joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d7f40
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d9020
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d8942
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fb108]
test eax, eax
je 0x2fc4d89da
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fb110]
mov qword [rbp - 8], rax
jmp 0x2fc4d89be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d89b2
cmp qword [rbp - 0x10], 0
je 0x2fc4d89b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d8978
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d89db
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d8ae0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d8b08
mov eax, 0
jmp 0x2fc4d8b56
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d8b31
mov eax, 0
jmp 0x2fc4d8b56
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d8b51
mov eax, 0
jmp 0x2fc4d8b56
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d8b5c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d8bda
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d8bd1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d8bd1
mov rax, qword [rbp - 8]
jmp 0x2fc4d8bef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d8ba4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140003260
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea rcx, [0x14000ff70]
add rsp, 0x28
jmp qword [sym.imp.Public.dll_public_virtual:_void___cdecl_WCommandLineArgs::Initialize_wchar_t_const____ptr64____ptr64]

Function at 0x1400065b4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400065fe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400065fe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400065fe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400065fe
cmp dword [rcx + 0x84], 0xe
jbe 0x1400065fe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006600
xor al, al
add rsp, 0x28
ret
Function at 0x140004d40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400c50b0]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x140004d79
xor eax, eax
jmp 0x140004e9b
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x140004db3
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x140004db3
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x140004e9b
cmp qword [rbx + 0x80], 0
je 0x140004e99
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140004dee
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140004e11
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call fcn.14006f618
cmp eax, edi
cmovne edi, esi
jmp 0x140004e99
lea r8, [rbp - 0x38]
mov byte [rbp - 0x40], sil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp - 0x3f]
lea r8, [rbp - 8]
mov qword [rsp + 0x30], r8
lea r8, [rbp - 0x28]
mov qword [rsp + 0x28], r8
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x40]
call qword [rax + 0x38]
test eax, eax
je 0x140004e5f
sub eax, 1
je 0x140004e5f
cmp eax, 2
jne 0x140004e99
movsx ecx, byte [rbp - 0x40]
jmp 0x140004dfb
mov r14, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x140004e89
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call fcn.140076a60
cmp r14, rax
jne 0x140004e99
lea rax, [rbp - 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x30], rax
mov eax, esi
jne 0x140004e9b
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140068fb0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140006f54
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400c50b0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140006fc3
cmp byte [rcx + 0x71], 0
je 0x140006fc3
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140007017
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x140006fdd
sub eax, 1
je 0x140006fe1
cmp eax, 2
jne 0x140007017
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140068fb0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14000700e
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.140076a60
cmp rdi, rax
jne 0x140007017
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140006fc5
xor al, al
jmp 0x140006fc5

Function at 0x1400120d8
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xor esi, esi
lea rbx, [rcx + 0x20]
mov qword [rcx + 8], rsi
lea rax, vtable.Window.0
mov qword [rcx], rax
mov rdi, rcx
mov dword [rcx + 0x10], esi
mov qword [rcx + 0x18], rsi
lea ecx, [rsi + 0x38]
mov qword [rsp + 0x38], rbx
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
call fcn.140068fd8
lea r9, [rsp + 0x38]
mov dword [rsp + 0x38], esi
lea edx, [rsi + 0x1f]
lea r8d, [rsi + 0x40]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rbx, [rdi + 0x30]
lea rcx, [rbx + 0x10]
mov qword [rbx + 8], rdi
lea rax, [0x140012388]
mov qword [rcx + 2], rsi
mov qword [rbx], rax
mov eax, 0xb848
mov word [rcx], ax
mov eax, 0xe0ff
mov word [rcx + 0x1d], ax
mov dword [rcx + 0xa], 0x4894865
mov word [rcx + 0xe], 0x2825
mov byte [rcx + 0x10], sil
mov dword [rcx + 0x11], 0xb8480000
mov qword [rcx + 0x15], rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rsi, qword [rsp + 0x40]
lea rax, [0x140015658]
mov qword [rbx + 0x25], rax
mov rax, rdi
mov qword [rbx + 0x12], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140012210
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x440
mov rax, qword [0x1400c50b0]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rdi, rdx
mov qword [rsp + 0x20], rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x400
call fcn.14006ba60
mov rcx, qword [rbx + 8]
lea rdx, [rsp + 0x30]
mov r8d, 0x200
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
mov qword [rdi + 0x18], 7
mov qword [rdi], rax
lea rdx, [rsp + 0x30]
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov word [rdi], ax
call fcn.1400066f4
mov rax, rdi
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.140068fb0
mov rbx, qword [rsp + 0x460]
add rsp, 0x440
pop rdi
ret
Function at 0x140012548
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
xor esi, esi
mov qword [rbp - 0x28], rcx
lea rax, [0x140012764]
mov qword [rbp - 0x1e], rsi
mov qword [rbp - 0x30], rax
lea r9, [rbp + 0x10]
mov eax, 0xb848
mov dword [rbp - 0x16], 0x4894865
mov word [rbp - 0x20], ax
lea r8d, [rsi + 0x40]
mov eax, 0xe0ff
mov word [rbp - 0x12], 0x2825
mov rdi, rdx
mov word [rbp - 3], ax
mov rbx, rcx
mov byte [rbp - 0x10], sil
lea edx, [rsi + 0x1f]
mov dword [rbp - 0xf], 0xb8480000
lea rcx, [rbp - 0x20]
mov qword [rbp - 0xb], rsi
mov dword [rbp + 0x10], esi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx edx, word [rbx + 0x80]
lea rax, [rbp - 0x30]
mov qword [rbp - 0x1e], rax
lea r9, [rbp - 0x20]
lea rax, [0x140015658]
mov qword [rsp + 0x20], rsi
mov r8, rdi
mov qword [rbp - 0xb], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_DialogBoxParamW]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140012604
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
xorps xmm0, xmm0
mov rbx, rdx
mov rdi, rcx
movzx edx, r8w
xor ecx, ecx
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x37], xmm0
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
xor r14d, r14d
mov byte [rdi + 0x84], 1
mov rsi, rax
mov qword [rbp - 0x11], rdi
lea rax, [0x140012764]
mov qword [rbp - 7], r14
mov qword [rbp - 0x19], rax
lea r9, [rbp + 0x77]
mov eax, 0xb848
mov dword [rbp + 1], 0x4894865
mov word [rbp - 9], ax
lea edx, [r14 + 0x1f]
mov eax, 0xe0ff
mov word [rbp + 5], 0x2825
lea r8d, [r14 + 0x40]
mov word [rbp + 0x14], ax
lea rcx, [rbp - 9]
mov byte [rbp + 7], r14b
mov dword [rbp + 8], 0xb8480000
mov qword [rbp + 0xc], r14
mov dword [rbp + 0x77], r14d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx edx, word [rdi + 0x80]
lea rax, [rbp - 0x19]
mov qword [rbp - 7], rax
lea r9, [rbp - 9]
lea rax, [0x140015658]
mov qword [rsp + 0x20], r14
mov r8, rbx
mov qword [rbp + 0xc], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov rcx, rax
mov qword [rdi + 8], rax
lea edx, [r14 + 5]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x140012739
xor r9d, r9d
lea rcx, [rbp + 0x17]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x140012747
mov rcx, qword [rdi + 8]
lea r8, [rbp + 0x17]
mov rdx, rsi
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x140012739
mov rcx, qword [rdi + 8]
lea rdx, [rbp + 0x17]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x140012739
lea rcx, [rbp + 0x17]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x17]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400126e8
lea r11, [rsp + 0x90]
mov eax, 1
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140013330
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x1400c50b0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rbx, str.BlackBoneDrv7.sys
mov eax, dword [0x1400c933c]
xor r14d, r14d
test eax, eax
je 0x1400133b8
cmp eax, 9
ja 0x1400133aa
cmp eax, 6
ja 0x14001339c
jb 0x1400133b8
mov rax, qword [0x1400c9340]
cmp eax, 3
jae 0x14001339c
cmp eax, 1
jbe 0x1400133b8
lea rbx, str.BlackBoneDrv8.sys
mov edx, 0x93
jmp 0x1400133bd
lea rbx, str.BlackBoneDrv81.sys
mov edx, 0x95
jmp 0x1400133bd
lea rbx, str.BlackBoneDrv10.sys
mov edx, 0x96
jmp 0x1400133bd
mov edx, 0x8e
lea r8, str.Driver
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1400134f9
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
lea rcx, [rbp + 0x2f]
call fcn.140024a70
nop
mov r8d, 1
lea rdx, [0x1400b2728]
mov rcx, rax
call fcn.140009240
mov qword [rbp + 0xf], r14
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1f], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1f], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], r14w
jne 0x14001343d
mov rdx, rbx
lea rcx, [rbp + 0xf]
call fcn.140009240
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x11], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 1], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rcx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rcx, qword [rbp - 0x11]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x120116
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
lea rcx, [rbp - 0x11]
call fcn.140006690
nop
lea rcx, [rbp + 0xf]
call fcn.140006690
nop
lea rcx, [rbp + 0x2f]
call fcn.140006690
cmp rbx, 0xffffffffffffffff
je 0x1400134f9
mov dword [rbp - 0x19], r14d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x19]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140068fb0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140013524
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1400c50b0]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rbx, str.BlackBoneDrv7.sys
mov eax, dword [0x1400c933c]
xor edi, edi
test eax, eax
je 0x140013597
cmp eax, 9
ja 0x140013590
cmp eax, 6
ja 0x140013587
jb 0x140013597
mov rcx, qword [0x1400c9340]
cmp ecx, 3
jae 0x140013587
lea rax, str.BlackBoneDrv8.sys
cmp ecx, 2
cmovb rax, rbx
mov rbx, rax
jmp 0x140013597
lea rbx, str.BlackBoneDrv81.sys
jmp 0x140013597
lea rbx, str.BlackBoneDrv10.sys
lea rcx, [rbp + 0x27]
call fcn.140024a70
nop
mov r8d, 1
lea rdx, [0x1400b2728]
mov rcx, rax
call fcn.140009240
mov qword [rbp + 7], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x17], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 7], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x17], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], di
jne 0x1400135e4
mov rdx, rbx
lea rcx, [rbp + 7]
call fcn.140009240
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 9], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x19]
call fcn.140006690
nop
lea rcx, [rbp + 7]
call fcn.140006690
nop
lea rcx, [rbp + 0x27]
call fcn.140006690
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140068fb0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14001650c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov edx, 0x8b
call fcn.140012444
nop
lea rax, vtable.DlgWait.0
mov qword [rsi], rax
mov qword [rsi + 0x88], rbx
mov qword [rsi + 0x90], rdi
mov ecx, 0x10
call fcn.140068fd8
mov qword [rax], rsi
lea rcx, [0x1400167b0]
mov qword [rax + 8], rcx
mov qword [rsp + 0x48], rax
lea rbx, [rsi + 0xa0]
mov qword [rsp + 0x28], rbx
xor edi, edi
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140016838]
xor edx, edx
xor ecx, ecx
call fcn.14007944c
mov qword [rsi + 0x98], rax
test rax, rax
je 0x1400165d5
mov dword [rsi + 0xa8], edi
lea rcx, [rsi + 0x70]
mov eax, 0x3fa
mov word [rsp + 0x48], ax
lea rdx, [rsp + 0x48]
call fcn.140015174
lea rcx, [0x1400164c4]
mov qword [rax], rcx
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], edi
mov ecx, 6
call fcn.1400681bc
int3

Function at 0x1400168b8
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
and qword [0x1400c9590], 0
lea rdx, [0x1400a8d84]
and dword [0x1400c959c], 0
lea rcx, [0x1400c95c0]
and dword [0x1400c95a0], 0
lea rdi, [0x1400c9590]
and qword [0x1400c95a8], 0
xorps xmm0, xmm0
and qword [0x1400c95c0], 0
and qword [0x1400c95d0], 0
movdqa xmmword [0x1400c95b0], xmm0
mov byte [0x1400c9598], 1
mov qword [0x1400c95d8], 7
call fcn.1400066f4
and qword [0x1400c95e0], 0
lea r8, [0x140016a5c]
xor ecx, ecx
mov r9, rdi
and qword [rsp + 0x28], rcx
xor edx, edx
and dword [rsp + 0x20], ecx
mov qword [0x1400c95b0], rcx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400c95a8], rax
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x140016a94
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1400c50b0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.140006838
nop
lea rcx, [rsp + 0x40]
call fcn.140006838
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140016c04
mov eax, dword [rbx + 0xc]
test al, 2
je 0x140016af5
mov r8d, 0x47
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140016b40
mov eax, dword [rbx + 0xc]
test al, 1
je 0x140016b09
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140016b40
mov rdi, qword [rbx + 0x50]
test rdi, rdi
je 0x140016b2c
lea rcx, [rsp + 0x20]
call fcn.140004218
mov r9b, 1
mov r8, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x28]
mov rcx, rax
call rdi
and qword [rbx + 0x18], 0
mov ecx, 0x1337
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140016b40
Capabilities:
Create process memory minidump

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
cmp qword [rdx + 0x18], 8
mov esi, r8d
mov rax, rdx
mov rbx, rcx
jb 0x140016b62
mov rax, qword [rdx]
and qword [rsp + 0x30], 0
xor r9d, r9d
and dword [rsp + 0x28], 0
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [rbx + 0x10]
mov rdi, rax
mov dword [rsp + 0x40], ecx
mov rcx, qword [rbx + 0x20]
mov qword [rsp + 0x44], rcx
mov dword [rsp + 0x4c], 1
cmp rax, 0xffffffffffffffff
je 0x140016bf1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
and qword [rsp + 0x28], 0
mov r9d, esi
mov qword [rsp + 0x20], rcx
mov r8, rdi
mov rcx, rax
mov edx, ebx
call qword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400191dc
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
xor eax, eax
mov rbx, rdx
mov edx, dword [rdx + 0xa4]
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
mov rdi, rcx
movups xmmword [rsp + 0x50], xmm0
test edx, edx
jne 0x140019221
cmp dword [rbx + 0xc0], eax
jne 0x140019221
mov eax, dword [rbx + 0x98]
mov dword [rbx + 0xc0], eax
lea r10, [rbx + 0x78]
cmp qword [r10 + 0x18], 8
jb 0x14001922f
mov r10, qword [r10]
lea r9, [rbx + 0x58]
cmp qword [r9 + 0x18], 8
jb 0x14001923d
mov r9, qword [r9]
movzx eax, byte [rbx + 0xb4]
movzx ecx, byte [rbx + 0xb5]
movzx r8d, byte [rbx + 0xb6]
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x40], r9
mov r9d, dword [rbx + 0xc0]
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 0x9c]
mov dword [rsp + 0x30], ecx
lea rcx, str.Injection_initiated._Mode:__d__process_type:__d__pid:__d__mmap_flags:_0x_X__erasePE:__d__unlink:__d__thread_hijack:__d__init_routine:__s__init_arg:__ls
mov dword [rsp + 0x28], r8d
mov r8d, dword [rbx + 0xa0]
mov dword [rsp + 0x20], eax
call fcn.1400175f8
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
call fcn.140017c20
mov esi, eax
test eax, eax
jne 0x140019385
mov ecx, dword [rbx + 0xa8]
test ecx, ecx
je 0x1400192b8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbp, qword [rbx + 0xd0]
mov r14, qword [rbx + 0xc8]
jmp 0x1400192ec
mov r8, qword [r14]
mov rdx, rbx
mov rcx, rdi
call fcn.14001939c
mov ecx, dword [rbx + 0xac]
or esi, eax
test ecx, ecx
je 0x1400192e8
call qword [sym.imp.KERNEL32.dll_Sleep]
add r14, 0x10
cmp r14, rbp
jne 0x1400192c8
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140019310
test esi, esi
jne 0x14001930a
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140019320
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x140019374
test byte [rbx + 0x9c], 0x10
je 0x140019374
mov eax, dword [rbx + 0xa4]
cmp eax, 1
je 0x14001933d
cmp eax, 4
jne 0x140019374
mov rdx, qword [rdi + 0x3a8]
lea rcx, [rdi + 0x3a0]
mov eax, dword [rdi + 0x10]
mov dword [rsp + 0x98], eax
cmp rdx, qword [rdi + 0x3b0]
je 0x140019367
mov dword [rdx], eax
add qword [rcx + 8], 4
jmp 0x140019374
lea r8, [rsp + 0x98]
call fcn.14001ae7c
lea rcx, [rdi + 8]
cmp qword [rcx], 0
je 0x140019383
call fcn.140030950
mov eax, esi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret