joyce8/EMBER2024-capa huggingface dataset:
Function at 0x911060
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00d93d20]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x9110cd
mov rcx, r8
call fcn.00910f40
test eax, eax
je 0x9110cd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x9110cd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x9110c4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x9110cf
add rax, 0x28
cmp rax, r9
jne 0x9110b0
xor eax, eax
add rsp, 0x28
ret

Function at 0x912aa0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x68
movaps xmmword [rsp], xmm6
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x50], xmm11
mov rax, qword [0x00d92d50]
movdqa xmm11, xmmword [rcx]
movdqa xmm10, xmmword [rcx + 0x10]
movdqa xmm9, xmmword [rax + 0xc0]
movdqa xmm8, xmmword [rax + 0xd0]
add rdx, r8
movdqa xmm7, xmmword [rax + 0xe0]
cmp r8, rdx
movdqa xmm6, xmmword [rax + 0xf0]
movdqa xmm5, xmmword [rax + 0x100]
movdqa xmm4, xmmword [rax + 0x110]
movdqa xmm3, xmmword [rax + 0x120]
movdqa xmm2, xmmword [rax + 0x130]
movdqa xmm1, xmmword [rcx + 0x20]
movdqa xmm0, xmmword [rcx + 0x30]
jae 0x912ba5
nop dword [rax + rax]
aesdec xmm11, xmm9
aesenc xmm10, xmm9
aesdec xmm1, xmm5
aesenc xmm0, xmm5
aesdec xmm11, xmm8
aesenc xmm10, xmm8
aesdec xmm1, xmm4
add r8, 0x40
aesenc xmm0, xmm4
aesdec xmm11, xmm7
aesenc xmm10, xmm7
aesdec xmm1, xmm3
aesenc xmm0, xmm3
aesdec xmm11, xmm6
aesenc xmm10, xmm6
movaps xmmword [r8 - 0x40], xmm11
movaps xmmword [r8 - 0x30], xmm10
aesdec xmm1, xmm2
aesenc xmm0, xmm2
movaps xmmword [r8 - 0x20], xmm1
movaps xmmword [r8 - 0x10], xmm0
cmp rdx, r8
ja 0x912b30
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
add rsp, 0x68
ret
lea r8, [rcx + 0x40]
mov rax, rdx
mov rdx, qword [0x00d92d50]
mov rcx, rax
mov edx, dword [rdx + 0x34]
lea edx, [rdx*8 + 0x80]
jmp 0x912aa0

Function at 0x912f10
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movdqa xmm0, xmmword [str._f__nc]
movdqa xmm1, xmmword [0x00d053b0]
movdqa xmm2, xmmword [0x00d053c0]
movdqa xmm3, xmmword [0x00d053d0]
add rdx, rcx
cmp rcx, rdx
jae 0x912f60
nop dword [rax + rax]
aesenc xmm3, xmmword [rcx]
aesdec xmm2, xmmword [rcx + 0x10]
aesenc xmm1, xmmword [rcx + 0x20]
aesdec xmm0, xmmword [rcx + 0x30]
add rcx, 0x40
cmp rdx, rcx
ja 0x912f40
movdqa xmm4, xmmword [0x00d053e0]
aesenc xmm3, xmm4
aesdec xmm2, xmm4
aesenc xmm1, xmm4
aesdec xmm0, xmm4
movdqa xmm4, xmmword [0x00d053f0]
aesenc xmm3, xmm4
aesdec xmm2, xmm4
aesenc xmm1, xmm4
aesdec xmm0, xmm4
movaps xmmword [r8], xmm3
movaps xmmword [r8 + 0x10], xmm2
movaps xmmword [r8 + 0x20], xmm1
movaps xmmword [r8 + 0x30], xmm0
ret
Function at 0x9790b0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x68
movaps xmmword [rsp], xmm6
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x50], xmm11
mov rax, qword [0x00d92d50]
movdqa xmm11, xmmword [rcx]
movdqa xmm10, xmmword [rcx + 0x10]
movdqa xmm9, xmmword [rax + 0xc0]
movdqa xmm8, xmmword [rax + 0xd0]
add rdx, r8
movdqa xmm7, xmmword [rax + 0xe0]
cmp r8, rdx
movdqa xmm6, xmmword [rax + 0xf0]
movdqa xmm5, xmmword [rax + 0x100]
movdqa xmm4, xmmword [rax + 0x110]
movdqa xmm3, xmmword [rax + 0x120]
movdqa xmm2, xmmword [rax + 0x130]
movdqa xmm1, xmmword [rcx + 0x20]
movdqa xmm0, xmmword [rcx + 0x30]
jae 0x912ba5
nop dword [rax + rax]
aesdec xmm11, xmm9
aesenc xmm10, xmm9
aesdec xmm1, xmm5
aesenc xmm0, xmm5
aesdec xmm11, xmm8
aesenc xmm10, xmm8
aesdec xmm1, xmm4
add r8, 0x40
aesenc xmm0, xmm4
aesdec xmm11, xmm7
aesenc xmm10, xmm7
aesdec xmm1, xmm3
aesenc xmm0, xmm3
aesdec xmm11, xmm6
aesenc xmm10, xmm6
movaps xmmword [r8 - 0x40], xmm11
movaps xmmword [r8 - 0x30], xmm10
aesdec xmm1, xmm2
aesenc xmm0, xmm2
movaps xmmword [r8 - 0x20], xmm1
movaps xmmword [r8 - 0x10], xmm0
cmp rdx, r8
ja 0x912b30
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
add rsp, 0x68
ret
lea r8, [rcx + 0x40]
mov rax, rdx
mov rdx, qword [0x00d92d50]
mov rcx, rax
mov edx, dword [rdx + 0x34]
lea edx, [rdx*8 + 0x80]
jmp 0x912aa0
Function at 0x9dd100
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rbp, rcx
mov rdi, rdx
mov esi, r8d
jmp 0x9dd128
call r12
cmp dword [rax], 4
jne 0x9dd146
mov rcx, rbp
call fcn.009dd000
mov r8d, esi
mov rdx, rdi
mov ecx, eax
call sub.msvcrt.dll__read_1
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
je 0x9dd120
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0xa17020
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp fcn.00401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00912130
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.00912130
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x1400039d3
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
lea rbx, [rsp + 0x2c]
mov dword [rbx], 0
mov ecx, 0xb
xor edx, edx
xor r8d, r8d
mov r9, rbx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov eax, dword [rbx]
mov edx, eax
mov eax, 0
test rdx, rdx
je 0x140003a9a
xor ecx, ecx
mov r8d, 0x54616731
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test rax, rax
je 0x140003a98
mov r14, rax
mov rbx, rax
lea r9, [rsp + 0x2c]
mov r8d, dword [r9]
mov ecx, 0xb
mov rdx, r14
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
js 0x140003a80
cmp dword [rbx], 0
je 0x140003a80
add r14, 0x30
xor r15d, r15d
movzx eax, word [r14 - 2]
mov ecx, eax
add rcx, r14
mov rdx, rdi
call sub.ntoskrnl.exe__stricmp
test eax, eax
je 0x140003aa6
mov rax, r15
inc rax
mov ecx, dword [rbx]
add r14, 0x128
mov r15, rax
cmp rax, rcx
jb 0x140003a53
xor eax, eax
mov rsi, rax
mov rcx, rbx
mov edx, 0x54616731
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rsi
jmp 0x140003a9a
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [r14 - 0x18]
test rsi, rsi
je 0x140003a82
mov ecx, dword [r14 - 0x10]
mov dword [rsi], ecx
jmp 0x140003a82

Function at 0x140004259
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rcx, qword [0x14000e818]
