joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180021fec
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x180022002
mov al, 1
jmp 0x180022062
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x180022013
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x180022060
mov ecx, dword [rcx + 0x18]
nop
call fcn.1800256d0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180022060
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180022060
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180022060
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x180022062
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x180025114
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180025144
xor eax, eax
jmp 0x180025207
mov rbp, rbx
cmp word [rax], si
je 0x180025169
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180025150
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18002514c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800237fc
movsxd r14, eax
test eax, eax
jne 0x1800251a7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18002513d
mov rcx, r14
call fcn.18001ed78
mov rdi, rax
test rax, rax
jne 0x1800251c0
xor ecx, ecx
call fcn.18001df78
jmp 0x18002519c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800237fc
test eax, eax
jne 0x1800251f1
mov rcx, rdi
call fcn.18001df78
jmp 0x1800251fb
xor ecx, ecx
call fcn.18001df78
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x180027d7c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.18001b6b4
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x180027e1d
cmp ebx, dword [rsp + 0x30]
je 0x180027e16
test esi, esi
je 0x180027e16
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x180027df1
sub r8w, 0x61
cmp r8w, 0x19
ja 0x180027dfe
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x180027ddb
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x180027e02
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x180027e1f
mov eax, 1
jmp 0x180027e1f
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18002ba70
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18002ba98
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18002ba98
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140072460
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x140d258a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x140d24ed2], 0
je 0x140072496
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x140d25be0]
aesenc xmm0, xmmword [0x140d25bf0]
aesenc xmm0, xmmword [0x140d25c00]
movq rax, xmm0
ret
jmp 0x14000dd80

Function at 0x140518310
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140cab0e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140518330
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140518338
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140518330
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x140518385
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14051837c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140518330
add rax, 0x28
cmp rax, r9
jne 0x140518368
xor eax, eax
ret

Function at 0x140518390
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140cab0e0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1405183b0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1405183b8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1405183b0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x140518440
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140cab0e0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140518460
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140518468
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x14000b740
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r10, rcx
mov eax, 0xffffffff
test rdx, rdx
je 0x14000b77f
lea r11, [0x140024250]
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [r10]
lea r10, [r10 + 1]
mov r8d, eax
shr eax, 8
xor r9, r8
movzx ecx, r9b
xor eax, dword [r11 + rcx*4]
sub rdx, 1
jne 0x14000b760
not eax
ret

