joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2c66c
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0xc0
and qword [rax + 0x18], 0
lea rdx, [0x00030a40]
lea rcx, [rax - 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x90], 0
and qword [rsp + 0xa8], 0
and qword [rsp + 0xb0], 0
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0xe0]
mov edi, 1
mov edx, 0x80100000
mov dword [rsp + 0x28], 0x60
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x88], 0x30
mov dword [rsp + 0xa0], 0x240
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
js 0x2c808
mov rcx, qword [rsp + 0xe0]
lea r9d, [rdi + 0x17]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x2c7ca
movsxd rbx, dword [rsp + 0x7c]
mov eax, dword [rsp + 0x78]
shl rbx, 0x20
or rbx, rax
je 0x2c7f5
cmp rbx, 0x6400000
ja 0x2c7f5
mov rdx, rbx
mov ecx, edi
call fcn.0002e424
mov rdi, rax
test rax, rax
je 0x2c7c5
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0xe0]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov esi, eax
test eax, eax
jns 0x2c7b6
mov rcx, rdi
call fcn.0002e49c
mov ebx, esi
jmp 0x2c7ca
cmp qword [rsp + 0x58], rbx
je 0x2c7dc
mov rcx, rdi
call fcn.0002e49c
mov ebx, 0xc0000001
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
jmp 0x2c808
mov rcx, qword [rsp + 0xe0]
mov qword [0x00041dd8], rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
jmp 0x2c808
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc0000001
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x2c824
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rdx, [rsp + 0x38]
xor edi, edi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, edi
jge 0x2c848
xor al, al
jmp 0x2c86f
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov ecx, 1
movzx ebx, dil
cmp rax, rdi
cmovne ebx, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x2c880
Capabilities:
Find process by pid

Disassembly:
push rdi
sub rsp, 0x20
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x2c8a4
lea rax, [0x0002fb20]
jmp 0x2c914
mov rcx, qword [rsp + 0x38]
call sub.ntoskrnl.exe_PsGetProcessImageFileName
mov r11, rax
test rax, rax
jne 0x2c8c3
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x2c89b
lea rdi, [0x00041cd0]
mov byte [0x00041dd3], 0
mov edx, 0x103
mov rcx, rdi
sub r11, rdi
lea rax, [rdx + 0x7ffffefb]
test rax, rax
je 0x2c8fb
mov al, byte [r11 + rcx]
test al, al
je 0x2c8fb
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x2c8dc
test rdx, rdx
jne 0x2c903
dec rcx
mov byte [rcx], 0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x2cc38
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x00041df0]
and dword [rsp + 0x30], 0
test rax, rax
jne 0x2cd19
lea edi, [rax + 0xb]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov ecx, edi
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
je 0x2cc7f
xor eax, eax
jmp 0x2cd19
mov edx, dword [rsp + 0x30]
mov ecx, 1
call fcn.0002e424
mov rbx, rax
test rax, rax
je 0x2cc78
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
jns 0x2ccb8
mov rcx, rbx
call fcn.0002e49c
jmp 0x2cc78
xor edi, edi
cmp dword [rbx], edi
jbe 0x2cd0a
lea rsi, [rbx + 0x2e]
