joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401620c0
Capabilities:
Parse pe header

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x50
mov r14, r8
mov rbp, rcx
mov edi, 0x100
call fcn.140170dc0
test rax, rax
jne 0x1401620ec
mov eax, 0xc00000bb
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
mov rcx, qword [0x1402caaf0]
mov r8, rdi
mov qword [rsp + 0x70], rbx
mov edx, 4
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r15
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r12d, r12d
lea r15, [0x14023ec90]
mov r13d, 0x5a4d
test byte [0x1402c6210], 1
mov rsi, rax
jne 0x14016228c
lock bts qword [0x1402c6210], 0x1f
setb al
test al, al
jne 0x140162275
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], 0x12
mov qword [rsp + 0x38], r15
call fcn.14017e120
test rax, rax
jne 0x1401621cf
xor edx, edx
mov r8d, 0x800
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
jne 0x1401621cf
xor edx, edx
mov r8d, 0x200
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop dword [rax]
test rax, rax
jne 0x1401621cf
cmp dword [0x1402bff40], 0x3e
jae 0x140162267
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
je 0x140162267
cmp word [rax], r13w
jne 0x140162267
mov edx, dword ds:[rax + 0x3c]
lea ecx, [rdx - 1]
cmp ecx, 0x7ffffffd
ja 0x140162267
cmp dword [rdx + rax], 0x4550
jne 0x140162267
add rdx, 0x88
add rdx, rax
mov ecx, dword [rdx]
test ecx, ecx
je 0x140162267
cmp dword [rdx + 4], r12d
je 0x140162267
lea r8, ds:[rax + rcx]
mov word [rsp + 0x20], r12w
mov rcx, rax
lea r9, str.NtQueryInformationResourceManager
call fcn.14017e4c0
mov r9, rax
test rax, rax
je 0x140162267
mov r8, qword [0x7ffe0320]
mov ecx, dword [0x7ffe0004]
mov eax, r8d
shr r8, 0x20
imul rax, rcx
imul r8, rcx
shr rax, 0x18
shl r8, 8
add rax, r8
mov qword [0x1402ce070], rax
xor rax, r9
mov qword [0x1402ce0f0], rax
lea rcx, [0x1402c6210]
call sym.SystemInformer.exe_PhfSetEvent
jmp 0x14016228c
test byte [0x1402c6210], 1
jne 0x14016228c
xor edx, edx
lea rcx, [0x1402c6210]
call sym.SystemInformer.exe_PhfWaitForEvent
mov rax, qword [0x1402ce0f0]
test rax, rax
je 0x1401622aa
mov rcx, qword [0x1402ce070]
nop
test rcx, rcx
je 0x1401622aa
xor rax, rcx
jmp 0x1401622ad
mov rax, r12
mov r9d, edi
mov qword [rsp + 0x20], r12
mov r8, rsi
xor edx, edx
mov rcx, rbp
call qword [case.0x14013d84a.0]
mov ebx, eax
cmp eax, 0x80000005
jne 0x140162316
mov rcx, qword [0x1402caaf0]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea eax, [rdi + rdi]
mov edi, eax
cmp eax, 0x100000
ja 0x14016230f
lfence
mov rcx, qword [0x1402caaf0]
mov r8d, edi
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
jmp 0x14016212d
mov eax, 0xc000009a
jmp 0x140162333
test ebx, ebx
js 0x14016231f
mov qword [r14], rsi
jmp 0x140162331
mov rcx, qword [0x1402caaf0]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x40]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
Function at 0x140163d40
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov dword [rsp + 0x38], 0x800
mov rcx, qword [0x1402caaf0]
mov edx, 4
mov r8d, 0x800
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140163dd8
mov rcx, qword [0x1402caaf0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x38]
mov edx, 4
mov rcx, qword [0x1402caaf0]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lfence
test eax, eax
js 0x140163de2
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140163e00
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
sub rsp, 0x178
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x130
call fcn.14020ab40
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov r8d, 0x130
lea rdx, [rsp + 0x30]
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140163e9d
cmp dword [rsp + 0x30], 1
jb 0x140163e9d
lea rax, [rsp + 0x60]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp byte [rax + rdx], 0
jne 0x140163e70
lea rcx, ds:[rsp + 0x60]
call sym.SystemInformer.exe_PhConvertUtf8ToUtf16Ex
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401e4a20
add rsp, 0x178
ret
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401e4a20
add rsp, 0x178
ret
Function at 0x140163ec0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov r11, rsp
sub rsp, 0x178
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp dword [0x1402bff40], 0x64
jb 0x140163f87
mov qword [r11 + 8], rbx
mov qword [r11 - 8], rdi
mov rdi, qword [0x1402c6060]
test rdi, rdi
jne 0x140163f0a
nop dword [rax]
call sym.SystemInformer.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x140163f5c
mov rdx, qword [0x1402ca998]
lea rcx, [rdi + 0x12]
mov qword [rsp + 0x188], rsi
mov rsi, qword [str.SystemRootSystem32_ntoskrnl.exe]
call sym.SystemInformer.exe_PhCreateObject
mov rbx, rax
xor ecx, ecx
mov qword [rax], rdi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rdi], cx
test rsi, rsi
je 0x140163f54
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.14020af00
mov rsi, qword [rsp + 0x188]
mov rdi, qword [rsp + 0x170]
mov rax, rbx
mov rbx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401e4a20
add rsp, 0x178
ret
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x130
call fcn.14020ab40
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov r8d, 0x130
lea rdx, [rsp + 0x30]
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax]
test eax, eax
je 0x140163ff8
cmp eax, 0xc0000004
jne 0x140163ff8
cmp dword [rsp + 0x30], 1
jb 0x140163ff8
lea rax, [rsp + 0x60]
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp byte [rax + rdx], 0
jne 0x140163fe0
lea rcx, [rsp + 0x60]
call sym.SystemInformer.exe_PhConvertUtf8ToUtf16Ex
mov rcx, rax
jmp 0x140163ffa
xor ecx, ecx
mov rax, rcx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401e4a20
add rsp, 0x178
ret
Function at 0x140164020
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rsi
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x1402bf040]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x130
lea rcx, [rsp + 0x30]
call fcn.14020ab40
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov r8d, 0x130
lea rdx, [rsp + 0x30]
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax]
test eax, eax
je 0x140164190
cmp eax, 0xc0000004
jne 0x140164195
cmp dword [rsp + 0x30], 1
jb 0x140164190
nop
test rsi, rsi
je 0x140164168
cmp dword [0x1402bff40], 0x64
jb 0x140164142
mov qword [rsp + 0x1b8], rbx
mov qword [rsp + 0x170], rdi
mov rdi, qword [0x1402c5e28]
test rdi, rdi
jne 0x1401640dc
call sym.SystemInformer.exe_PhReferenceEmptyString
mov rbx, rax
jmp 0x14016412d
mov rdx, qword [0x1402ca998]
lea rcx, [rdi + 0x12]
mov qword [rsp + 0x178], rbp
mov rbp, qword [str.SystemRootSystem32_ntoskrnl.exe]
call sym.SystemInformer.exe_PhCreateObject
mov rbx, rax
xor ecx, ecx
mov qword [rax], rdi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rdi], cx
test rbp, rbp
je 0x140164125
mov rcx, qword ds:[rbx + 8]
mov r8, rdi
mov rdx, rbp
call fcn.14020af00
mov rbp, qword [rsp + 0x178]
mov rdi, qword [rsp + 0x170]
mov qword [rsi], rbx
mov rbx, qword [rsp + 0x1b8]
jmp 0x140164168
lea rax, [rsp + 0x60]
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp byte [rax + rdx], 0
jne 0x140164150
lea rcx, ds:[rsp + 0x60]
call sym.SystemInformer.exe_PhConvertUtf8ToUtf16Ex
mov qword [rsi], rax
cmp dword [0x1402bff40], 0x71
mov rax, qword [rsp + 0x48]
jb 0x140164182
test rax, rax
jne 0x140164182
mov rax, 0xfffffffffffffffe
mov qword [r14], rax
mov eax, dword [rsp + 0x50]
mov dword [r15], eax
xor eax, eax
jmp 0x140164195
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401e4a20
add rsp, 0x180
pop r15
pop r14
pop rsi
ret

Function at 0x1401641c0
Capabilities:
Get system information on windows

Disassembly:
mov edx, 5
jmp sym.SystemInformer.exe_PhEnumProcessesEx
Function at 0x1401641e0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push r14
push r15
sub rsp, 0x20
mov r8d, edx
mov esi, edx
mov r15, rcx
sub r8d, 5
je 0x140164233
sub r8d, 0x34
je 0x140164224
nop
cmp r8d, 0x5b
je 0x140164215
mov eax, 0xc0000003
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov eax, dword [0x1402c5e00]
lea r14, [0x1402c5e00]
jmp 0x140164240
mov eax, dword [0x1402c5dfc]
lea r14, [0x1402c5dfc]
jmp 0x140164240
mov eax, dword [0x1402c5df8]
lea r14, [0x1402c5df8]
mov rcx, qword [0x1402caaf0]
xor edx, edx
mov r8d, eax
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], r8d
mov qword [rsp + 0x50], rdi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x1401642c5
nop
mov r8d, dword ds:[rsp + 0x48]
lea r9, [rsp + 0x48]
mov rdx, rdi
mov ecx, esi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
cmp eax, 0xc0000023
je 0x140164296
cmp eax, 0xc0000004
jne 0x1401642de
mov rcx, qword [0x1402caaf0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov rcx, qword [0x1402caaf0]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x140164270
mov eax, 0xc0000017
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
lfence
test ebx, ebx
jns 0x1401642fb
mov rcx, qword [0x1402caaf0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
jmp 0x1401642ca
mov eax, dword ds:[rsp + 0x48]
cmp eax, 0x100000
ja 0x14016430a
mov dword [r14], eax
mov qword [r15], rdi
mov eax, ebx
jmp 0x1401642ca
Function at 0x140164640
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebx, dword [0x1402c5d90]
mov r14, rcx
mov rcx, qword [0x1402caaf0]
xor ebp, ebp
mov r8d, ebx
mov dword [rsp + 0x48], ebp
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rdx, rax
mov ecx, 0x40
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x1401646f1
cmp ebp, 0xa
jae 0x1401646f9
mov rcx, qword [0x1402caaf0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ebx, dword [rsp + 0x48]
mov edx, 4
mov rcx, qword [0x1402caaf0]
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r9, ds:[rsp + 0x48]
mov r8d, ebx
mov rdx, rax
mov ecx, 0x40
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
inc ebp
mov esi, eax
cmp eax, 0xc0000004
je 0x140164698
test esi, esi
jns 0x1401647af
mov ebx, dword [0x1402c5d90]
mov edx, 4
mov rcx, qword [0x1402caaf0]
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov ecx, 0x40
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x140164788
mov rcx, qword [0x1402caaf0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add ebx, ebx
cmp ebx, 0x10000000
ja 0x1401647a8
lfence
mov rcx, qword [0x1402caaf0]
mov edx, 4
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov ecx, 0x40
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
je 0x140164734
test esi, esi
jns 0x1401647af
lfence
mov rcx, qword [0x1402caaf0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1401647c3
mov eax, 0xc000009a
jmp 0x1401647c5
lfence
cmp ebx, 0x200000
ja 0x1401647c0
mov dword [0x1402c5d90], ebx
mov qword [r14], rdi
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140164b00
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 0x200
mov rcx, qword [0x1402caaf0]
mov r8d, ebx
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov ecx, 0x12
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x140164ba8
mov rcx, qword [0x1402caaf0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add ebx, ebx
cmp ebx, 0x10000000
ja 0x140164bc8
lfence
mov rcx, qword [0x1402caaf0]
mov edx, 4
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov ecx, 0x12
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
je 0x140164b52
lfence
test esi, esi
jns 0x140164bcf
mov rcx, qword [0x1402caaf0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140164bd2
mov eax, 0xc000009a
jmp 0x140164bd4
mov qword [r14], rdi
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x140164c00
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 0x200
mov rcx, qword [0x1402caaf0]
mov r8d, ebx
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov ecx, 0x90
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x140164ca8
mov rcx, qword [0x1402caaf0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add ebx, ebx
cmp ebx, 0x10000000
ja 0x140164cc8
lfence
mov rcx, qword [0x1402caaf0]
mov edx, 4
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov ecx, 0x90
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
je 0x140164c52
lfence
test esi, esi
jns 0x140164ccf
mov rcx, qword [0x1402caaf0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140164cd2
mov eax, 0xc000009a
jmp 0x140164cd4
mov qword [r14], rdi
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140165c00
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x10], edx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
movzx r13d, r8b
mov ebx, edx
mov r14, rcx
mov r15d, 0x400
mov rcx, qword [0x1402caaf0]
mov r8d, r15d
mov edx, 4
mov r12, r9
mov dil, 1
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
nop dword [rax]
mov byte [rsp + 0x50], dil
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], r12
xor r9d, r9d
mov byte [rsp + 0x40], r13b
xor r8d, r8d
mov dword [rsp + 0x38], ebx
xor edx, edx
mov dword [rsp + 0x30], r15d
mov rcx, r14
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
mov ebx, eax
cmp eax, 0x103
jne 0x140165ca8
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
mov ebx, eax
cmovns ebx, dword [rsp + 0x60]
cmp ebx, 0x80000005
je 0x140165cb8
cmp ebx, 0xc0000004
jne 0x140165cf2
mov rcx, qword [0x1402caaf0]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [0x1402caaf0]
lea eax, [r15 + r15]
mov r8d, eax
mov edx, 4
mov r15d, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, dword [rsp + 0xa8]
jmp 0x140165c4a
cmp ebx, 0x80000006
je 0x140165d6e
test ebx, ebx
js 0x140165d70
lfence
mov r8, qword [rsp + 0xc8]
mov rdx, rsi
mov rax, qword [rsp + 0xc0]
mov rcx, r14
xor ebp, ebp
mov rdi, rsi
call qword [case.0x14013d84a.0]
test al, al
je 0x140165d70
nop word [rax + rax]
mov eax, dword [rdi]
test eax, eax
je 0x140165d5f
mov r8, qword [rsp + 0xc8]
add ebp, eax
mov rax, qword [rsp + 0xc0]
mov rcx, r14
mov edi, ebp
add rdi, rsi
mov rdx, rdi
call qword [case.0x14013d84a.0]
test al, al
jne 0x140165d30
jmp 0x140165d70
mov ebx, dword [rsp + 0xa8]
xor dil, dil
jmp 0x140165c50
xor ebx, ebx
mov rcx, qword [0x1402caaf0]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140165dc0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rbp, r8
mov r14, rdx
mov rdi, rcx
mov edx, 4
mov rcx, qword [0x1402caaf0]
mov r8d, 0x2000
mov bl, 1
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
xor r15d, r15d
mov byte [rsp + 0x50], bl
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], r15
xor r9d, r9d
mov byte [rsp + 0x40], r15b
xor r8d, r8d
mov dword [rsp + 0x38], 0x21
xor edx, edx
mov dword [rsp + 0x30], 0x2000
mov rcx, rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
mov ebx, eax
cmp eax, 0x103
jne 0x140165e5f
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
mov ebx, eax
cmovns ebx, dword [rsp + 0x60]
nop
cmp ebx, 0x80000006
je 0x140165e9a
test ebx, ebx
js 0x140165e9d
lfence
mov r8, qword [rsp + 0x68]
mov r9, rbp
mov rdx, rsi
mov rcx, rdi
mov rax, r14
call qword [case.0x14013d84a.0]
mov ebx, eax
cmp eax, 0x80000006
je 0x140165e9a
test eax, eax
js 0x140165e9d
xor bl, bl
jmp 0x140165e01
mov ebx, r15d
mov rcx, qword [0x1402caaf0]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x140165ee0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rbp, r8
mov r14, rdx
mov rdi, rcx
mov edx, 4
mov rcx, qword [0x1402caaf0]
mov r8d, 0x2400
mov bl, 1
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
xor r15d, r15d
mov byte [rsp + 0x50], bl
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], r15
xor r9d, r9d
mov byte [rsp + 0x40], r15b
xor r8d, r8d
mov dword [rsp + 0x38], 0x1d
xor edx, edx
mov dword [rsp + 0x30], 0x2400
mov rcx, rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
mov ebx, eax
cmp eax, 0x103
jne 0x140165f7f
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
mov ebx, eax
cmovns ebx, dword [rsp + 0x60]
nop
cmp ebx, 0x80000006
je 0x140165fba
test ebx, ebx
js 0x140165fbd
lfence
mov r8, qword [rsp + 0x68]
mov r9, rbp
mov rdx, rsi
mov rcx, rdi
mov rax, r14
call qword [case.0x14013d84a.0]
mov ebx, eax
cmp eax, 0x80000006
je 0x140165fba
test eax, eax
js 0x140165fbd
xor bl, bl
jmp 0x140165f21
mov ebx, r15d
mov rcx, qword [0x1402caaf0]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x140165ff0
Capabilities:
Get file attributes

Disassembly:
mov r8, rdx
mov edx, 0x16
jmp fcn.1401617e0
Function at 0x1401695e0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword ss:[rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov dword [rsp + 0x68], 0x100
mov ebp, edx
mov r14, rcx
mov rcx, qword [0x1402caaf0]
mov edx, 4
mov r8d, 0x100
mov esi, 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
nop dword [rax]
mov r9d, dword [rsp + 0x68]
lea rax, [rsp + 0x68]
mov r8, rdi
mov qword [rsp + 0x20], rax
mov edx, ebp
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtQueryKey]
mov ebx, eax
test eax, eax
jns 0x14016968e
xor edx, edx
mov r8, rdi
cmp eax, 0x80000005
jne 0x1401696ac
mov rcx, qword [0x1402caaf0]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword ds:[rsp + 0x68]
mov edx, 4
mov rcx, qword [0x1402caaf0]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
add esi, 0xffffffff
jne 0x140169630
mov qword [r15], rdi
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
lfence
mov rcx, qword [0x1402caaf0]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140169691

Function at 0x1401696c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword ss:[rsp + 0x20], rbp
push rsi
push r14
push r15
sub rsp, 0x40
mov r15, r9
mov ebp, r8d
mov r14, rcx
mov esi, 0x10
test rdx, rdx
je 0x140169722
mov r10, qword [rdx]
test r10, r10
je 0x140169722
mov word [rsp + 0x30], r10w
lea eax, [r10 + 2]
mov word [rsp + 0x32], ax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x38], rax
cmp r10, 0xfffe
jbe 0x14016972a
mov eax, 0xc0000106
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rsi
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov rcx, qword [0x1402caaf0]
mov edx, 4
mov qword [rsp + 0x60], rbx
mov r8d, 0x100
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x68], 0x100
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
nop word [rax + rax]
mov ecx, dword [rsp + 0x68]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], ecx
mov r9, rdi
mov rcx, r14
mov r8d, ebp
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, eax
test eax, eax
jns 0x1401697c5
xor edx, edx
mov r8, rdi
cmp eax, 0x80000005
jne 0x1401697e3
mov rcx, qword [0x1402caaf0]
nop
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x68]
mov edx, 4
mov rcx, qword [0x1402caaf0]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
add esi, 0xffffffff
jne 0x140169760
mov qword [r15], rdi
mov rdi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rsi
ret
lfence
mov rcx, qword [0x1402caaf0]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1401697c8