joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100068f44
Capabilities:
Get user security identifier

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, rdx
mov rbx, rcx
lea rbp, [rcx + 0x50]
mov dword [rbp], 7
add rcx, 0x58
call fcn.100068e74
lea rcx, [rbx + 0x60]
call fcn.100068e74
lea rcx, [rbx + 0x68]
call fcn.100068e74
lea rcx, [rbx + 0x70]
call fcn.100068e74
mov byte [rbx + 0x4c], 0
test rsi, rsi
jne 0x100068fd5
lea r8, [0x1000079e8]
mov edx, 0x9c
lea rcx, [0x1000079b0]
call fcn.100099ad8
xor al, al
jmp 0x100069172
and qword [rsp + 0x50], 0
mov edx, 0x100
lea rcx, [rsp + 0x50]
call fcn.10001c6d0
mov rdi, qword [rsp + 0x50]
mov dword [rsp + 0x44], 0x44
mov dword [rsp + 0x40], 0x80
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x44]
lea r8, [rsp + 0xe0]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1000690a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10006912b
cmp dword [rsp + 0x44], 0x44
jbe 0x100069050
mov ecx, 0x80004005
call fcn.100019658
int3
cmp dword [rsp + 0x40], 0x80
jbe 0x100069070
mov edx, dword [rsp + 0x40]
add rdx, rdx
lea rcx, [rsp + 0x50]
call fcn.100068a9c
mov rdi, qword [rsp + 0x50]
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x44]
lea r8, [rsp + 0xe0]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x10006912b
lea rcx, [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
cmp eax, 0x44
jb 0x1000690cf
lea r8, [0x100007a00]
mov edx, 0xc4
lea rcx, [0x1000079b0]
call fcn.100099ad8
mov byte [rbx + 0x4c], 1
lea rdx, [rbx + 8]
lea r8, [rsp + 0xe0]
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x10006912b
mov rdx, rdi
lea rcx, [rbx + 0x60]
call fcn.100068d3c
mov rdx, rsi
lea rcx, [rbx + 0x58]
call fcn.100068d3c
xor edx, edx
lea rcx, [rbx + 0x70]
call fcn.100068d3c
nop
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x50], rcx
je 0x100069127
lea rcx, [rsp + 0x50]
call fcn.10001c444
mov al, 1
jmp 0x100069172
mov dword [rbp], 7
lea rcx, [rbx + 0x58]
call fcn.100068e74
lea rcx, [rbx + 0x60]
call fcn.100068e74
lea rcx, [rbx + 0x68]
call fcn.100068e74
lea rcx, [rbx + 0x70]
call fcn.100068e74
mov byte [rbx + 0x4c], 0
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x50], rax
je 0x100069170
lea rcx, [rsp + 0x50]
call fcn.10001c444
xor al, al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.10014e480
mov rbx, qword [rsp + 0x190]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x100087844
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x40
mov esi, r8d
mov r12, rdx
mov rbp, rcx
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
lea r15, [0x100003b68]
cmp rcx, rdi
je 0x1000878a3
test byte [rcx + 0x1c], 1
je 0x1000878a3
cmp byte [rcx + 0x19], 4
jb 0x1000878a3
mov rcx, qword [rcx + 0x10]
mov edx, 0x25
mov r8, r15
call fcn.10001c7b8
mov rcx, qword [0x1001653b8]
xor ebx, ebx
mov dword [rsp + 0x70], ebx
cmp rbp, rbx
jne 0x1000878cd
lea r8, [0x1000096e0]
lea rcx, [0x100009600]
mov edx, 0x20e
call fcn.100099ad8
mov rcx, qword [0x1001653b8]
cmp esi, ebx
ja 0x1000878f0
lea r8, [0x1000096f8]
lea rcx, [0x100009600]
mov edx, 0x20f
call fcn.100099ad8
mov rcx, qword [0x1001653b8]
cmp r12, rbx
jne 0x100087914
lea r8, [0x100009708]
lea rcx, [0x100009600]
mov edx, 0x210
call fcn.100099ad8
mov rcx, qword [0x1001653b8]
cmp rcx, rdi
je 0x100087939
test byte [rcx + 0x1c], 1
je 0x100087939
cmp byte [rcx + 0x19], 4
jb 0x100087939
mov rcx, qword [rcx + 0x10]
mov edx, 0x26
mov r9, rbp
mov r8, r15
call fcn.10001da24
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x40000000
lea r8d, [r9 + 3]
mov rcx, rbp
mov dword [rsp + 0x28], 0x2000080
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1000879cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
cmp r11d, ebx
cmovle eax, r11d
mov ebx, eax
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x100087a8f
test byte [rcx + 0x1c], 1
je 0x100087a6d
cmp byte [rcx + 0x19], 2
jb 0x100087a6d
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x28]
mov r9, rbp
mov r8, r15
mov dword [rsp + 0x20], eax
call fcn.10001daa4
jmp 0x100087a66
lea r9, [rsp + 0x70]
mov r8d, esi
mov rdx, r12
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
jne 0x100087a38
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
cmp r11d, ebx
cmovle eax, r11d
mov ebx, eax
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x100087a5d
test byte [rcx + 0x1c], 1
je 0x100087a5d
cmp byte [rcx + 0x19], 2
jb 0x100087a5d
mov rcx, qword [rcx + 0x10]
mov edx, 0x28
mov r9d, eax
mov r8, r15
call fcn.10001c7dc
jmp 0x100087a5d
cmp esi, dword [rsp + 0x70]
je 0x100087a56
lea r8, [0x100009720]
lea rcx, [0x100009600]
mov edx, 0x233
call fcn.100099ad8
lea rsi, [0x1001653b8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x100087a8f
test byte [rcx + 0x1c], 1
je 0x100087a8f
cmp byte [rcx + 0x19], 4
jb 0x100087a8f
mov rcx, qword [rcx + 0x10]
mov edx, 0x29
mov r8, r15
call fcn.10001c7b8
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop r12
pop rdi
ret
Function at 0x10008b8f4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov rbx, rcx
xor r12d, r12d
xor ecx, ecx
mov qword [rsp + 0x40], r12
mov rbp, rdx
call fcn.10008c07c
mov rax, qword gs:[0x30]
movzx edi, word [rbx]
xor edx, edx
mov rcx, qword [rax + 0x60]
add edi, 0xe
mov rcx, qword [rcx + 0x30]
mov r8d, edi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
cmp rax, r12
jne 0x10008b94f
mov ebx, 0xc0000017
jmp 0x10008b9df
mov dword [rax], 1
mov dword [rax + 4], edi
mov dword [rax + 8], 3
movzx r8d, word [rbx]
mov rdx, qword [rbx + 8]
lea rcx, [rax + 0xc]
call sub.msvcrt.dll_memcpy
movzx r11d, word [rbx]
lea r8, [rsp + 0x40]
shr r11, 1
xor edx, edx
mov rcx, rsi
mov word [rsi + r11*2 + 0xc], r12w
call fcn.10008bbfc
cmp eax, r12d
mov ebx, eax
jl 0x10008b9c3
mov rdi, qword [rsp + 0x40]
lea r8, [0x10014f2d0]
lea rdx, [0x10014f5c0]
mov rcx, rdi
call fcn.10008e828
xor edx, edx
mov rcx, rdi
call fcn.10008c318
cmp eax, r12d
mov ebx, eax
jl 0x10008b9c3
mov qword [rbp], rdi
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret

Function at 0x10008d690
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebx, 1
lea rdx, [rsp + 0x20]
xor r9d, r9d
lea r8d, [rbx + 0x13]
lea ecx, [rbx + 0x59]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x10008d6cf
xor ebx, ebx
cmp dword [rsp + 0x30], 3
cmovl ebx, dword [rsp + 0x30]
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.10014e480
add rsp, 0x40
pop rbx
ret

Function at 0x10008df04
Capabilities:
Delete registry key

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
and qword [rsp + 0x50], 0
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
mov rdi, rcx
call fcn.10008e260
test eax, eax
js 0x10008df74
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x10008df74
mov rbx, qword [rsp + 0x50]
mov rsi, rax
mov rdx, qword [rbx]
lea r9, [rsp + 0x58]
mov r8d, 0xf003f
mov rcx, rdi
call fcn.10008dfc4
test eax, eax
js 0x10008df6a
mov rcx, qword [rsp + 0x58]
call fcn.10008df04
test eax, eax
jns 0x10008df6a
mov rcx, qword [rsp + 0x58]
call fcn.10008dc88
add rbx, 8
sub rsi, 1
jne 0x10008df38
cmp qword [rsp + 0x50], 0
je 0x10008df9a
mov rax, qword gs:[0x30]
mov r8, qword [rsp + 0x50]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov ebx, eax
test eax, eax
js 0x10008dfb2
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x10008e688
Capabilities:
Check for peb beingdebugged flag
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r15, rdx
mov r13, rcx
xor edi, edi
mov r12d, edi
mov rsi, rdi
mov dword [rsp + 0x88], edi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryKey]
mov ebx, eax
mov dword [rsp + 0x80], eax
cmp eax, 0xc0000023
je 0x10008e6fd
cmp eax, edi
jl 0x10008e7bd
mov ebx, 0xc000000d
mov dword [rsp + 0x80], ebx
jmp 0x10008e7bd
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x88]
mov rcx, qword [rax + 0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
cmp rax, rdi
jne 0x10008e737
mov ebx, 0xc000009a
mov dword [rsp + 0x80], ebx
jmp 0x10008e7bd
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x88]
mov r8, rsi
xor edx, edx
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryKey]
mov ebx, eax
mov dword [rsp + 0x80], eax
cmp eax, edi
jl 0x10008e7bd
mov rcx, qword gs:[0x30]
mov r8d, dword [rsi + 0xc]
add r8, 2
mov rcx, qword [rcx + 0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r14, rax
cmp rax, rdi
jne 0x10008e79e
mov ebx, 0xc000009a
mov dword [rsp + 0x80], ebx
jmp 0x10008e7bd
mov r8d, dword [rsi + 0xc]
lea rdx, [rsi + 0x10]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov r11d, dword [rsi + 0xc]
shr r11, 1
mov word [r14 + r11*2], di
mov qword [r15], r14
cmp rsi, rdi
je 0x10008e7de
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp ebx, 0xc000017d
jne 0x10008e80e
int3
mov eax, ebx
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x10008e828
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x30
mov rsi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
and qword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
lea rdx, [0x10014f2d0]
mov r8d, 0x2001f
mov rcx, rsi
call fcn.10008dfc4
mov edi, eax
test eax, eax
js 0x10008e87d
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
mov edi, eax
cmp qword [rsp + 0x50], rsi
je 0x10008e897
cmp qword [rsp + 0x50], 0
je 0x10008e897
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
mov rsi, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x10008e8ac
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r14d, r9d
mov r13, r8
mov r15, rdx
mov r12, rcx
xor esi, esi
xor edi, edi
and qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0xc0]
and qword [rax], rdi
mov rax, qword [rsp + 0xc8]
and dword [rax], edi
mov rdx, r15
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
test r13, r13
je 0x10008e930
lea r9, [rsp + 0x40]
mov r8d, 0x20019
mov rdx, r13
mov rcx, r12
call fcn.10008dfc4
mov ebx, eax
mov dword [rsp + 0x34], eax
test eax, eax
jns 0x10008e935
jmp 0x10008ea4a
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], edi
xor r9d, r9d
lea r8d, [r9 + 2]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, eax
mov dword [rsp + 0x34], eax
cmp eax, 0xc0000023
jne 0x10008ea4a
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x30]
mov rcx, qword [rax + 0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x10008e99f
mov ebx, 0xc000009a
mov dword [rsp + 0x34], ebx
jmp 0x10008ea4a
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8d, 2
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, eax
mov dword [rsp + 0x34], eax
test eax, eax
js 0x10008ea4a
cmp dword [rdi + 4], r14d
je 0x10008e9e5
mov ebx, 0xc0000024
mov dword [rsp + 0x34], ebx
jmp 0x10008ea4a
add dword [rsp + 0x30], 0xfffffff4
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x30]
mov rcx, qword [rax + 0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, qword [rsp + 0xc0]
mov qword [rcx], rax
test rax, rax
jne 0x10008ea23
mov ebx, 0xc000009a
mov dword [rsp + 0x34], ebx
jmp 0x10008ea4a
mov r8d, dword [rsp + 0x30]
lea rdx, [rdi + 0xc]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov r11d, dword [rsp + 0x30]
mov rax, qword [rsp + 0xc8]
mov dword [rax], r11d
xor ebx, ebx
mov dword [rsp + 0x34], ebx
mov rcx, qword [rsp + 0x40]
cmp rcx, r12
je 0x10008ea5f
test rcx, rcx
je 0x10008ea5f
call qword [sym.imp.ntdll.dll_NtClose]
test rdi, rdi
je 0x10008ea80
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp ebx, 0xc000017d
jne 0x10008eac0
int3
mov eax, ebx
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x10008ead8
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r15d, r9d
mov r13, r8
mov r14, rdx
mov r12, rcx
xor esi, esi
mov rdx, r14
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
and qword [rsp + 0x38], 0
test r13, r13
je 0x10008eb4f
lea r9, [rsp + 0x38]
mov r8d, 0x2001f
mov rdx, r13
mov rcx, r12
call fcn.10008dfc4
mov edi, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x10008eb48
mov rbx, qword [rsp + 0x38]
jmp 0x10008eb52
mov rbx, qword [rsp + 0x38]
jmp 0x10008eb84
mov rbx, r12
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov edi, eax
mov dword [rsp + 0x30], eax
cmp rbx, r12
je 0x10008eb96
test rbx, rbx
je 0x10008eb96
mov rcx, rbx
call fcn.10008dc88
cmp edi, 0xc000017d
jne 0x10008ebd6
int3
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x10008f004
Capabilities:
Delete file

Disassembly:
mov r11, rsp
sub rsp, 0x58
mov dword [rsp + 0x20], 0x30
xor eax, eax
mov qword [r11 - 0x30], rax
mov dword [rsp + 0x38], 0x40
mov qword [r11 - 0x28], rcx
lea rcx, [r11 - 0x38]
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x10], rax
call qword [sym.imp.ntdll.dll_NtDeleteFile]
add rsp, 0x58
ret
Function at 0x10008f044
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
and qword [rdx], 0
mov rdi, r8
mov rsi, rdx
xor edx, edx
mov ebx, ecx
mov rcx, rdi
lea r8d, [rdx + 0x28]
call sub.msvcrt.dll_memset
mov r11, qword gs:[0x30]
xor edx, edx
mov rcx, qword [r11 + 0x60]
lea r8d, [rdx + 0x6a]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbp, rax
test rax, rax
jne 0x10008f0a1
mov eax, 0xc0000017
jmp 0x10008f18e
and qword [rsp + 0x20], 0
lea r8, [0x10014f420]
mov r9d, ebx
mov edx, 0x35
mov rcx, rax
call sub.msvcrt.dll_swprintf_s
mov rdx, rsi
mov rcx, rbp
call fcn.10008f1ac
mov ebx, eax
test eax, eax
jns 0x10008f113
lea rdx, [rsp + 0x48]
mov rcx, rbp
call fcn.10008f534
mov ebx, eax
test eax, eax
js 0x10008f14b
mov rcx, qword [rsp + 0x48]
mov rdx, rsi
call fcn.10008f1ac
xor edx, edx
mov ebx, eax
mov rax, qword gs:[0x30]
mov r8, qword [rsp + 0x48]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test ebx, ebx
js 0x10008f14b
mov rax, qword [rsi]
and dword [rdi], 0
cmp dword [rax], 0
jne 0x10008f12d
mov eax, dword [rax + 8]
mov dword [rdi + 4], 1
mov dword [rdi + 8], eax
jmp 0x10008f147
cmp dword [rax], 1
jne 0x10008f142
movdqu xmm0, xmmword [rax + 8]
and dword [rdi + 4], 0
movdqu xmmword [rdi + 8], xmm0
jmp 0x10008f147
mov ebx, 0xc000000d
test ebx, ebx
jns 0x10008f170
mov r8, qword [rsi]
test r8, r8
je 0x10008f170
mov rax, qword gs:[0x30]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
and qword [rsi], 0
mov rax, qword gs:[0x30]
mov r8, rbp
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x10008f278
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, rdx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r9d, 0x18
mov rdi, rcx
mov dword [rsp + 0x20], 1
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
mov r11d, eax
test eax, eax
jns 0x10008f2c9
cmp eax, 0x80000005
jne 0x10008f30d
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov r9d, 0x68
mov rcx, rdi
mov dword [rsp + 0x20], 0x12
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov r11d, eax
test eax, eax
jns 0x10008f2f8
cmp eax, 0x80000005
jne 0x10008f30d
mov eax, dword [rsp + 0x48]
xor r11d, r11d
mov dword [rbx], eax
mov rax, qword [rsp + 0xa0]
mov qword [rbx + 8], rax
mov eax, r11d
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.10014e480
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop rdi
ret
Function at 0x10008fdd0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rsi, rdx
mov rdx, rcx
xor ebp, ebp
lea rcx, [rax - 0x58]
mov qword [rax + 0x20], rbp
mov qword [rax - 0x60], rbp
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea edx, [rbp + 1]
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x30
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x58], 0x40
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rbp
call qword [sym.imp.ntdll.dll_NtOpenSymbolicLinkObject]
cmp eax, ebp
jl 0x10008ffad
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov edi, ebp
mov dword [rsp + 0xa0], ebp
jmp 0x10008feb5
cmp qword [rsp + 0x28], rbp
je 0x10008fe7c
mov rax, qword gs:[0x30]
mov r8, qword [rsp + 0x28]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [rsp + 0xa0]
xor edx, edx
mov word [rsp + 0x22], ax
lea edi, [rax + 2]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r8d, edi
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsp + 0x28], rax
cmp rax, rbp
je 0x10008ffbd
mov rcx, qword [rsp + 0xa8]
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_NtQuerySymbolicLinkObject]
mov ebx, eax
cmp eax, 0xc0000023
je 0x10008fe57
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_NtClose]
cmp ebx, ebp
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0xa8], rbp
jl 0x10008ff88
movzx ecx, word [rsp + 0x20]
lea r8, [rsp + 0x40]
mov edx, 1
shr rcx, 1
mov word [rax + rcx*2], bp
lea rax, [rsp + 0x20]
lea rcx, [rsp + 0xa8]
mov word [rsp + 0x22], di
mov dword [rsp + 0x40], 0x30
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x40
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rbp
call qword [sym.imp.ntdll.dll_NtOpenSymbolicLinkObject]
cmp eax, ebp
jge 0x10008feb5
mov rax, qword [rsp + 0x28]
mov ebx, ebp
mov qword [rsi], rax
mov rcx, qword [rsp + 0xa8]
cmp rcx, rbp
je 0x10008ff84
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0xa8], rbp
cmp ebx, ebp
jge 0x10008ffab
cmp rax, rbp
je 0x10008ffab
mov rax, qword gs:[0x30]
mov r8, qword [rsp + 0x28]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
mov ebx, 0xc000009a
jmp 0x10008ff64
Function at 0x100090728
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x58], rax
sub edx, 1
mov rdi, r8
je 0x1000907bf
cmp edx, 1
je 0x100090758
mov ebx, 0xc000000d
jmp 0x1000907e5
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
lea rdx, [0x100009b08]
call fcn.100090400
mov ebx, eax
test eax, eax
js 0x1000907ae
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x23000003
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0x10
call fcn.100090d4c
mov ebx, eax
test eax, eax
js 0x1000907ae
movdqu xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rdi], xmm0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1000907e5
call fcn.10008dc88
jmp 0x1000907e5
xor r9d, r9d
lea rdx, [rsp + 0x40]
lea r8d, [r9 + 0x14]
lea ecx, [r9 + 0x5a]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
test eax, eax
js 0x1000907e5
movdqu xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rdi], xmm0
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.10014e480
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x100090afc
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov ebp, edx
xor edx, edx
mov r12, rcx
mov rsi, r8
lea r9, [rsp + 0x58]
lea ecx, [rdx + 0x62]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
cmp eax, 0xc0000023
je 0x100090b44
test eax, eax
js 0x100090bd2
mov ebx, 0xc0000001
jmp 0x100090bd2
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x100090b71
mov ebx, 0xc000009a
jmp 0x100090bb1
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, rax
mov ecx, 0x62
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
test eax, eax
js 0x100090bb1
movzx eax, word [rdi]
add eax, 2
mov dword [rsi], eax
cmp eax, ebp
jbe 0x100090ba2
mov ebx, 0xc0000023
jmp 0x100090bb1
mov rdx, qword [rdi + 8]
mov r8d, eax
mov rcx, r12
call sub.msvcrt.dll_memcpy
test rdi, rdi
je 0x100090bd2
mov rax, qword gs:[0x30]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test ebx, ebx
jns 0x100090bed
lea rcx, [fcn.100090c08]
mov r9, rsi
mov r8d, ebp
mov rdx, r12
call fcn.100090c44
mov ebx, eax
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret