joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7fff25dabb00
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r15, rdx
xorps xmm0, xmm0
mov rdx, rcx
xorps xmm1, xmm1
lea rcx, [rbp - 0x10]
mov r14d, r8d
xor esi, esi
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x40], xmm1
call qword [sym.imp.ntdll.dll_RtlInitAnsiStringEx]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25dabbe1
mov r8b, 1
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x20]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25dabbe1
mov eax, 0x7ffd
mov edi, 0xc0000023
cmp r14d, eax
cmovbe eax, r14d
add eax, eax
movzx edx, ax
mov word [rbp - 0x3e], dx
cmp edx, eax
jb 0x7fff25dabce4
mov rcx, qword gs:[0x60]
movzx r8d, dx
mov edx, dword [0x7fff25fd0c80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rbp - 0x38], rax
test rax, rax
je 0x7fff25df696c
lea r8, [rbp - 0x40]
xor ecx, ecx
lea rdx, [rbp - 0x20]
call qword [sym.imp.ntdll.dll_RtlQueryEnvironmentVariable_U]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x7fff25dabc3f
cmp eax, edi
je 0x7fff25dabca8
lea rcx, [rbp - 0x20]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
cmp qword [rbp - 0x38], 0
je 0x7fff25dabc17
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x38]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test ebx, ebx
jns 0x7fff25dabc22
mov ecx, ebx
call fcn.7fff25d6b370
lea r11, [rsp + 0x60]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov edi, 0xfffd
lea rcx, [rbp - 0x40]
cmp r14d, edi
cmovbe edi, r14d
call qword [sym.imp.ntdll.dll_RtlxUnicodeStringToAnsiSize]
nop dword [rax + rax]
mov esi, eax
cmp eax, edi
ja 0x7fff25dabbe1
xor r8d, r8d
mov qword [rbp - 0x28], r15
lea rdx, [rbp - 0x40]
mov word [rbp - 0x2e], di
lea rcx, [rbp - 0x30]
call qword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25dabbe1
movzx eax, word [rbp - 0x30]
cmp eax, edi
ja 0x7fff25dabca0
cmp eax, r14d
jae 0x7fff25dabca0
mov byte [rax + r15], 0
movzx eax, word [rbp - 0x30]
movzx esi, ax
jmp 0x7fff25dabbe1
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x38]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
movzx ecx, word [rbp - 0x40]
and qword [rbp - 0x38], rsi
add ecx, 2
movzx eax, cx
mov word [rbp - 0x3e], ax
movzx edx, ax
cmp eax, ecx
jae 0x7fff25dabb8d
mov ebx, edi
jmp 0x7fff25dabbe1
Function at 0x7fff25dabf50
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor r9d, r9d
mov r15, r8
mov rbp, rdx
mov r14, rcx
lea rdx, [rsp + 0x30]
xor ecx, ecx
lea r8d, [r9 + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25df69df
mov rcx, qword gs:[0x60]
movsx rax, byte [rsp + 0x68]
mov edx, dword [0x7fff25fd0c80]
mov rcx, qword [rcx + 0x30]
lea edi, [rax + rax*2]
shl edi, 4
mov r8d, edi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x7fff25df69da
lea r9, [rsp + 0x20]
mov r8d, edi
mov rdx, rax
mov ecx, 8
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25dac090
cmp dword [rsp + 0x20], edi
jne 0x7fff25df69ed
movsx r8, byte [rsp + 0x68]
test r14, r14
je 0x7fff25dac039
xor eax, eax
mov rcx, r8
test r8b, r8b
jle 0x7fff25dac02e
mov rdx, rsi
add rax, qword [rdx]
lea rdx, [rdx + 0x30]
sub rcx, 1
jne 0x7fff25dac021
mov dword [r14], eax
shr rax, 0x20
mov dword [r14 + 4], eax
test rbp, rbp
je 0x7fff25dac063
xor eax, eax
mov rcx, r8
test r8b, r8b
jle 0x7fff25dac059
lea rdx, [rsi + 8]
add rax, qword [rdx]
lea rdx, [rdx + 0x30]
sub rcx, 1
jne 0x7fff25dac04c
mov dword [rbp], eax
shr rax, 0x20
mov dword [rbp + 4], eax
test r15, r15
je 0x7fff25dac08e
xor eax, eax
mov rdx, r8
test r8b, r8b
jle 0x7fff25dac083
lea rcx, [rsi + 0x10]
add rax, qword [rcx]
lea rcx, [rcx + 0x30]
sub rdx, 1
jne 0x7fff25dac076
mov dword [r15], eax
shr rax, 0x20
mov dword [r15 + 4], eax
xor ebx, ebx
mov rcx, qword gs:[0x60]
mov r8, rsi
mov edx, dword [0x7fff25fd0c80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test ebx, ebx
js 0x7fff25df69df
mov eax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.7fff25dce640
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x7fff25dacb2c
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
movaps xmmword [rax - 0x28], xmm6
mov rdi, rdx
movups xmm6, xmmword [rdx]
movzx edx, word [rdx]
mov r10w, 2
mov ebx, r8d
cmp dx, r10w
jb 0x7fff25df6c9c
mov r8, qword [rdi + 8]
xor r14d, r14d
test r8, r8
je 0x7fff25df6c9c
test dl, 1
jne 0x7fff25df6c9c
mov eax, edx
shr rax, 1
cmp word [r8 + rax*2 - 2], r14w
jne 0x7fff25df6c9c
test r9d, r9d
jne 0x7fff25df6c9c
mov rsi, qword [rbp + 0x40]
sub dx, r10w
mov word [rdi], dx
test r10b, cl
jne 0x7fff25df6c5d
test byte [0x7fff25fd28b0], r10b
jne 0x7fff25df6c42
and ebx, 0x300
mov qword [rbp - 0x38], rcx
bts ebx, 0x10
mov dword [rbp - 0x40], 0x30
xor r9d, r9d
mov dword [rbp - 0x28], 0x40
mov qword [rbp - 0x30], rdi
xorps xmm0, xmm0
lea r8, [rbp - 0x40]
mov edx, ebx
lea rcx, [rbp + 0x28]
movdqu xmmword [rbp - 0x20], xmm0
test rsi, rsi
jne 0x7fff25df6c92
mov qword [rsp + 0x20], r14
call fcn.7fff25d72648
mov ebx, eax
call fcn.7fff25dd0fbc
mov rsi, qword [rbp + 0x28]
test al, al
je 0x7fff25dacc1f
mov rcx, rsi
call qword [sym.imp.ext_ms_win_kernel32_registry_l1_1_0.dll_TermsrvDeleteKey]
nop dword [rax + rax]
test ebx, ebx
jns 0x7fff25dacc50
mov ecx, ebx
movdqu xmmword [rdi], xmm6
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtDeleteKey]
nop dword [rax + rax]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
jmp 0x7fff25dacc23

Function at 0x7fff25dacc78
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rbp, rcx
mov esi, 0x208
mov rcx, qword gs:[0x60]
xor edx, edx
lea r8d, [rsi + 2]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor r14d, r14d
mov rdi, rax
test rax, rax
je 0x7fff25df6d10
mov ecx, esi
shr ecx, 1
mov dword [rsp + 0x68], ecx
mov qword [rsp + 0x38], r14
lea r9, [rsp + 0x68]
mov qword [rsp + 0x30], r14
mov r8, rdi
mov qword [rsp + 0x28], r14
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x20], r14
call sym.KERNELBASE.dll_RegEnumValueW
mov ebx, eax
cmp eax, 0xea
je 0x7fff25df6ca6
cmp eax, 0x103
je 0x7fff25dacd22
test eax, eax
jne 0x7fff25dacd25
mov eax, dword [rsp + 0x68]
mov rdx, rdi
mov rcx, rbp
mov word [rdi + rax*2], r14w
call sym.KERNELBASE.dll_RegDeleteValueW
mov ebx, eax
test eax, eax
je 0x7fff25daccc0
jmp 0x7fff25dacd25
mov ebx, r14d
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x7fff25dace30
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, qword gs:[0x30]
mov rbp, qword [rdi + 0x60]
call qword [sym.imp.ntdll.dll_RtlAcquirePebLock]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x78]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.ntdll.dll_RtlFindClearBitsAndSet]
nop dword [rax + rax]
or r14d, 0xffffffff
mov ebx, eax
cmp eax, r14d
je 0x7fff25daceb9
call qword [sym.imp.ntdll.dll_RtlReleasePebLock]
nop dword [rax + rax]
mov eax, ebx
and qword [rdi + rax*8 + 0x1480], 0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rsi, qword [rdi + 0x1780]
test rsi, rsi
je 0x7fff25dacf00
mov rcx, qword [rbp + 0x238]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.ntdll.dll_RtlFindClearBitsAndSet]
nop dword [rax + rax]
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlReleasePebLock]
nop dword [rax + rax]
cmp ebx, r14d
je 0x7fff25df6d3e
and qword [rsi + rbx*8], 0
add ebx, 0x40
jmp 0x7fff25dace9b
call qword [sym.imp.ntdll.dll_RtlReleasePebLock]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8d, 0x2000
mov edx, dword [0x7fff25fd0c80]
or edx, 8
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
test rax, rax
je 0x7fff25df6d3e
mov qword [rdi + 0x1780], rax
call qword [sym.imp.ntdll.dll_RtlAcquirePebLock]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x78]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.ntdll.dll_RtlFindClearBitsAndSet]
nop dword [rax + rax]
jmp 0x7fff25dace7d

Function at 0x7fff25dad420
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r12d, edx
mov esi, 0x530
xor ebx, ebx
mov edx, esi
xor ecx, ecx
call sym.KERNELBASE.dll_LocalAlloc
mov rdi, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x7fff25df6e60
lea r9, [rsp + 0x78]
mov r8d, esi
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov r14d, eax
mov r15d, dword [rdi]
test eax, eax
js 0x7fff25dad542
shr r12d, 3
mov r8, qword [rsp + 0x60]
cmp ebx, r15d
jae 0x7fff25dad4e4
cmp ebx, r12d
je 0x7fff25dad4e4
mov edx, ebx
imul rax, rdx, 0x128
mov rcx, qword [rax + rdi + 0x18]
mov qword [r8 + rdx*8], rcx
jmp 0x7fff25dad4e0
inc ebx
jmp 0x7fff25dad496
mov eax, r15d
shl eax, 3
mov dword [r13], eax
jmp 0x7fff25dad51c
mov rcx, rdi
call sym.KERNELBASE.dll_LocalFree
mov eax, 1
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rcx, rdi
call sym.KERNELBASE.dll_LocalFree
mov ecx, 0xc0000004
cmp r14d, ecx
jne 0x7fff25dad56d
imul eax, r15d, 0x128
add eax, 8
cmp eax, esi
jbe 0x7fff25df6e67
mov esi, eax
jmp 0x7fff25dad449
mov ecx, r14d
jmp 0x7fff25df6e67
Function at 0x7fff25dad750
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x30]
mov r9d, 0x18
lea r8, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25df6ee2
mov rax, qword [rsp + 0x48]
mov qword [rbx], rax
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0x60
pop rbx
ret

Function at 0x7fff25dad7c0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
and qword [rbp - 0x38], 0
mov r14d, edx
and dword [rbp - 0x3c], 0
mov rdx, rcx
lea rcx, [rbp - 0x30]
mov rdi, r9
mov rsi, r8
call fcn.7fff25d71d08
test eax, eax
je 0x7fff25df6f25
mov rcx, qword gs:[0x60]
mov r8d, 0x20a
mov edx, dword [0x7fff25fd0c80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x7fff25df6f2c
mov rcx, qword [rbp - 0x28]
mov rax, rdi
neg rax
mov r8, rbx
lea rax, [rbp - 0x38]
mov edx, 0x208
sbb r9, r9
and r9, rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_RtlGetFullPathName_UEx]
nop dword [rax + rax]
test eax, eax
js 0x7fff25df6ef0
mov r8d, dword [rbp - 0x40]
cmp r8d, 0x208
ja 0x7fff25df6f51
mov rdx, rbx
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_RtlUnicodeToMultiByteSize]
nop dword [rax + rax]
test eax, eax
js 0x7fff25df6f48
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x7fff25dad94b
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x7fff25dad8d3
sub rcx, rbx
mov rdx, rbx
sar rcx, 1
lea r8d, [rcx + rcx]
lea rcx, [rbp - 0x3c]
call qword [sym.imp.ntdll.dll_RtlUnicodeToMultiByteSize]
nop dword [rax + rax]
test eax, eax
js 0x7fff25df6f48
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x7fff25dad94b
cmp eax, r14d
jae 0x7fff25dad997
mov rdx, rbx
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rax, qword [0x7fff25fcfd98]
lea rdx, [rbp - 0x10]
mov r8b, 1
lea rcx, [rbp - 0x20]
call qword [case.0x7fff25dc97c1.0]
test eax, eax
js 0x7fff25df6f6c
mov r8d, dword [rbp - 0x40]
mov rcx, rsi
mov rdx, qword [rbp - 0x18]
inc r8d
call sub.ntdll.dll_memcpy
lea rcx, [rbp - 0x20]
call qword [sym.imp.ntdll.dll_RtlFreeAnsiString]
nop dword [rax + rax]
test rdi, rdi
je 0x7fff25dad94b
cmp qword [rbp - 0x38], 0
je 0x7fff25dad99e
mov eax, dword [rbp - 0x3c]
add rax, rsi
mov qword [rdi], rax
lea rcx, [rbp - 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, dword [rbp - 0x40]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
inc eax
mov dword [rbp - 0x40], eax
jmp 0x7fff25dad94b
and qword [rdi], 0
jmp 0x7fff25dad94b
Function at 0x7fff25dae190
Capabilities:
Access peb ldr_data
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
mov rax, qword gs:[0x60]
mov rdx, rcx
mov r8, qword [rax + 0x20]
mov dword [rcx], 0x68
mov rax, qword [r8 + 0xd8]
mov qword [rcx + 8], rax
mov rax, qword [r8 + 0xc8]
mov qword [rcx + 0x10], rax
mov rax, qword [r8 + 0xb8]
mov qword [rcx + 0x18], rax
mov eax, dword [r8 + 0x88]
mov dword [rcx + 0x20], eax
mov eax, dword [r8 + 0x8c]
mov dword [rcx + 0x24], eax
mov eax, dword [r8 + 0x90]
mov dword [rcx + 0x28], eax
mov eax, dword [r8 + 0x94]
mov dword [rcx + 0x2c], eax
mov eax, dword [r8 + 0x98]
mov dword [rcx + 0x30], eax
mov eax, dword [r8 + 0x9c]
mov dword [rcx + 0x34], eax
mov eax, dword [r8 + 0xa0]
mov dword [rcx + 0x38], eax
mov ecx, dword [r8 + 0xa4]
mov dword [rdx + 0x3c], ecx
movzx eax, word [r8 + 0xa8]
mov word [rdx + 0x40], ax
movzx eax, word [r8 + 0xe0]
mov word [rdx + 0x42], ax
mov rax, qword [r8 + 0xe8]
mov qword [rdx + 0x48], rax
test ecx, 0x700
jne 0x7fff25dae244
ret
mov rax, qword [r8 + 0x20]
mov qword [rdx + 0x50], rax
mov rax, qword [r8 + 0x28]
mov qword [rdx + 0x58], rax
mov rax, qword [r8 + 0x30]
mov qword [rdx + 0x60], rax
ret

Function at 0x7fff25db0718
Capabilities:
Map section object

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
mov rbp, rsp
sub rsp, 0x80
and qword [rdx], 0
mov rdi, r8
and qword [r8], 0
mov rsi, rdx
mov rbx, rcx
call qword [sym.imp.ntdll.dll_RtlIsCurrentProcess]
nop dword [rax + rax]
test al, al
je 0x7fff25db0759
add rsp, 0x80
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea r8, [rbp - 0x28]
mov rcx, rbx
lea rdx, [rbp + 0x38]
call qword [sym.imp.ntdll.dll_RtlWow64GetSharedInfoProcess]
nop dword [rax + rax]
test eax, eax
js 0x7fff25db074a
cmp byte [rbp + 0x38], 0
je 0x7fff25db074a
jmp 0x7fff25df7bbc
test byte [rbp - 0x24], 2
je 0x7fff25db074a
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x7fff25db074a
and qword [rbp + 0x40], 0
lea r9, [rbp + 0x40]
and qword [rbp + 0x48], 0
or r15, 0xffffffffffffffff
and qword [rbp - 0x30], 0
mov r8, r15
mov dword [rsp + 0x30], 6
mov rcx, rbx
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
nop dword [rax + rax]
test eax, eax
js 0x7fff25df7c73
mov rcx, qword [rbp + 0x40]
lea rax, [rbp - 0x30]
mov dword [rsp + 0x48], 4
lea r8, [rbp + 0x48]
mov dword [rsp + 0x40], 0x100000
xor r9d, r9d
mov dword [rsp + 0x38], 2
mov rdx, r15
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x4000
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
nop dword [rax + rax]
test eax, eax
js 0x7fff25df7c73
mov rax, qword [rbp + 0x40]
mov qword [rsi], rax
mov rax, qword [rbp + 0x48]
mov qword [rdi], rax
jmp 0x7fff25db074a
mov rdx, qword [rbp + 0x48]
test rdx, rdx
je 0x7fff25df7c8b
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x7fff25db074a
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
nop
jmp 0x7fff25db074a
Function at 0x7fff25db104c
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x30
movzx r9d, word [rdx + 2]
lea rax, [rsp + 0x48]
mov r8, qword [rdx + 8]
mov rbx, rdx
mov edx, 3
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryKey]
nop dword [rax + rax]
test eax, eax
js 0x7fff25db109d
mov rcx, qword [rbx + 8]
mov eax, dword [rcx]
lea rdx, [rcx + 4]
mov r8d, eax
mov dword [rsp + 0x48], eax
call sub.ntdll.dll_memmove
movzx eax, word [rsp + 0x48]
mov word [rbx], ax
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x7fff25db1860
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rdi, qword [rsp + 0xa0]
lea rbp, [0x7fff25db7ec0]
mov eax, dword [r9 + 0x10]
xor ebx, ebx
mov dword [r11 + 0x28], eax
mov rsi, r9
mov eax, dword [r9 + 0x14]
mov r14d, r8d
mov dword [r11 + 0x2c], eax
mov r15, rdx
mov qword [r11 + 0x20], rbx
mov r12, rcx
test rdi, rdi
je 0x7fff25db18d4
lea r9, [r11 + 0x20]
mov r8, rsi
mov rdx, rdi
lea ecx, [rbx + 2]
call fcn.7fff25db1a3c
test eax, eax
js 0x7fff25db193f
mov rbx, qword [rsp + 0x98]
test rbx, rbx
jne 0x7fff25df84ae
and qword [rsp + 0x40], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov r9, rdi
mov dword [rsp + 0x30], r14d
mov r8, rbp
mov qword [rsp + 0x28], r15
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntdll.dll_NtWriteFile]
nop dword [rax + rax]
mov edx, eax
mov edi, eax
mov eax, 0xc0000000
and edx, eax
cmp edx, eax
je 0x7fff25df84bd
mov eax, 1
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, eax
jmp 0x7fff25df84a2
mov rcx, rbx
call fcn.7fff25e1cdf8
mov ecx, edi
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25db1925
lea rbp, [0x7fff25e47390]
mov rdi, rbx
jmp 0x7fff25db18d4
test rbx, rbx
je 0x7fff25df84a0
jmp 0x7fff25df8498
Function at 0x7fff25db1950
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rdi, qword [rsp + 0xa0]
lea rbp, [0x7fff25db7ec0]
mov eax, dword [r9 + 0x10]
xor ebx, ebx
mov dword [r11 + 0x28], eax
mov rsi, r9
mov eax, dword [r9 + 0x14]
mov r14d, r8d
mov dword [r11 + 0x2c], eax
mov r15, rdx
mov qword [r11 + 0x20], rbx
mov r12, rcx
test rdi, rdi
je 0x7fff25db19c4
lea r9, [r11 + 0x20]
mov r8, rsi
mov rdx, rdi
lea ecx, [rbx + 2]
call fcn.7fff25db1a3c
test eax, eax
js 0x7fff25db1a2f
mov rbx, qword [rsp + 0x98]
test rbx, rbx
jne 0x7fff25df84da
and qword [rsp + 0x40], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov r9, rdi
mov dword [rsp + 0x30], r14d
mov r8, rbp
mov qword [rsp + 0x28], r15
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntdll.dll_NtReadFile]
nop dword [rax + rax]
mov edx, eax
mov edi, eax
mov eax, 0xc0000000
and edx, eax
cmp edx, eax
je 0x7fff25df84e9
mov eax, 1
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, eax
jmp 0x7fff25df84ce
mov rcx, rbx
call fcn.7fff25e1cdf8
mov ecx, edi
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25db1a15
lea rbp, [0x7fff25e47390]
mov rdi, rbx
jmp 0x7fff25db19c4
test rbx, rbx
je 0x7fff25df84cc
jmp 0x7fff25df84c4

Function at 0x7fff25db2038
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
movsxd rbx, edx
mov rcx, qword gs:[0x60]
mov rsi, r8
mov r8, rbx
mov edx, 8
add r8, r8
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor r14d, r14d
mov qword [rsi], rax
mov r9, rax
test rax, rax
je 0x7fff25df8a24
lea r15d, [r14 + 2]
cmp ebx, 1
jle 0x7fff25db2117
lea r12, [0x7fff25f36210]
movzx r11d, word [rdi + 2]
mov ebp, ebx
movzx r10d, word [rdi]
mov ecx, r14d
mov r8d, 0x2bd
lea eax, [r8 + rcx]
cdq
idiv r15d
movsxd rdx, eax
lea rbx, [rdx + rdx*2]
cmp r10w, word [r12 + rbx*2 + 2]
je 0x7fff25db2153
jae 0x7fff25db214e
lea r8d, [rax - 1]
cmp ecx, r8d
jle 0x7fff25db20b8
mov edx, r14d
movzx eax, dx
lea r8, [r9 + 2]
neg ax
movzx eax, dx
sbb ebx, ebx
dec ebx
add ebx, ebp
neg ax
sbb rcx, rcx
and rcx, r15
add rcx, r15
add rdi, rcx
test dx, dx
cmovne r10w, dx
mov word [r9], r10w
mov r9, r8
cmp ebx, 1
jg 0x7fff25db20a4
test ebx, ebx
jle 0x7fff25db2125
movzx eax, word [rdi]
mov word [r9], ax
add r9, r15
sub r9, qword [rsi]
sar r9, 1
mov eax, r9d
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
lea ecx, [rax + 1]
jmp 0x7fff25db20d9
cmp r11w, word [r12 + rbx*2 + 4]
jne 0x7fff25db20d3
jmp 0x7fff25df8a36
mov ecx, 0xe
call sub.ntdll.dll_RtlSetLastWin32Error
or eax, 0xffffffff
jmp 0x7fff25db212e
lea rax, [rdx + rdx*2]
movzx edx, word [r12 + rax*2]
jmp 0x7fff25db20e1