mov rax, rcx
test rcx, rcx
jne 0x14000437d
mov dword [rsp + 0x2c], 0
movabs rax, 0x3d59435f17545944
mov qword [rsp + 0x35], rax
movabs rax, 0x5459445e475c465f
mov qword [rsp + 0x30], rax
cmp byte [rsp + 0x3c], 0
je 0x1400042c0
xor eax, eax
mov ecx, eax
mov dl, al
lea ecx, [rdx + 0x31]
xor byte [rsp + rax + 0x30], cl
mov rcx, rax
inc rcx
mov rax, rcx
cmp rcx, 0xd
jne 0x1400042a6
lea rcx, [rsp + 0x30]
lea rdi, [rsp + 0x2c]
mov rdx, rdi
call fcn.1400039d3
mov ecx, dword [rdi]
test rax, rax
je 0x14000434d
mov rsi, rax
mov eax, 0
test ecx, ecx
je 0x14000437d
movabs rax, 0x20e78307efc1f88b
mov qword [rsp + 0x43], rax
mov dword [rsp + 0x4b], 0xfff25
mov byte [rsp + 0x4f], 0
cmp ecx, 0xd
je 0x14000437b
lea rbx, [rsi + 0x14]
lea rdi, [rsp + 0x43]
mov r14, qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
xor r15d, r15d
lea rcx, [rsi + r15]
mov r8d, 0xd
mov rdx, rdi
call r14
cmp rax, 0xd
je 0x140004354
mov rax, r15
inc rax
mov ecx, dword [rsp + 0x2c]
add ecx, 0xfffffff3
inc rbx
mov r15, rax
cmp rax, rcx
jb 0x14000431d
jmp 0x14000437b
mov eax, 0
jmp 0x14000437d
cmp byte [rbx - 7], 0x4c
jne 0x14000437b
cmp byte [rbx - 6], 0x8d
jne 0x14000437b
cmp byte [rbx - 5], 0x15
jne 0x14000437b
movsxd rax, dword [rbx - 4]
test rax, rax
je 0x14000437b
add rax, rbx
mov qword [0x14000e818], rax
jmp 0x14000437d
xor eax, eax
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140004389
Capabilities:
Get file attributes
Read file on windows
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov rsi, rcx
mov rdi, rcx
lea rbx, [rsp + 0xb8]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0xc8]
mov dword [r8], 0x30
xor eax, eax
xor ecx, ecx
mov qword [r8 + 8], rcx
mov dword [r8 + 0x18], 0x240
mov qword [r8 + 0x10], rbx
xorps xmm0, xmm0
movups xmmword [r8 + 0x20], xmm0
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x48], rcx
mov eax, 1
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x68], 0x100
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x78]
lea r9, [rsp + 0x88]
mov edx, 1
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
mov ecx, 0
mov ebp, 0
test eax, eax
js 0x1400045bd
lea r8, [rsp + 0x98]
mov qword [r8], 0
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x20], 0xe
lea rdx, [rsp + 0x88]
mov r9d, 8
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov rcx, qword [rsp + 0x78]
test eax, eax
js 0x1400045b3
mov dword [rsp + 0x20], 5
lea r15, [rsp + 0x88]
lea r8, [rsp + 0xa0]
mov rdx, r15
mov r9d, 0x18
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
js 0x1400045ae
mov rax, qword [rsp + 0xa8]
mov ebp, eax
mov eax, eax
mov edx, eax
mov ecx, 0x200
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r14, rax
mov rbx, rax
mov rcx, qword [rsp + 0x78]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebp, eax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebp, ebp
js 0x1400045da
mov qword [rsp + 0x80], rdi
movsxd r12, dword [rbx + 0x3c]
movzx r13d, word [rbx + r12 + 0x14]
mov ebp, dword [rbx + r12 + 0x50]
mov edx, ebp
mov ecx, 0x200
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r15, rax
mov eax, dword [rbx + r12 + 0x54]
mov r8d, eax
mov rcx, r15
mov rdx, rbx
call fcn.14000c500
cmp word [rbx + r12 + 6], 0
je 0x140004596
add r12, r14
mov eax, r13d
lea rdi, [rax + r12]
add rdi, 0x18
add rdi, 0x14
xor ecx, ecx
mov r13, rcx
mov eax, dword [rdi - 8]
mov r8d, dword [rdi - 4]
mov ecx, eax
add rcx, r15
mov eax, dword [rdi]
mov edx, eax
add rdx, r14
call fcn.14000c500
inc r13
movzx eax, word [r12 + 6]
mov edx, eax
add rdi, 0x28
mov rcx, r13
cmp r13, rdx
jb 0x140004564
mov rcx, rbx
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, r15
mov rdi, qword [rsp + 0x80]
jmp 0x1400045bd
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor ecx, ecx
xor ebp, ebp
mov qword [rsi], rcx
mov dword [rsi + 8], ebp
mov rax, rdi
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x1400045b9
Function at 0x1400045e7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
movsxd rax, dword [rcx + 0x3c]
mov eax, dword [rcx + rax + 0x88]
mov ebx, eax
mov eax, dword [rcx + rbx + 0x18]
mov r14d, eax
test r14, r14
je 0x14000464c
mov rsi, rdx
mov rdi, rcx
mov eax, dword [rcx + rbx + 0x20]
mov r15d, eax
add r15, rcx
mov r12, rcx
xor r13d, r13d
mov eax, dword [r15 + r13*4]
mov ecx, eax
add rcx, rdi
mov rdx, rsi
call sub.ntoskrnl.exe_strcmp
test eax, eax
je 0x140004653
mov rax, r13
inc rax
add r12, 2
mov r13, rax
cmp r14, rax
jne 0x140004625
xor eax, eax
jmp 0x140004700
mov eax, dword [rdi + rbx + 0x1c]
mov ecx, dword [rdi + rbx + 0x24]
movzx ecx, word [r12 + rcx]
add rax, rdi
mov eax, dword [rax + rcx*4]
mov esi, eax
add rsi, rdi
xor eax, eax
mov rdi, rax
mov al, byte [rsi + rax]
test rdi, rdi
je 0x14000467c
cmp al, 0x2e
je 0x1400046a1
mov ecx, eax
and cl, 0xdf
add cl, 0xa5
cmp cl, 0xe6
setb cl
add al, 0xc6
cmp al, 0xf6
setb al
test al, cl
jne 0x1400046fd
lea rax, [rdi + 1]
cmp rdi, 0x31
jne 0x14000466d
jmp 0x1400046fd
lea rax, [rdi - 0x28]
neg rax
cmp rdi, 0x28
mov ecx, 0
mov r8, rax
cmovae r8, rcx
lea rcx, [rsp + rdi]
add rcx, 0x20
xor edx, edx
call fcn.14000c400
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.14000c500
mov rcx, rbx
mov edx, 0
call fcn.1400039d3
test rax, rax
je 0x1400046fd
mov rcx, rax
lea rdx, [rsi + rdi]
inc rdx
call fcn.1400045e7
jmp 0x140004700
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140004d00
Capabilities:
Encode data using xor
Print debug messages

Disassembly:
sub rsp, 0x98
call fcn.1400067b6
mov rcx, rax
call fcn.140006b30
movabs rax, 0x4620282a042d2f4d
mov qword [rsp + 0x4e], rax
movups xmm0, xmmword [0x1400050bb]
movups xmmword [rsp + 0x40], xmm0
cmp byte [rsp + 0x55], 0
je 0x140004d52
xor eax, eax
mov ecx, eax
mov dl, al
lea ecx, [rdx + 0x31]
xor byte [rsp + rax + 0x40], cl
mov rcx, rax
inc rcx
mov rax, rcx
cmp rcx, 0x16
jne 0x140004d38
lea rcx, [rsp + 0x40]
call fcn.1400047bb
mov qword [0x14000e820], rax
movabs rax, 0x453d312d2c257252
mov qword [rsp + 0x2d], rax
movups xmm0, xmmword [0x1400050d1]
movups xmmword [rsp + 0x20], xmm0
cmp byte [rsp + 0x34], 0
je 0x140004da1
xor eax, eax
mov ecx, eax
mov dl, al
lea ecx, [rdx + 0x31]
xor byte [rsp + rax + 0x20], cl
mov rcx, rax
inc rcx
mov rax, rcx
cmp rcx, 0x15
jne 0x140004d87
lea rcx, [rsp + 0x20]
call fcn.1400047bb
mov qword [0x14000e828], rax
mov r8, rax
mov rdx, qword [0x14000e820]
movabs rax, 0x333841405e1a100e
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [0x1400050e6]
movups xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [0x1400050f6]
movups xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [0x140005106]
movups xmmword [rsp + 0x80], xmm0
cmp byte [rsp + 0x97], 0
je 0x140004e2d
xor eax, eax
mov ecx, eax
mov r9b, al
lea ecx, [r9 - 0x35]
cmp rax, 0x35
mov r9d, eax
movzx ecx, cl
cmovb ecx, eax
add cl, 0x31
xor byte [rsp + rax + 0x60], cl
mov rcx, rax
inc rcx
mov rax, rcx
cmp rcx, 0x38
jne 0x140004e01
lea rcx, [rsp + 0x60]
call sub.ntoskrnl.exe_DbgPrint
cmp qword [0x14000e820], 0
je 0x140004e5c
call fcn.1400067b6
mov rdx, qword [0x14000e820]
lea r8, [0x140004e8a]
mov rcx, rax
call fcn.14000744e
cmp qword [0x14000e828], 0
je 0x140004e81
call fcn.1400067b6
mov rdx, qword [0x14000e828]
lea r8, [0x140004f9d]
mov rcx, rax
call fcn.14000744e
nop
add rsp, 0x98
ret
Function at 0x140005c34
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
mov dword [rsp + 0x2c], 0
call fcn.140005ade
lea rsi, [rsp + 0x64]
mov r8d, 0x114
mov rcx, rsi
xor edx, edx
call fcn.14000c400
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov ecx, 0xffffffff
test eax, eax
js 0x140005c7f
mov ecx, dword [rsp + 0x70]
cmp ecx, 0x47ba
jae 0x140005c8e
xor eax, eax
jmp 0x140005e2f
lea rcx, [0x1400061bc]
lea rdi, [rsp + 0x2c]
mov rdx, rdi
call fcn.140007fee
mov rsi, rax
mov rbx, rax
mov eax, dword [rdi]
mov edi, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test rdi, rdi
je 0x140005ce3
test al, al
je 0x140005ce3
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x50], rbx
movzx eax, word [rbx]
cmp eax, 0x5a4d
jne 0x140005dd6
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x140005dd6
add rax, rsi
movzx ecx, word [rax + 6]
mov ebx, ecx
test rbx, rbx
je 0x140005dd6
movzx ecx, word [rax + 0x14]
lea r14, [rax + rcx]
add r14, 0x18
lea rdi, [0x1400061d6]
lea r15, [0x140006200]
lea r12, [0x1400061db]
xor r13d, r13d
lea rbp, [r13*4]
add rbp, r13
lea rcx, [r14 + rbp*8]
mov rdx, rdi
call sub.ntoskrnl.exe_strstr
test rax, rax
je 0x140005dc4
mov ecx, dword [r14 + rbp*8 + 8]
cmp ecx, 0x24
je 0x140005dc4
mov eax, dword [r14 + rbp*8 + 0xc]
add rax, rsi
add ecx, 0xffffffdc
mov r8, rax
xor edx, edx
xor r11d, r11d
xor r9d, r9d
mov r10d, r11d
mov r11b, byte [r8 + r9]
cmp r11b, byte [r9 + r15]
je 0x140005d88
cmp byte [r9 + r12], 0x3f
jne 0x140005da3
lea rbp, [r9 + 1]
cmp r9, 0x23
setae r9b
mov r10d, r9d
mov r11d, r9d
mov r9, rbp
cmp rbp, 0x24
jne 0x140005d74
test r10b, 1
jne 0x140005dbc
mov r9, rdx
inc r9
inc r8
mov rdx, r9
cmp r9, rcx
jne 0x140005d6e
jmp 0x140005dc4
add rdx, rax
mov rax, rdx
jne 0x140005dd8
mov rax, r13
inc rax
mov r13, rax
cmp rax, rbx
jne 0x140005d38
xor eax, eax
mov rsi, rax
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140005df5
movsxd rax, dword [rsi + 3]
add rsi, rax
add rsi, 7
jmp 0x140005df7
xor esi, esi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140005e1c
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140005e2c
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rax, rsi
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140006b30
Capabilities:
Create thread
Encode data using xor
Print debug messages

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1c0
cmp qword [0x14000ebb8], 0
je 0x140006c9c
mov rsi, rcx
call fcn.140005ade
test rax, rax
je 0x140006ca6
lea rdi, [rsp + 0xac]
mov r8d, 0x114
mov rcx, rdi
xor edx, edx
call fcn.14000c400
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov ecx, 0xffffffff
test eax, eax
js 0x140006b8a
mov ecx, dword [rsp + 0xb8]
cmp ecx, 0x1db1
ja 0x140006cad
cmp qword [rsi + 0xa0], 0
je 0x140006d22
mov rcx, rsi
call fcn.140006ecc
test al, al
je 0x140006d22
mov rcx, qword [rsi + 0x90]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
mov ebx, 0xc0000001
test al, al
je 0x140006d2b
mov rax, qword [rsi + 0x90]
lea rcx, [0x1400078aa]
mov qword [rax], rcx
lea rcx, [rsp + 0x58]
mov qword [rcx], 0
xorps xmm0, xmm0
lea rax, [rsp + 0x60]
movups xmmword [rax], xmm0
lea r8, [rsp + 0x70]
movups xmmword [r8], xmm0
movups xmmword [r8 + 0x10], xmm0
mov dword [r8], 0x30
mov dword [r8 + 0x18], 0x200
movups xmmword [r8 + 0x20], xmm0
mov rdx, qword [rsi + 0xa0]
lea r9, [0x1400072b0]
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
mov edx, 0x1fffff
xor r9d, r9d
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov esi, eax
test eax, eax
js 0x140006c54
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
movups xmm0, xmmword [0x140007a04]
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x4449752f
cmp byte [rsp + 0x53], 0
je 0x140006c8b
xor eax, eax
mov ecx, eax
mov dl, al
lea ecx, [rdx + 0x31]
xor byte [rsp + rax + 0x40], cl
mov rcx, rax
inc rcx
mov rax, rcx
cmp rcx, 0x14
jne 0x140006c71
lea rcx, [rsp + 0x40]
call sub.ntoskrnl.exe_DbgPrint
mov ebx, esi
jmp 0x140006d2b
mov ebx, 0xc00000a0
jmp 0x140006d2b
mov ebx, 0xc000009a
jmp 0x140006d2b
lea rdi, [rsi + 0x10]
mov rcx, rdi
call fcn.140005784
test eax, eax
js 0x140006d29
mov rcx, rdi
call fcn.140005908
mov ebx, eax
test eax, eax
js 0x140006d2b
cmp qword [rdi], 0
je 0x140006d22
cli
mov rax, qword [rsi + 0x10]
mov ecx, dword [rsi + 0x20]
mov rax, qword [rax + rcx*8]
mov qword [0x14000ebc0], rax
lea rdx, [rsi + 0x28]
lea rdi, [0x14000737a]
mov rcx, rdi
call fcn.140001dcd
mov qword [rsi + 0x30], rax
test rax, rax
je 0x140006d14
mov rcx, rax
mov r8d, dword [rsi + 0x60]
lea rdx, [rsi + 0x38]
call fcn.140003f21
mov rdi, qword [rsi + 0x30]
mov rax, qword [rsi + 0x10]
mov ecx, dword [rsi + 0x20]
mov qword [rax + rcx*8], rdi
sti
jmp 0x140006d2b
mov ebx, 0xc0000001
jmp 0x140006d2b
mov ebx, eax
mov eax, ebx
add rsp, 0x1c0
pop rbx
pop rdi
pop rsi
ret
Function at 0x140007fee
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x138
mov rsi, rdx
mov rdi, rcx
lea rbx, [rsp + 0x2c]
mov dword [rbx], 0
mov ecx, 0xb
xor edx, edx
xor r8d, r8d
mov r9, rbx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
shl dword [rbx], 1
lea rcx, [rsp + 0x30]
mov r8d, 0x100
xor edx, edx
call fcn.14000c400
test rdi, rdi
je 0x140008084
movzx edx, word [rdi]
test dx, dx
je 0x14000807b
mov eax, 0x3f
xor ecx, ecx
movzx edx, dx
cmp edx, 0x80
cmovae edx, eax
mov byte [rsp + rcx + 0x30], dl
lea r8, [rcx + 1]
cmp rcx, 0xfd
ja 0x14000807e
movzx r9d, word [rdi + rcx*2 + 2]
mov edx, r9d
mov rcx, r8
test r9w, r9w
jne 0x14000804a
jmp 0x14000807e
xor r8d, r8d
mov byte [rsp + r8 + 0x30], 0
mov eax, dword [rsp + 0x2c]
mov edx, eax
xor ecx, ecx
mov r8d, 0x74656d70
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test rax, rax
je 0x14000813a
mov r14, rax
mov rdi, rax
lea r9, [rsp + 0x2c]
mov r8d, dword [r9]
mov ecx, 0xb
mov rdx, r14
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
js 0x14000811b
cmp dword [rdi], 0
je 0x14000811b
add r14, 0x30
lea rbx, [rsp + 0x30]
xor r12d, r12d
mov rcx, r14
mov edx, 0x5c
call sub.ntoskrnl.exe_strrchr
lea r15, [rax + 1]
test rax, rax
cmove r15, r14
mov rcx, rbx
call sub.ntoskrnl.exe_strlen
mov rcx, r15
mov rdx, rbx
mov r8, rax
call sub.ntoskrnl.exe__strnicmp
test eax, eax
je 0x14000814d
mov rax, r12
inc rax
mov ecx, dword [rdi]
add r14, 0x128
mov r12, rax
cmp rax, rcx
jb 0x1400080d2
xor esi, esi
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140008135
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rsi
jmp 0x14000813c
xor eax, eax
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbx, qword [r14 - 0x18]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140008164
mov eax, dword [r14 - 0x10]
mov dword [rsi], eax
mov rsi, rbx
jmp 0x14000811d

Function at 0x140008370
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x1400083d6
mov rdi, rdx
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
jne 0x1400083d6
add rdx, rcx
movzx eax, word [rdx + 6]
test rax, rax
je 0x1400083d6
mov rsi, r8
movzx ecx, word [rdx + 0x14]
lea rbx, [rdx + rcx]
add rbx, 0x18
mov r14, rbx
neg r14
mov r15, rax
mov rcx, rbx
mov rdx, rdi
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x1400083e4
add rbx, 0x28
add r14, 0xffffffffffffffd8
dec r15
jne 0x1400083b9
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
test rsi, rsi
je 0x1400083ee
mov eax, dword [rbx + 0x10]
mov dword [rsi], eax
mov eax, dword [rbx + 0xc]
sub rax, r14
jmp 0x1400083d8