movzx ecx, word [rsi]
mov eax, edi
lea rdx, [0x00032490]
imul rax, rax, 0x128
add rax, rbx
lea rcx, [rcx + rax + 0x30]
call fcn.0002f246
test eax, eax
je 0x2ccf5
inc edi
add rsi, 0x128
cmp edi, dword [rbx]
jb 0x2ccc2
jmp 0x2cd0a
mov eax, edi
imul rax, rax, 0x128
mov rax, qword [rax + rbx + 0x18]
mov qword [0x00041df0], rax
mov rcx, rbx
call fcn.0002e49c
mov rax, qword [0x00041df0]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x2d96c
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rbp, rdx
lea rdx, [rsp + 0x30]
mov rsi, r8
mov rdi, rcx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x2daa7
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rbx, rax
test rax, rax
je 0x2da9c
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r9, rsi
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.0002d844
and qword [rsp + 0xd8], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x70], 0
and qword [rsp + 0x78], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xd8]
mov edx, 0x400
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x50], 0x30
mov dword [rsp + 0x68], 0x200
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
test eax, eax
js 0x2da8e
mov rcx, qword [rsp + 0xd8]
and qword [rsp + 0x20], 0
mov r9d, 8
lea edx, [r9 + 0x12]
lea r8, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov rcx, qword [rsp + 0xd8]
xor ebx, ebx
test eax, eax
cmovns rbx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test rbx, rbx
je 0x2da8e
mov r9, rsi
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.0002dac8
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x2e04c
Capabilities:
Check os version

Disassembly:
mov rax, rsp
sub rsp, 0x38
lea r9, [rax - 0x18]
lea r8, [rax + 8]
lea rdx, [rax + 0x10]
lea rcx, [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov r11d, dword [rsp + 0x50]
cmp r11d, 5
jne 0x2e088
cmp dword [rsp + 0x48], 2
jne 0x2e1d6
lea eax, [r11 - 2]
jmp 0x2e1d8
mov eax, 6
cmp r11d, eax
jne 0x2e125
mov ecx, dword [rsp + 0x48]
xor edx, edx
cmp ecx, edx
je 0x2e1d8
cmp ecx, 1
jne 0x2e0cf
cmp dword [rsp + 0x40], 0x1b58
jne 0x2e0bb
lea eax, [rcx + 7]
jmp 0x2e1d8
cmp dword [rsp + 0x40], 0x1bbc
sbb eax, eax
not eax
and eax, 0xa
jmp 0x2e1d8
cmp ecx, 2
jne 0x2e10c
mov eax, dword [rsp + 0x40]
cmp eax, 0x203a
jne 0x2e0e7
lea eax, [rcx + 0xc]
jmp 0x2e1d8
cmp eax, 0x20d0
jne 0x2e0f8
mov eax, 0xf
jmp 0x2e1d8
mov ecx, 0x11
cmp eax, 0x23f0
cmove edx, ecx
mov eax, edx
jmp 0x2e1d8
cmp ecx, 3
jne 0x2e1d6
cmp dword [rsp + 0x40], 0x2580
lea eax, [rcx + 0x11]
cmove edx, eax
jmp 0x2e105
cmp r11d, 0xa
jne 0x2e1d6
xor edx, edx
cmp dword [rsp + 0x48], edx
jne 0x2e1d6
mov ecx, dword [rsp + 0x40]
cmp ecx, 0x37b1
jne 0x2e14f
lea eax, [rdx + 0x27]
jmp 0x2e1d8
lea eax, [rcx - 0x2b5e]
cmp eax, 0xc4d
ja 0x2e163
mov eax, 0x25
jmp 0x2e1d8
cmp ecx, 0x2b5b
jne 0x2e172
mov eax, 0x23
jmp 0x2e1d8
cmp ecx, 0x2b4a
jne 0x2e181
mov eax, 0x21
jmp 0x2e1d8
cmp ecx, 0x295a
jne 0x2e190
mov eax, 0x1f
jmp 0x2e1d8
cmp ecx, 0x2945
jne 0x2e19f
mov eax, 0x1d
jmp 0x2e1d8
cmp ecx, 0x2933
jne 0x2e1ae
mov eax, 0x1b
jmp 0x2e1d8
cmp ecx, 0x2924
jne 0x2e1bd
mov eax, 0x19
jmp 0x2e1d8