Function at 0x14000b7a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test r8, r8
je 0x14000b7ce
lea r10, [0x140024250]
nop dword [rax]
movzx r9d, byte [rdx]
lea rdx, [rdx + 1]
mov eax, ecx
shr ecx, 8
xor r9, rax
movzx eax, r9b
xor ecx, dword [r10 + rax*4]
sub r8, 1
jne 0x14000b7b0
mov eax, ecx
ret
Function at 0x14000c9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rcx + 0x10], 2
mov r11, rcx
mov r8, qword [rdx]
movabs rax, 0x112e0be826d694b3
imul r8
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
lea r9, [rdx - 1]
sub r8d, eax
cmovns r9, rdx
test r8d, r8d
lea eax, [r8 + 0x3b9aca00]
cmovns eax, r8d
mov dword [rcx + 0xc], eax
movabs rax, 0x8888888888888889
imul r9
add rdx, r9
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3c
lea r8d, [rdx - 1]
sub r9d, eax
lea eax, [r9 + 0x3c]
movzx ecx, al
movzx eax, r9b
cmovns ecx, eax
test r9d, r9d
mov byte [r11 + 0xb], cl
mov eax, 0x88888889
cmovns r8d, edx
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3c
lea r9d, [rdx - 1]
sub r8d, eax
cmovns r9d, edx
test r8d, r8d
lea eax, [r8 + 0x3c]
movzx ecx, al
movzx eax, r8b
cmovns ecx, eax
mov eax, 0x2aaaaaab
imul r9d
mov byte [r11 + 0xa], cl
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
lea ecx, [rdx - 1]
shl eax, 3
sub r9d, eax
cmovns ecx, edx
test r9d, r9d
lea eax, [r9 + 0x18]
movzx edx, al
movzx eax, r9b
cmovns edx, eax
mov eax, 0x92492493
mov byte [r11 + 9], dl
imul ecx
mov eax, 0x92492493
add edx, ecx
sar edx, 2
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
mov r8d, ecx
imul edx, edx, 7
sub r8d, edx
add r8d, 0xa
imul r8d
add edx, r8d
lea r10, [0x1400247a0]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 7
sub r8d, eax
mov eax, 0xb38cf9b1
mov byte [r11 + 5], r8b
imul ecx
add edx, ecx
sar edx, 8
mov r8d, edx
add edx, 0x12c
shr r8d, 0x1f
add r8d, edx
lea edx, [r8 + 1]
cmp dword [r10 + rdx*4], ecx
jg 0x14000cb1c
nop dword [rax + rax]
inc r8d
lea edx, [rdx + 1]
cmp dword [r10 + rdx*4], ecx
jle 0x14000cb10
cmp dword [r10 + r8*4], ecx
jle 0x14000cb2b
dec r8d
cmp dword [r10 + r8*4], ecx
jg 0x14000cb22
sub ecx, dword [r10 + r8*4]
lea r9d, [r8 + 0x686]
mov dword [r11], r9d
lea eax, [rcx + 1]
mov word [r11 + 6], ax
mov eax, r9d
and eax, 0x80000003
jge 0x14000cb52
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x14000cb95
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
imul r8d, edx, 0x64
cmp r9d, r8d
jne 0x14000cb91
mov eax, 0x51eb851f
imul r9d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x190
cmp r9d, eax
jne 0x14000cb95
mov al, 1
jmp 0x14000cb97
xor al, al
test al, al
lea rdx, [0x140024758]
movzx eax, al
lea r10, [0x140024778]
cmove r10, rdx
xor eax, 1
inc eax
shl eax, 6
or eax, 2
mov dword [r11 + 0x10], eax
mov eax, ecx
cdq
inc ecx
and edx, 0x1f
add eax, edx
sar eax, 5
movsxd r9, eax
movzx r8d, word [r10 + r9*2 + 2]
cmp r8d, ecx
jg 0x14000cbf1
nop dword [rax + rax]
movsxd rdx, r9d
inc r9d
movzx r8d, word [r10 + rdx*2 + 4]
cmp r8d, ecx
jle 0x14000cbe0
lea eax, [r9 + 1]
mov byte [r11 + 4], al
movsxd rax, r9d
sub cl, byte [r10 + rax*2]
mov rax, r11
inc cl
mov dword [r11 + 0x14], 0
mov byte [r11 + 8], cl
ret
Function at 0x140010530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
sub rsp, 0x28
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax - 8], rdi
mov qword [rax - 0x10], r12
mov r12, r9
mov qword [rax - 0x18], r13
xor r9d, r9d
mov qword [rax - 0x20], r14
mov r13, rdx
mov rax, rcx
mov qword [rsp], r15
movzx ecx, r8b
mov edx, r9d
shr r8d, 8
test r8d, r8d
jne 0x140010579
mov r8d, 0xffffffff
cmp ecx, 0x24
mov r10b, 1
cmovb edx, ecx
movzx ecx, byte [rax]
cmp cl, 0x2b
jne 0x14001058f
mov r10b, 1
jmp 0x140010598
cmp cl, 0x2d
jne 0x1400105a1
xor r10b, 1
inc rax
add r8d, 0xffffffff
jne 0x140010582
lea rbx, [0x140000000]
test edx, edx
jne 0x1400105f6
cmp byte [rax], 0x30
lea edi, [rdx + 0xa]
jne 0x14001062e
cmp r8d, 1
jbe 0x1400105e1
movzx ecx, byte [rax + 1]
sub cl, 0x58
test cl, 0xdf
jne 0x1400105e1
movzx ecx, byte [rax + 2]
cmp byte [rcx + rbx + 0x253f0], 0x10
jae 0x1400105e1
add rax, 2
lea edi, [rdx + 0x10]
add r8d, 0xfffffffe
jmp 0x14001062e
movzx ecx, byte [rax + 1]
cmp byte [rcx + rbx + 0x253f0], 8
jae 0x14001062e
mov edi, 8
jmp 0x14001062e
mov edi, edx
cmp edx, 0x10
jne 0x14001062e
cmp byte [rax], 0x30
jne 0x14001062e
cmp r8d, 1
jbe 0x14001062e
movzx ecx, byte [rax + 1]
cmp cl, 0x78
je 0x140010616
cmp cl, 0x58
jne 0x14001062e
movzx ecx, byte [rax + 2]
mov edi, edx
cmp byte [rcx + rbx + 0x253f0], 0x10
jae 0x14001062e
add r8d, 0xfffffffe
add rax, 2
mov r14d, edi
mov r15, rax
movsx ebp, byte [r14 + rbx + 0x254f0]
mov rbx, r9
test r8d, r8d
je 0x140010697
lea r13, [0x140000000]
mov qword [rsp + 0x48], rsi
movzx ecx, byte [rax]
test cl, cl
je 0x14001068d
movzx esi, byte [rcx + r13 + 0x253f0]
cmp esi, edi
jae 0x14001068d
mov r11, rbx
imul rbx, r14
add rbx, rsi
cmp r11, rbx
ja 0x14001067e
mov ecx, ebp
shr r11, cl
test r11, r11
je 0x140010684
mov r9d, 0x37
inc rax
add r8d, 0xffffffff
jne 0x140010651
mov r13, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 8]
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
test r10b, r10b
jne 0x1400106ba
test r9d, r9d
mov ecx, 0x39
cmove r9d, ecx
neg rbx
test r12, r12
je 0x1400106c3
mov qword [r12], rbx
mov r12, qword [rsp + 0x18]
cmp rax, r15
mov r15, qword [rsp]
mov ecx, 0xffffffc8
mov rbx, qword [rsp + 0x30]
cmove r9d, ecx
test r13, r13
je 0x1400106e6
mov qword [r13], rax
mov r13, qword [rsp + 0x10]
test r9d, r9d
jne 0x140010733
cmp byte [rax], r9b
je 0x140010733
test r8d, r8d
je 0x140010733
nop word [rax + rax]
movzx ecx, byte [rax]
cmp cl, 0x20
je 0x14001070d
cmp cl, 9
jne 0x140010720
inc rax
add r8d, 0xffffffff
jne 0x140010700
mov eax, 0x4d
add rsp, 0x28
ret
test r8d, r8d
je 0x140010716
test cl, cl
je 0x140010716
mov eax, 0x4c
add rsp, 0x28
ret
mov eax, r9d
add rsp, 0x28
ret
Function at 0x140010a90
Capabilities:
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rdi
sub rsp, 0x140
xor edi, edi
lea r8, [rax + 0x18]
mov rbx, rcx
mov dword [rax + 8], edi
lea rcx, [rax + 8]
mov dword [rax + 0x10], edi
xor r9d, r9d
mov dword [rax + 0x18], edi
lea rdx, [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
and byte [rbx + 2], 0xfe
movzx ecx, byte [rsp + 0x158]
cmp al, 1
movzx edx, byte [rsp + 0x150]
sete al
mov byte [rbx + 1], cl
mov ecx, dword [rsp + 0x160]
or al, 0xfc
or byte [rbx + 2], al
mov byte [rbx], dl
mov dword [rbx + 4], ecx
cmp qword [0x14002c508], rdi
je 0x140010b3a
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call fcn.140020100
mov rax, qword [0x14002c508]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [case.0x140010a7d.0]
test eax, eax
js 0x140010b3a
movzx eax, byte [rsp + 0x134]
and byte [rbx + 2], 3
shl al, 2
or byte [rbx + 2], al
cmp dword [rsp + 0x150], 6
mov eax, 2
cmovae edi, eax
movzx eax, byte [rbx + 2]
and al, 0xfd
or dil, al
mov byte [rbx + 2], dil
test dil, 2
jne 0x140010bbb
mov rax, qword [0x14002c468]
test rax, rax
je 0x140010b79
mov ecx, 0xffff
call qword [case.0x140010a7d.0]
cmp eax, 1
ja 0x140010bb7
mov rax, qword [0x14002c460]
test rax, rax
je 0x140010b90
call qword [case.0x140010a7d.0]
cmp eax, 1
ja 0x140010bb7
mov rax, qword [0x14002c458]
test rax, rax
je 0x140010ba8
call qword [case.0x140010a7d.0]
cmp rax, 1
ja 0x140010bb7
mov rax, qword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
movzx ecx, byte [rax]
cmp cl, 1
jle 0x140010bbb
or byte [rbx + 2], 2
mov rbx, qword [rsp + 0x168]
add rsp, 0x140
pop rdi
ret
Function at 0x140016390
Capabilities:
Print debug messages

Disassembly:
push rbp
sub rsp, 0x30
mov rax, qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
lea r8, [rsp + 0x40]
test rcx, rcx
mov qword [0x14002ea00], rax
mov eax, 0x6e
mov dword [rsp + 0x40], 0
mov edx, 0x1b
mov qword [rsp + 0x48], 0
mov rbp, rcx
cmovne edx, eax
lea rcx, [rsp + 0x48]
call fcn.1400167d0
test eax, eax
js 0x14001649e
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x28], rdi
mov edi, dword [rsp + 0x40]
mov edx, edi
mov qword [rsp + 0x20], r14
cmp edi, 2
jb 0x14001646a
mov rbx, qword [rsp + 0x48]
mov r8, rbp
mov rcx, rbx
call fcn.1400168c0
mov esi, eax
cmp eax, 0xfffffd9e
jne 0x140016480
mov r14d, dword [rbx]
cmp r14d, edi
jbe 0x140016480
test rbp, rbp
je 0x140016480
mov rcx, rbx
mov dword [rsp + 0x40], r14d
call sym.VBoxNetAdp.sys_RTMemFree
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], 0
mov edx, r14d
lea rcx, [rsp + 0x48]
call fcn.1400167d0
mov rbx, qword [rsp + 0x48]
mov esi, eax
test eax, eax
js 0x140016480
mov edx, dword [rsp + 0x40]
mov r8, rbp
mov rcx, rbx
call fcn.1400168c0
mov esi, eax
jmp 0x140016480
lea rcx, str.rtR0DbgKrnlNtInit:_Error__Only__u_module_s__returned__n
call sub.ntoskrnl.exe_DbgPrint
mov rbx, qword [rsp + 0x48]
mov esi, 0xffffa87f
mov rcx, rbx
call sym.VBoxNetAdp.sys_RTMemFree
mov r14, qword [rsp + 0x20]
mov eax, esi
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x1400167d0
Capabilities:
Get system information on windows
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
imul esi, edx, 0x128
xor ebp, ebp
mov qword [rcx], rbp
mov ebx, edx
mov r15, rcx
mov dword [r8], ebp
lea rdx, [0x140021a80]
mov r14, r8
add esi, 8
mov ecx, esi
call sym.VBoxNetAdp.sys_RTMemAllocZTag
mov rdi, rax
test rax, rax
jne 0x14001684a
shr ebx, 2
lea rdx, [0x140021a80]
imul esi, ebx, 0x128
add esi, 8
mov ecx, esi
call sym.VBoxNetAdp.sys_RTMemAllocZTag
mov rdi, rax
test rax, rax
jne 0x14001684a
lea rcx, str.rtR0DbgKrnlNtQueryModules:_Out_of_memory__n
call sub.ntoskrnl.exe_DbgPrint
lea eax, [rbp - 8]
jmp 0x1400168a7
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], ebp
mov r8d, esi
mov rdx, rdi
mov ecx, 0xb
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov ecx, 0x80000000
mov esi, eax
add eax, ecx
test ecx, eax
jne 0x14001689a
cmp esi, 0xc0000004
je 0x14001689a
mov rcx, rdi
call sym.VBoxNetAdp.sys_RTMemFree
mov edx, esi
lea rcx, str.rtR0DbgKrnlNtQueryModules:_ZwQuerySystemInformation_failed:__x_n
call sub.ntoskrnl.exe_DbgPrint
mov ecx, esi
call sym.VBoxNetAdp.sys_RTErrConvertFromNtStatus
mov ebp, eax
jmp 0x1400168a5
mov qword [r15], rdi
cmp ebx, dword [rdi]
cmova ebx, dword [rdi]
mov dword [r14], ebx
mov eax, ebp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140019c50
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], r9
mov r9d, edx
mov rdx, rcx
lea rcx, str._n__Assertion_Failed___nExpression:__s_nLocation__:__s__d___s_n
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x38
ret

Function at 0x140019c70
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x128
mov r9, r8
lea rcx, [rsp + 0x20]
mov r8, rdx
mov edx, 0xff
call sym.VBoxNetAdp.sys_RTStrPrintfV
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x11f], 0
lea rcx, [0x1400225dc]
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x128
ret

Function at 0x140019cf0
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x70
xor esi, esi
mov qword [r11 - 0x48], rcx
mov dword [rsp + 0x40], 0x30
lea rax, [0x140019cb0]
mov qword [r11 - 0x30], rsi
lea r8, [r11 - 0x38]
mov dword [rsp + 0x58], 0x200
lea rcx, [r11 + 0x18]
mov rdi, rdx
mov qword [r11 - 0x28], rsi
xorps xmm0, xmm0
mov qword [r11 - 0x50], rax
xor r9d, r9d
mov qword [r11 + 0x18], rsi
mov edx, 0x1fffff
mov qword [r11 - 0x58], rsi
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov ebx, eax
test eax, eax
js 0x140019da3
mov rcx, qword [rsp + 0x90]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x1fffff
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov ebx, eax
test eax, eax
js 0x140019da3
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rax, qword [rsp + 0x98]
mov qword [rdi], rax
mov ecx, ebx
call sym.VBoxNetAdp.sys_RTErrConvertFromNtStatus
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140011352
Capabilities:
Terminate process

Disassembly:
jmp 0x140016fb0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011433
Capabilities:
Parse pe header

Disassembly:
jmp 0x140018300
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140018320
xor al, al
jmp 0x1400183a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140018333
xor al, al
jmp 0x1400183a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001835d
xor al, al
jmp 0x1400183a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018371
xor al, al
jmp 0x1400183a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140018383
xor al, al
jmp 0x1400183a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001839f
xor al, al
jmp 0x1400183a1
mov al, 1
add rsp, 0x38
ret
Function at 0x14001168b
Capabilities:
Create thread

Disassembly:
jmp 0x140012680
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x140023040]
xor rax, rbp
mov qword [rbp + 0x120], rax
lea rcx, [0x1400290fb]
call fcn.1400115e1
mov edx, 8
lea rcx, [rbp + 8]
call fcn.14001169f
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 0x108]
call fcn.1400116d6
mov qword [rbp + 0x118], rax
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.140011690
nop
lea rcx, [rbp + 0x108]
call fcn.1400116b8
lea rax, [0x1400116ea]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x150]
add rax, 8
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 8]
call fcn.1400116ef
mov rcx, qword [rbp + 0x118]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x150]
mov qword [rcx], rax
mov rax, qword [rbp + 0x150]
cmp qword [rax], 0
je 0x140012780
lea rcx, [rbp + 8]
call fcn.1400116bd
jmp 0x140012799
mov rax, qword [rbp + 0x150]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14001169a
nop
lea rcx, [rbp + 8]
call fcn.1400116b8
lea rcx, [rbp - 0x30]
lea rdx, [0x14001f350]
call fcn.140011514
mov rcx, qword [rbp + 0x120]
xor rcx, rbp
call fcn.1400112e9
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x140001ce4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14002e040]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rcx + 0x18], 7
jbe 0x140001d0c
mov rcx, qword [rcx]
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001d41
xor al, al
jmp 0x140001d80
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rdi
mov r8d, 0x1e400
lea rdx, [0x14002ec90]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140001d7d
cmp dword [rsp + 0x40], 0x1e400
jne 0x140001d7d
mov dil, 1
mov al, dil
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400059b0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret