0x140011a4c
mov edx, edi
mov rcx, r13
call fcn.140012290
mov rcx, qword [rbx]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x68]
mov rcx, qword [rbx]
mov r9d, esi
jmp 0x140011b10
mov esi, 1
mov ebp, r12d
test sil, r14b
cmovne ebp, esi
test r14b, 2
je 0x140011b1d
mov rcx, rax
call fcn.140011b8c
lea rcx, [rbx + 8]
lea edx, [rsi + 0x1f]
call fcn.14001e210
mov rcx, qword [0x1400c40d0]
mov rdx, qword [rsp + 0x30]
mov r9, qword [rcx]
lea r8, [rsp + 0x30]
mov r12, rax
call qword [r9 + 0x28]
test eax, eax
jne 0x140011b64
mov rcx, qword [rsp + 0x30]
mov byte [r12 + 9], bpl
mov byte [r12 + 8], sil
mov qword [r12], rcx
mov rcx, qword [rsp + 0x30]
mov edx, dword [rbx + 0x14]
mov rax, qword [rcx]
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
mov edx, dword [rbx + 0x10]
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
cmp edi, 0xffffffff
je 0x140011afa
mov r8, r12
mov edx, edi
mov rcx, r13
call fcn.1400121ac
jmp 0x140011b08
mov rcx, qword [rsp + 0x30]
mov edx, dword [rbx + 0x18]
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rcx, qword [rsp + 0x30]
mov r9d, ebp
mov rax, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x60]
jmp 0x140011b64
mov rax, qword [rcx]
call qword [rax + 0x90]
mov rcx, qword [rsp + 0x30]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp edi, 0xffffffff
je 0x140011b42
mov edx, edi
mov rcx, r13
call fcn.140012290
mov rcx, qword [rsp + 0x30]
mov r9d, ebp
xor r8d, r8d
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x60]
test eax, eax
jne 0x140011b64
mov r12, rsi
mov byte [rbx + 0x2c], sil
mov byte [rbx + 0x2e], bpl
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rax, r12
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
or r8d, 0xffffffff
xor edx, edx
jmp 0x14001197c