add ecx, 0xffffd800
mov eax, 0x17
cmp ecx, 0x124
cmovbe edx, eax
jmp 0x2e105
xor eax, eax
add rsp, 0x38
ret

Function at 0x2e1e4
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov qword [rax + 0x10], rsi
mov rbx, rsi
mov qword [rax - 0x48], rbx
lea rdx, [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, esi
jl 0x2e2c3
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rdi, rax
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea ebx, [rsi + 1]
mov r8d, ebx
lea edx, [rsi + 0x28]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rdi, qword [rdi + 0x20]
mov r8d, ebx
lea edx, [rbx + 0x7f]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rdi + 0x60]
mov r8d, ebx
mov rcx, qword [rdi + 0x68]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rdi + 0x60]
add rdx, 2
mov ecx, ebx
call fcn.0002e424
mov rbx, rax
mov qword [rsp + 0x20], rax
cmp rax, rsi
je 0x2e2a6
movzx r8d, word [rdi + 0x60]
mov rdx, qword [rdi + 0x68]
mov rcx, rax
call fcn.0002f2c0
movzx r11d, word [rdi + 0x60]
shr r11w, 1
movzx ecx, r11w
mov word [rbx + rcx*2], si
jmp 0x2e2ad
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x2e2e0
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x70
xor r12d, r12d
mov qword [rax + 0x10], r12
mov rsi, r12
mov qword [rax - 0x58], r12
lea rdx, [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, r12d
jl 0x2e402
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rbx, rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea edx, [r12 + 0x28]
lea r8d, [r12 + 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rbx, qword [rbx + 0x20]
mov edx, 0x80
lea r8d, [r12 + 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rbx + 0x60]
lea r8d, [r12 + 1]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov word [rsp + 0x28], r12w
mov word [rsp + 0x2a], r12w
mov r8b, 1
lea rdx, [rbx + 0x60]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
cmp eax, r12d
jl 0x2e3e2
movzx edx, word [rsp + 0x28]
inc rdx
lea ecx, [r12 + 1]
call fcn.0002e424
mov rsi, rax
mov qword [rsp + 0x20], rax
cmp rax, r12
je 0x2e3d7
movzx r8d, word [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call fcn.0002f2c0
movzx r11d, word [rsp + 0x28]
mov byte [r11 + rsi], r12b
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
jmp 0x2e3e9
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x2e8b8
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, rcx
xor r9d, r9d
mov ecx, edx
movzx eax, word [rbx + 0x14]
movzx r11d, word [rbx + 6]
lea r8, [rax + rbx + 0x18]
test r11d, r11d
je 0x2e8f9
mov r10d, dword [r8 + 0xc]
cmp rcx, r10
jb 0x2e8ed
mov eax, dword [r8 + 8]
add eax, r10d
cmp rcx, rax
jb 0x2e8fc
inc r9d
add r8, 0x28
cmp r9d, r11d
jb 0x2e8d8
xor r8d, r8d
test r8, r8
je 0x2e914
mov eax, dword [rbx + 0x3c]
dec eax
not eax
and eax, dword [r8 + 0x14]
sub eax, dword [r8 + 0xc]
add eax, edx
jmp 0x2e916
mov eax, edx
mov rbx, qword [rsp + 8]
ret

Function at 0x2e924
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movzx eax, word [rcx + 0x14]
movzx r11d, word [rcx + 6]
xor r9d, r9d
lea r8, [rax + rcx + 0x18]
mov rbx, rcx
test r11d, r11d
je 0x2e963
mov r10d, dword [r8 + 0xc]
cmp edx, r10d
jb 0x2e957
mov eax, dword [r8 + 8]
lea ecx, [r10 + rax]
cmp edx, ecx
jb 0x2e966
inc r9d
add r8, 0x28
cmp r9d, r11d
jb 0x2e942
xor r8d, r8d
test r8, r8
je 0x2e97e
mov eax, dword [rbx + 0x3c]
dec eax
not eax
and eax, dword [r8 + 0x14]
sub eax, dword [r8 + 0xc]
add eax, edx
jmp 0x2e980
mov eax, edx
mov rbx, qword [rsp + 8]
ret
Function at 0x2e98c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov eax, 0x5a4d
mov r12b, r8b
mov rbx, rcx
cmp word [rcx], ax
jne 0x2eb04
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
je 0x2eb04
mov edx, dword [rsi + 0x78]
test edx, edx
je 0x2eb04
test r8b, r8b
jne 0x2e9e0
mov rcx, rsi
call fcn.0002e924
mov edx, eax
mov edi, edx
add rdi, rbx
je 0x2eb04
mov ebp, dword [rsi + 0x50]
mov rax, rdi
sub rax, rbx
mov qword [rsp + 0x88], rax
cmp rbp, rax
jb 0x2eb04
mov eax, dword [rsi + 0x7c]
sub rax, rbx
add rax, rdi
cmp rbp, rax
jb 0x2eb04
mov edx, dword [rdi + 0x20]
test r12b, r12b
jne 0x2ea29
mov rcx, rsi
call fcn.0002e924
mov edx, eax
mov eax, edx
mov edx, dword [rdi + 0x1c]
add rax, rbx
mov qword [rsp + 0x20], rax
test r12b, r12b
jne 0x2ea45
mov rcx, rsi
call fcn.0002e924
mov edx, eax
mov r14d, edx
mov edx, dword [rdi + 0x24]
add r14, rbx
test r12b, r12b
jne 0x2ea5d
mov rcx, rsi
call fcn.0002e924
mov edx, eax
movsxd rcx, dword [rdi + 0x18]
mov r13d, edx
mov edx, dword [rdi + 0x14]
add r13, rbx
mov dword [rsp + 0x70], edx
cmp r13, rbx
jb 0x2eb04
lea rax, [rbx + rbp]
cmp r13, rax
ja 0x2eb04
xor edi, edi
mov r15, rcx
test ecx, ecx
jle 0x2eb04
cmp rdi, r15
movzx ebp, word [r13 + rdi*2]
jge 0x2eb04
cmp ebp, edx
jge 0x2eb04
movsxd rax, ebp
mov ecx, dword [r14 + rax*4]
mov rax, qword [rsp + 0x88]
cmp rcx, rax
jb 0x2eabc
mov r8d, dword [rsi + 0x7c]
add rax, r8
cmp rcx, rax
jb 0x2eafc
mov rax, qword [rsp + 0x20]
mov edx, dword [rax + rdi*4]
test r12b, r12b
jne 0x2ead3
mov rcx, rsi
call fcn.0002e924
mov edx, eax
mov r8d, edx
mov rdx, qword [rsp + 0x78]
add r8, rbx
sub r8, rdx
movzx eax, byte [rdx]
movzx ecx, byte [rdx + r8]
sub eax, ecx
jne 0x2eaf4
inc rdx
test ecx, ecx
jne 0x2eae1
test eax, eax
je 0x2eb1e
mov edx, dword [rsp + 0x70]
inc rdi
cmp rdi, r15
jl 0x2ea8d
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edx, dword [r14 + rbp*4]
test r12b, r12b
jne 0x2eb31
mov rcx, rsi
call fcn.0002e924
mov edx, eax
mov eax, edx
add rax, rbx
jmp 0x2eb06

Function at 0x2eb40
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x2eb86
movsxd r9, dword [rcx + 0x3c]
add r9, rcx
je 0x2eb86
movzx eax, word [r9 + 0x14]
movzx r11d, word [r9 + 6]
xor r10d, r10d
lea r8, [rax + r9 + 0x18]
cmp r11d, r10d
jbe 0x2eb86
mov ecx, dword [r8 + 0x14]
cmp edx, ecx
jb 0x2eb7a
add ecx, dword [r8 + 0x10]
cmp edx, ecx
jb 0x2eb89
inc r10d
add r8, 0x28
cmp r10d, r11d
jb 0x2eb6a
xor eax, eax
ret
mov eax, dword [r8 + 0xc]
sub eax, dword [r8 + 0x14]
add eax, edx
ret
Function at 0x2efd4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x10
mov r13, rdx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x2f0cb
movsxd rax, dword [rcx + 0x3c]
mov ebx, dword [rax + rcx + 0x8c]
mov dword [rsp + 0x50], ebx
mov edx, dword [rax + rcx + 0x88]
cmp edx, r8d
je 0x2f0cb
mov rax, rdx
add rax, rcx
je 0x2f0cb
mov rsi, rax
sub rsi, rcx
mov r14d, dword [rax + 0x1c]
add r14, rcx
mov r12d, dword [rax + 0x24]
add r12, rcx
mov r11d, dword [rax + 0x20]
add r11, rcx
mov qword [rsp + 0x58], r11
mov r15d, dword [rax + 0x18]
mov r9d, dword [rax + 0x14]
mov dword [rsp + 0x50], r9d
mov edx, r8d
mov dword [rsp], edx
cmp edx, r15d
jae 0x2f0c9
mov r10d, edx
movsx eax, word [r12 + r10*2]
cmp eax, r9d
jae 0x2f0c5
mov r9d, dword [r14 + rax*4]
cmp r9, rsi
jb 0x2f081
lea rax, [rsi + rbx]
cmp r9, rax
jb 0x2f0b9
mov eax, dword [r11 + r10*4]
add rax, rcx
mov rdi, r13
sub rdi, rax
movzx r10d, byte [rax]
movzx r11d, byte [rax + rdi]
sub r10d, r11d
jne 0x2f0a4
inc rax
test r11d, r11d
jne 0x2f08e
cmp r10d, r8d
jne 0x2f0b4
lea r8, [r9 + rcx]
mov qword [rsp + 8], r8
jmp 0x2f0c9
mov r11, qword [rsp + 0x58]
inc edx
mov dword [rsp], edx
mov r9d, dword [rsp + 0x50]
jmp 0x2f05d
xor eax, eax
jmp 0x2f0da
jmp 0x2f0d7
xor eax, eax
jmp 0x2f0da
mov rax, r8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x10
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x28c19b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
inc r11w
not r10b
sal r10, cl
mov qword [rsp + 0x10], rdi
ror r10b, cl
xor edi, edi
jmp 0x28c1bc
movzx ebx, r8b
inc r8
movzx r8, r11w
mov r11, rcx
bswap r8w
movzx r10, r8w
mov r8, rdi
setae r9b
not r9b
nop
movsx r9d, di
inc r10w
mov r9w, 0x500
movzx r9d, byte [r11]
movzx r10, di
movzx r10d, byte [rdx]
jmp 0x28c1fb
inc r11
inc rdx
test bl, bl
jmp 0x28c208
je 0x28c259
mov ecx, r8d
cmovns eax, r12d
movzx rax, bx
movsx eax, r11w
mov eax, 0x14e00243
stc
clc
rol eax, cl
cmp r14d, 0x190f5c6e
test r11b, 1
jmp 0x28c236
add al, r8b
stc
jmp 0x28c23f
xor r9b, al
jmp 0x28c247
inc r8
test cl, r12b
jmp 0x28c259
test r9b, r9b
jmp 0x28c261
je 0x28c275
cmp r9b, r10b
jmp 0x28c26f
je 0x28c1ea
cmp r9b, r10b
jmp 0x28c27d
jae 0x28c29c
or eax, 0xffffffff
bswap ebx
mov rbx, qword [rsp + 8]
movsx rdi, r9w
movsx di, spl
mov rdi, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 8]
cbw
lahf
seta dil
mov rax, rbp
movsx eax, r9w
movsxd rax, ebp
mov eax, edi
movsx rdi, r14w
bswap rdi
movzx edi, r14w
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140001894
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, dword [rsp + 0x98]
lea r13d, [rcx - 0x150]
mov edi, r12d
lea esi, [rcx - 0x620]
mov r15d, r9d
lea eax, [r13 - 0x4d0]
xor edi, 0x513
xor r15d, 0xf7f
xor r12d, 0x80e
cmp esi, eax
jne 0x140001a4e
lea eax, [rcx - 0xeb]
cmp edi, eax
je 0x14000194b
mov rax, qword [section..data]
lea r9d, [r15 + 0xa6]
mov r8, qword [rsp + 0x90]
xor esi, 0xbaf
mov edx, dword [rax]
sub dword [r8 + 0x5c], edx
lea eax, [rsi + 0x151]
mov r8, qword [section..data]
mov edx, esi
xor esi, 0xee2
mov dword [rsp + 0x20], eax
mov ecx, esi
xor edx, 0xdf1
call fcn.140002330
xor edi, 0x1cf
jmp 0x140001a4e
mov rbp, qword [rsp + 0x90]
mov edx, 0xe2e
mov rcx, qword [section..data]
mov eax, dword [rbp + 0x50]
mov r14d, dword [rcx + 0x74]
xor eax, edx
cmp r14d, eax
je 0x140001a4e
imul eax, edi, 0xd43
xor eax, dword [rbp + 0x12c]
cmp dword [rbp + 0xa4], eax
jb 0x140001a36
mov eax, r13d
sub eax, r15d
or eax, dword [0x140035048]
cmp dword [0x140035060], eax
jb 0x140001a36
mov r10d, dword [rcx + 0x50]
mov eax, r12d
mov ebx, dword [rbp + 0xe4]
or eax, edx
imul eax, dword [rcx + 0x80]
sub ebx, r13d
mov edx, dword [rbp + 0x108]
mov r9d, r15d
xor edx, dword [0x14003507c]
xor ebx, 0xe50
mov r11d, dword [rbp + 0xbc]
sub r10d, r12d
mov r8d, dword [rbp + 0x118]
or r11d, 0xd1d
or r9d, dword [rbp + 0x50]
add edi, eax
imul edx, dword [rbp + 0x98]
mov eax, r13d
sub eax, dword [rcx + 0xfc]
sub r8d, esi
mov qword [rsp + 0x38], 0x913
sub r9d, 0xe30
mov dword [rsp + 0x30], ebx
sub r8d, 0xd29
mov dword [rsp + 0x28], r11d
lea ecx, [rax - 0xb3d]
mov dword [rsp + 0x20], r10d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov edx, 0xe2e
mov ecx, dword [rbp + 0x50]
inc r14d
xor ecx, edx
cmp r14d, ecx
mov rcx, qword [section..data]
jne 0x140001971
lea r11, [rsp + 0x40]
xor edi, 0x2fc
mov rbx, qword [r11 + 0x30]
mov eax, edi
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140001ef4
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov eax, dword [rsp + 0x90]
lea r15d, [r8 - 0x4f2]
mov ebx, r8d
lea r14d, [rdx - 0x3a1]
mov edi, edx
xor ebx, 0x82c
xor edi, 0xd73
mov r13d, edx
lea esi, [rax - 0x71]
mov rbp, rcx
lea r12d, [rax + 0xeb]
mov dword [rsp + 0x90], esi
mov eax, r15d
xor eax, 0xe50
cmp edi, eax
jle 0x1400020c7
mov eax, ebx
xor eax, 0x5cd
cmp r15d, eax
mov rax, qword [section..data]
jge 0x140002082
lea r8d, [r14 + 0xe50]
mov qword [r11 - 0x48], rax
mov edx, r12d
mov ecx, edi
xor edx, 0x307
xor ecx, 0x356
mov r9d, r8d
call fcn.1400013c0
lea eax, [rdi - 0x395]
mov r8d, esi
lea r9d, [rsi - 0x4c4]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r9d
lea edx, [rdi - 0x6c4]
mov r9, rbp
lea ecx, [r15 + 0xbcd]
xor r8d, 0x6a8
call fcn.140004020
mov r8d, dword [rsp + 0x90]
lea r9d, [r12 + 0x22]
add r8d, 0xfffff820
lea ecx, [r15 + 0xe30]
xor r14d, 0xd29
mov esi, eax
lea edx, [rax - 0x32f]
mov dword [rsp + 0x28], edx
lea rdx, [0x140035010]
mov dword [rsp + 0x20], r8d
mov r8d, r14d
call fcn.140003ab8
mov ecx, dword [0x1400350b8]
mov r9d, r13d
add ecx, 0x3bb58b4e
mov edx, r14d
mov dword [rbp + 0x40], ecx
mov edi, eax
mov ecx, dword [rsp + 0x90]
lea ebx, [rax + 0x20]
add ecx, 0x17e
lea r8d, [rax - 2]
mov dword [rsp + 0x28], ecx
mov rcx, rbp
mov dword [rsp + 0x20], ebx
call fcn.14001653c
lea r8d, [rsi + 0x2f3]
xor edi, 0x319
lea edx, [r15 + 0x80e]
mov ecx, ebx
mov dword [rsp + 0x30], edx
lea r9d, [r15 + 0xcd2]
mov dword [rsp + 0x28], r12d
mov rdx, rbp
mov dword [rsp + 0x20], r8d
mov r8d, edi
call fcn.140017a44
jmp 0x1400020c7
mov ecx, dword [rax + 0x130]
mov edi, ebx
xor ecx, dword [rbp + 0x58]
xor ecx, r14d
cmp ebx, ecx
je 0x1400020c7
mov eax, dword [rbp + 0xb8]
and eax, ebx
sub eax, 0x3a1
xor dword [0x1400350b4], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rax, qword [section..data]
add edi, 4
mov ecx, dword [rax + 0x130]
xor ecx, dword [rbp + 0x58]
xor ecx, r14d
cmp edi, ecx
jne 0x140002094
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
lea eax, [r12 - 0x105]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret