joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180023c4c
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, rdx
mov rdx, rcx
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
nop dword [rax + rax]
xor edi, edi
test eax, eax
js 0x18003644e
movzx edx, word [rbp - 0x40]
mov rax, qword [rbp - 0x38]
mov ecx, edx
shr rcx, 1
cmp word [rax + rcx*2 - 2], 0x5c
jne 0x180023cb3
mov eax, 0xfffe
add dx, ax
mov word [rbp - 0x40], dx
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
movzx r8d, word [rbp - 0x40]
add r8, 0x18
mov edx, dword [rax]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x180036457
xor eax, eax
lea rcx, [rbx + 0x18]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov dword [rbx + 0x10], 0x18
movzx eax, word [rbp - 0x40]
mov word [rbx + 0x14], ax
movzx r8d, word [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
call sub.ntdll.dll_memcpy
cmp word [rbp - 0x40], 4
jb 0x180023d3b
mov rax, qword [rbp - 0x38]
cmp word [rax + 2], 0x5c
jne 0x180023d3b
mov eax, dword [rbx + 0x10]
mov ecx, 0x3f
mov word [rax + rbx + 2], cx
or qword [rsp + 0x30], 0xffffffffffffffff
lea rcx, str..MountPointManager
mov r8d, 3
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov dword [rsp + 0x20], r8d
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180023de3
movzx r9d, word [rbp - 0x40]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x38], rdi
add r9d, 0x18
mov qword [rsp + 0x30], rax
mov r8, rbx
lea rax, [rbp - 0x28]
mov dword [rsp + 0x28], 0x20
mov edx, 0x6d0008
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_io_l1_1_0.dll_DeviceIoControl]
nop dword [rax + rax]
test eax, eax
jne 0x180023e28
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0xea
sete al
mov rcx, rsi
mov byte [r14], al
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov edi, 1
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180024680
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
cmp dword [rbp - 0x24], edi
setne al
jmp 0x180023dcc
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x180036468
mov ecx, 8
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor eax, eax
jmp 0x180023e03
Function at 0x180023e38
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8d, 0x1e
mov edx, dword [rax]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x18003648e
movups xmm0, xmmword [str.DosDevices_]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x180087f50]
movsd qword [rax + 0x10], xmm1
movzx ecx, word [rbp]
call qword [sym.imp.ntdll.dll_toupper]
nop dword [rax + rax]
mov rdx, rsi
mov dword [rdi + 0x1a], 0x3a
lea rcx, [rsp + 0x40]
mov word [rdi + 0x18], ax
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
movzx eax, word [rsp + 0x40]
lea r14d, [rbx + 0x24]
mov ecx, 0xfffe
add ax, cx
movzx ebp, ax
add ebp, r14d
mov word [rsp + 0x40], ax
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8d, ebp
mov edx, dword [rax]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x180036470
mov word [rax + 4], r14w
mov dword [rax], 0x1c0008
movzx eax, word [rsp + 0x40]
mov word [rsi + 6], ax
movups xmm0, xmmword [rdi]
movups xmmword [rsi + 8], xmm0
movsd xmm1, qword [rdi + 0x10]
movsd qword [rsi + 0x18], xmm1
mov eax, dword [rdi + 0x18]
mov dword [rsi + 0x20], eax
movzx ecx, word [rsi + 4]
movzx r8d, word [rsi + 6]
add rcx, rsi
mov rdx, qword [rsp + 0x48]
call sub.ntdll.dll_memcpy
movzx eax, word [rsi + 4]
lea ecx, [rbx + 0x3f]
mov r8, rdi
xor edx, edx
mov word [rax + rsi + 2], cx
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
or qword [rsp + 0x30], 0xffffffffffffffff
lea r8d, [rbx + 3]
mov dword [rsp + 0x28], 0x80
lea rcx, str..MountPointManager
xor r9d, r9d
mov dword [rsp + 0x20], r8d
mov edx, 0xc0000000
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
nop dword [rax + rax]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18002400f
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov r9d, ebp
mov dword [rsp + 0x28], ebx
mov r8, rsi
mov edx, 0x6dc000
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_io_l1_1_0.dll_DeviceIoControl]
nop dword [rax + rax]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, 8
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor eax, eax
jmp 0x18002402f
Function at 0x1800242e0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov edi, r8d
mov rbx, rdx
mov rdx, rcx
lea rcx, [rsp + 0x48]
call sym.KERNEL32.dll_Basep8BitStringToDynamicUnicodeString
xor esi, esi
test eax, eax
je 0x18002446a
mov qword [rsp + 0x40], rbx
lea eax, [rdi - 1]
mov word [rsp + 0x38], ax
mov word [rsp + 0x3a], di
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
movzx ebx, di
add bx, bx
mov word [rsp + 0x88], bx
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov ecx, dword [rax]
mov dword [rsp + 0x24], ecx
movzx r8d, bx
mov rcx, qword gs:[0x60]
mov edx, dword [rsp + 0x24]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800243f2
movzx eax, word [rsp + 0x88]
mov word [rsp + 0x2a], ax
mov r8d, edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNELBASE.dll_GetVolumeNameForVolumeMountPointW]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x20], eax
test eax, eax
je 0x18002441b
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
call qword [sym.imp.KERNELBASE.dll_GetUnicodeStringToEightBitStringRoutine]
nop dword [rax + rax]
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x38]
call qword [case.0x1800532bc.0]
test eax, eax
js 0x180024405
movzx eax, word [rsp + 0x38]
cmp eax, edi
jae 0x180024414
movzx ecx, word [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov byte [rcx + rax], sil
jmp 0x18002441b
mov ecx, 8
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x18002440c
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
mov ebx, esi
mov dword [rsp + 0x20], ebx
jmp 0x18002441b
mov ecx, 0x80000005
jmp 0x180024407
cmp qword [rsp + 0x30], rsi
je 0x180024446
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x30]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ebx, dword [rsp + 0x20]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
xor eax, eax
jmp 0x180024459
Function at 0x180024480
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
lea rax, [rdx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x180036639
call qword [sym.imp.ntdll.dll_RtlGetCurrentTransaction]
nop dword [rax + rax]
test rax, rax
jne 0x180036632
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlSetCurrentTransaction]
nop dword [rax + rax]
nop
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
mov ebx, eax
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlSetCurrentTransaction]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x1a45
jmp 0x18003663e
mov ecx, 0x1a2c
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
nop
jmp 0x1800244e9
Function at 0x180025ff8
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xa0
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0x27], rax
cmp qword [r9], 0
mov rsi, r9
mov rdi, qword [rbp + 0x7f]
mov r15, rdx
mov r14d, 5
jne 0x1800260e8
mov rax, qword [rdx + 8]
lea r9, [rbp - 1]
and qword [rbp - 0x29], 0
lea r8, [rbp - 0x31]
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x60
mov edx, 0x1200a9
mov qword [rbp - 0x21], rax
mov rcx, rsi
mov dword [rbp - 0x31], 0x30
movdqu xmmword [rbp - 0x11], xmm0
mov dword [rbp - 0x19], 0x40
mov dword [rsp + 0x20], r14d
call sub.ntdll.dll_NtOpenFile
mov ebx, eax
test eax, eax
jns 0x1800260e8
cmp eax, 0xc0000034
je 0x1800261b2
lea ecx, [rax + 0x3fffff77]
cmp ecx, 2
jbe 0x1800261b2
cmp eax, 0xc0000204
je 0x1800261b2
cmp eax, 0xc0150002
je 0x1800261b2
cmp eax, 0xc000000f
je 0x1800261b2
mov dword [rsp + 0x28], eax
lea r9, str.BasepSxsCreateFileStreamEx
mov rax, qword [rbp - 0x21]
lea r8, str.SXS:__s___NtOpenFile__wZ__failed._Status__0x_x_n
xor edx, edx
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x33]
call sub.ntdll.dll_DbgPrintEx
jmp 0x1800261b2
mov rcx, qword [rsi]
lea r8, [rbp + 0xf]
mov r9d, 0x18
mov dword [rsp + 0x20], r14d
lea rdx, [rbp - 1]
call sub.ntdll.dll_NtQueryInformationFile
mov ebx, eax
test eax, eax
jns 0x18002612a
lea r8, str.SXS:__s___NtQueryInformationFile_failed._Status__0x_x_n
xor edx, edx
mov dword [rsp + 0x20], eax
lea r9, str.BasepSxsCreateFileStreamEx
lea ecx, [rdx + 0x33]
call sub.ntdll.dll_DbgPrintEx
jmp 0x1800261b2
mov rcx, qword [rbp + 0x17]
cmp rcx, 0x800000
jle 0x18002613e
mov ebx, 0xc0150022
jmp 0x1800261b2
lea r14, [rsi + 0x10]
cmp qword [r14], 0
jne 0x180026185
mov rax, qword [rsi]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], 0x8000000
mov rcx, r14
mov dword [rsp + 0x20], 2
lea edx, [r9 + 4]
call sub.ntdll.dll_NtCreateSection
mov ebx, eax
test eax, eax
jns 0x180026181
lea r8, str.SXS:__s___NtCreateSection___failed._Status__0x_x_n
jmp 0x180026110
mov rcx, qword [rbp + 0x17]
mov rax, qword [rsi]
mov qword [rdi + 0x18], rax
mov word [rdi], 0x101
mov rax, qword [r15]
movups xmm0, xmmword [rax]
mov byte [rdi + 2], 3
movdqu xmmword [rdi + 8], xmm0
mov rax, qword [r14]
and qword [rdi + 0x28], 0
xor ebx, ebx
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x30], rcx
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.180024680
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180036794
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor r14d, r14d
mov dword [rsp + 0x40], 4
lea rax, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x30], rax
lea r8, str.RequireSignedAppInit_DLLs
lea rax, [rsp + 0x44]
mov rbx, rcx
mov qword [rsp + 0x28], rax
lea r9d, [r14 + 0x10]
mov qword [rsp + 0x20], r14
mov esi, r14d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x180036810
cmp dword [rsp + 0x44], r14d
mov eax, 0x80
cmovne esi, eax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x30], rax
lea rdi, [rsp + 0x50]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
jmp 0x180036896
lea rax, [rsp + 0x50]
cmp rdi, rax
je 0x18003685b
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, dword [rsp + 0x40]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x180036951
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov r9d, 2
mov qword [rsp + 0x20], r14
lea r8, str.AppInit_DLLs
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
cmp eax, 0xea
je 0x180036833
test eax, eax
jne 0x180036929
mov rbx, rdi
movzx eax, word [rbx]
cmp ax, 0x20
je 0x1800368da
cmp ax, 0x2c
jne 0x1800368e0
add rbx, 2
jmp 0x1800368cb
test ax, ax
je 0x180036929
mov r9, rbx
movzx ecx, ax
cmp ax, 0x2c
je 0x180036906
test ax, ax
je 0x180036913
add rbx, 2
movzx eax, word [rbx]
movzx ecx, ax
cmp ax, 0x20
jne 0x1800368e8
test cx, cx
je 0x180036913
mov word [rbx], r14w
add rbx, 2
mov r8d, esi
xor edx, edx
mov rcx, r9
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
nop dword [rax + rax]
jmp 0x1800368cb
lea rax, [rsp + 0x50]
cmp rdi, rax
je 0x180036951
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.180024680
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180036a20
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rsi, rcx
test rcx, rcx
jne 0x180036a54
lea ecx, [rsi + 0x57]
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor eax, eax
jmp 0x180036b16
xor edx, edx
lea r9, [rsp + 0x30]
xor r8d, r8d
lea ebp, [rdx + 0x70]
mov ecx, ebp
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
cmp eax, 0xc0000023
je 0x180036a7f
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x180036a4d
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, dword [rsp + 0x30]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x180036aac
lea ecx, [rax + 8]
jmp 0x180036a41
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rdi
mov ecx, ebp
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov ebp, eax
mov r8, rdi
test eax, eax
jns 0x180036aef
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, ebp
jmp 0x180036a78
cmp byte [rdi], bl
setne bl
xor edx, edx
mov dword [rsi], ebx
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, 1
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180037250
Capabilities:
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, qword [rsp + 0xb0]
mov rsi, r9
mov r15, qword [rsp + 0xb8]
mov rdi, r8
mov rbx, rdx
mov dword [rsp + 0x20], 0x2c
mov r9d, 0x14
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
jns 0x1800372b7
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x1800372e0
mov ecx, dword [rsp + 0x4c]
mov eax, dword [rsp + 0x50]
mov dword [r14], ecx
mov dword [r15], eax
mov eax, dword [rsp + 0x44]
mov dword [rbx], eax
mov eax, dword [rsp + 0x40]
imul eax, ecx
mov dword [rdi], eax
movzx eax, byte [rsp + 0x49]
mov dword [rsi], eax
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180024680
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x180037300
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, qword [rbp + 0x60]
mov r12d, r9d
mov rdi, qword [rbp + 0x68]
mov esi, r8d
mov r15d, edx
mov dword [rsp + 0x20], 0x2c
mov r9d, 0x14
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x30]
mov r14, rcx
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
jns 0x180037368
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x180037415
mov ecx, dword [rbp - 0x14]
test ecx, ecx
jne 0x180037386
and dword [rbx], ecx
and dword [rdi], ecx
mov ecx, 1
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x180037361
xor edx, edx
mov eax, esi
div ecx
mov dword [rbp - 0x20], eax
test eax, eax
jne 0x18003739c
test esi, esi
je 0x18003739c
lea ecx, [rax + 0x57]
jmp 0x180037378
mov dword [rbp - 0x1c], r15d
lea r8, [rbp - 0x20]
mov r15d, 0x2c
mov byte [rbp - 0x17], r12b
lea rdx, [rbp - 0x30]
mov byte [rbp - 0x18], 1
mov rcx, r14
mov dword [rsp + 0x20], r15d
lea r12d, [r15 - 0x18]
mov r9d, r12d
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x18003735a
test esi, esi
jne 0x1800373df
and dword [rbx], esi
and dword [rdi], esi
jmp 0x180037410
mov r9d, r12d
mov dword [rsp + 0x20], r15d
lea r8, [rbp - 0x20]
mov rcx, r14
lea rdx, [rbp - 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x18003735a
mov eax, dword [rbp - 0x14]
mov dword [rbx], eax
mov eax, dword [rbp - 0x10]
mov dword [rdi], eax
mov eax, 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180024680
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180037490
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov rdi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x1800374cc
lea ecx, [rdx + 0x57]
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor eax, eax
jmp 0x1800375b5
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1800374d3
test rax, rax
jne 0x1800374e7
lea esi, [rax + 8]
jmp 0x1800374fb
mov rax, rbx
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1800374ea
lea esi, [rax*2 + 6]
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8d, esi
mov edx, dword [rax]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x180037532
lea ecx, [rax + 8]
jmp 0x1800374b9
inc rbx
cmp word [rdi + rbx*2], r15w
jne 0x180037532
add ebx, ebx
lea rcx, [r14 + 4]
mov eax, ebx
mov r8, rdi
mov edx, ebx
shr rdx, 1
inc rdx
mov dword [r14], eax
call qword [sym.imp.ntdll.dll_wcscpy_s]
nop dword [rax + rax]
mov r9d, esi
mov dword [rsp + 0x20], 0x28
mov r8, r14
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, r14
xor edx, edx
mov ebx, eax
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test ebx, ebx
jns 0x1800375b0
mov ecx, ebx
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x1800374c5
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x1800383d0
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov dword [rsp + 0x20], 0x35
lea rdx, [rsp + 0x30]
mov r9d, 2
lea r8, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
jns 0x18003840c
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x180038419
movzx eax, word [rsp + 0x60]
mov word [rbx], ax
mov eax, 1
add rsp, 0x40
pop rbx
ret
Function at 0x180039160
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov rbx, rdx
mov rdi, rcx
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0x10]
lea ecx, [r9 + 0x25]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
jns 0x1800391aa
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x1800391c5
test rdi, rdi
je 0x1800391b5
mov eax, dword [rsp + 0x20]
mov dword [rdi], eax
test rbx, rbx
je 0x1800391c0
mov eax, dword [rsp + 0x24]
mov dword [rbx], eax
mov eax, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180024680
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180039a90
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [rsp + 0xc0]
mov qword [r11 - 0x18], rax
mov rax, qword [rsp + 0xb8]
mov qword [r11 - 0x20], rax
mov rax, qword [rsp + 0xb0]
mov qword [r11 - 0x28], rax
mov rax, qword [rsp + 0xa8]
mov qword [r11 - 0x30], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [r11 - 0x48], rax
call qword [sym.imp.KERNELBASE.dll_CreateProcessAsUserA]
nop dword [rax + rax]
add rsp, 0x68
ret

Function at 0x180039b10
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [rsp + 0xc8]
mov qword [r11 - 0x10], rax
mov rax, qword [rsp + 0xc0]
mov qword [r11 - 0x18], rax
mov rax, qword [rsp + 0xb8]
mov qword [r11 - 0x20], rax
mov rax, qword [rsp + 0xb0]
mov qword [r11 - 0x28], rax
mov rax, qword [rsp + 0xa8]
mov qword [r11 - 0x30], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [r11 - 0x48], rax
call qword [sym.imp.KERNELBASE.dll_CreateProcessInternalA]
nop dword [rax + rax]
add rsp, 0x68
ret

Function at 0x180039b90
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [rsp + 0xc8]
mov qword [r11 - 0x10], rax
mov rax, qword [rsp + 0xc0]
mov qword [r11 - 0x18], rax
mov rax, qword [rsp + 0xb8]
mov qword [r11 - 0x20], rax
mov rax, qword [rsp + 0xb0]
mov qword [r11 - 0x28], rax
mov rax, qword [rsp + 0xa8]
mov qword [r11 - 0x30], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [r11 - 0x48], rax
call qword [sym.imp.KERNELBASE.dll_CreateProcessInternalW]
nop dword [rax + rax]
add rsp, 0x68
ret

Function at 0x180039c10
Capabilities:
Create thread

Disassembly:
mov r11, rsp
sub rsp, 0x48
mov r10d, dword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
and r10d, 0x10004
mov qword [r11 - 0x10], rax
and qword [r11 - 0x18], 0
mov rax, qword [rsp + 0x70]
mov dword [r11 - 0x20], r10d
mov qword [r11 - 0x28], rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateRemoteThreadEx]
nop dword [rax + rax]
add rsp, 0x48
ret