joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14030
Capabilities:
Find process by pid
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x50], 0
mov rax, qword [rsp + 0x80]
cmp qword [rax], 0
je 0x140bf
mov rdx, qword [rsp + 0x80]
mov rdx, qword [rdx]
lea rcx, [0x00017390]
call sub.ntoskrnl.exe_DbgPrint
mov r11, qword [rsp + 0x80]
mov edx, dword [r11 + 0x14]
lea rcx, [0x00017480]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx]
call sub.ntoskrnl.exe_PsLookupProcessByProcessId
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
jge 0x140bf
mov eax, dword [rsp + 0x58]
jmp 0x141f3
mov rcx, qword [rsp + 0x48]
call fcn.00011f80
movzx eax, al
test eax, eax
je 0x141cf
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9d, 0x10000000
xor r8d, r8d
mov edx, 0x200
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
jl 0x141cf
call fcn.000115f0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.000120e0
mov byte [rsp + 0x68], al
lea r8, [rsp + 0x50]
mov edx, 0x20
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_NtOpenProcessToken]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
jl 0x1419a
mov r8, qword [rsp + 0x80]
add r8, 8
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x10
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_NtAdjustPrivilegesToken]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
jl 0x1419a
lea rcx, [0x00017490]
call sub.ntoskrnl.exe_DbgPrint
cmp qword [rsp + 0x50], 0
je 0x141ad
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_NtClose]
cmp qword [rsp + 0x40], 0
je 0x141c0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_NtClose]
movzx edx, byte [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.00012120
cmp dword [rsp + 0x58], 0
jl 0x141ef
mov rax, qword [rsp + 0x88]
mov dword [rax], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [rsp + 0x58]
add rsp, 0x78
ret
Function at 0x14200
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x30], 0xc0000001
mov dword [rsp + 0x28], 0xc0000001
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0x68]
sub rax, 0x470
xor edx, edx
mov ecx, 0x468
div rcx
mov qword [rsp + 0x38], rax
call fcn.000148c0
lea rcx, [0x000174c0]
call fcn.00016040
mov qword [0x000191f8], rax
cmp qword [rsp + 0x50], 0
je 0x1427b
cmp qword [rsp + 0x60], 0
jne 0x14282
mov eax, 0xc000000d
jmp 0x142fc
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0
je 0x142b9
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x20]
call sub.ntoskrnl.exe_PsLookupProcessByProcessId
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jl 0x142b2
cmp qword [rsp + 0x20], 0
jne 0x142b9
mov eax, 0xc0000001
jmp 0x142fc
mov rcx, qword [rsp + 0x20]
call fcn.00011f80
movzx eax, al
test eax, eax
je 0x142e6
mov ecx, dword [rsp + 0x2c]
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x20]
call fcn.00014310
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x28], 0
jl 0x142f8
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x14310
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov dword [rsp + 0x30], 0xc0000001
mov qword [rsp + 0x20], 0x10000
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x34], 0
call fcn.000115f0
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.000120e0
mov byte [rsp + 0x34], al
mov rdx, qword [rsp + 0x20]
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14479
mov rdi, qword [rsp + 0x38]
xor eax, eax
mov rcx, qword [rsp + 0x20]
rep stosb byte [rdi], al
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov ecx, 0x10
call sub.ntoskrnl.exe_NtQuerySystemInformation
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x1445f
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x40], 0
jmp 0x143de
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
cmp dword [rsp + 0x40], eax
jae 0x1445f
mov ecx, dword [rsp + 0x40]
imul rcx, rcx, 0x18
mov rax, qword [rsp + 0x48]
movzx eax, word [rax + rcx + 8]
cmp qword [rsp + 0x60], rax
jne 0x1445a
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
cmp qword [rsp + 0x78], rax
jbe 0x14446
mov edi, dword [rsp + 0x40]
imul rdi, rdi, 0x18
mov ecx, dword [rsp + 0x40]
imul rcx, rcx, 0x18
mov rax, qword [rsp + 0x48]
movzx edx, word [rax + rcx + 0xe]
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x48]
mov r8, qword [r8 + rdi + 0x10]
mov rcx, qword [rsp + 0x68]
call fcn.000144d0
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
add rcx, 1
mov rax, qword [rsp + 0x70]
mov qword [rax], rcx
jmp 0x143d3
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [rsp + 0x20]
shl rax, 1
mov qword [rsp + 0x20], rax
cmp dword [rsp + 0x30], 0xc0000004
je 0x14360
movzx edx, byte [rsp + 0x34]
mov rcx, qword [rsp + 0x28]
call fcn.00012120
cmp dword [rsp + 0x30], 0
jl 0x144be
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
cmp qword [rsp + 0x78], rax
jb 0x144b6
mov dword [rsp + 0x30], 0
jmp 0x144be
mov dword [rsp + 0x30], 0xc0000023
mov eax, dword [rsp + 0x30]
add rsp, 0x50
pop rdi
ret
Function at 0x144d0
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
cmp qword [rsp + 0x90], 0
je 0x14659
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x14659
mov edx, 0x468
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x14659
mov rdi, qword [rsp + 0x58]
xor eax, eax
mov ecx, 0x468
rep stosb byte [rdi], al
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov byte [rsp + 0x50], 1
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x88]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x90]
mov qword [rcx + 8], rax
mov rcx, qword [rsp + 0x90]
sub rcx, 0x18
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x145be
mov rcx, qword [0x00019170]
mov rax, qword [rsp + 0x90]
sub rax, rcx
mov rcx, qword [rsp + 0x58]
mov rax, qword [rax]
mov qword [rcx + 0x10], rax
jmp 0x145cb
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x10], 0
mov rdx, qword [rsp + 0x58]
add rdx, 0x7c
mov rcx, qword [rsp + 0x88]
call fcn.00014670
mov r8, qword [rsp + 0x58]
add r8, 0x18
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
call fcn.00014790
movzx edx, byte [rsp + 0x50]
test edx, edx
je 0x14618
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov byte [rsp + 0x50], 0
mov rcx, qword [rsp + 0x98]
mov rcx, qword [rcx]
imul rcx, rcx, 0x468
mov rax, qword [rsp + 0x98]
lea rdi, [rax + rcx + 8]
mov rsi, qword [rsp + 0x58]
mov ecx, 0x468
rep movsb byte [rdi], byte [rsi]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rsp + 0x58], 0
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x14b60
Capabilities:
Find process by pid
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x48
mov dword [rsp + 0x28], 0xc0000001
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x70]
sub rax, 0x220
xor edx, edx
mov ecx, 0x218
div rcx
mov dword [rsp + 0x2c], eax
call fcn.00014fe0
cmp dword [rsp + 0x60], 0
je 0x14bcc
mov ecx, dword [rsp + 0x60]
lea rdx, [rsp + 0x20]
call sub.ntoskrnl.exe_PsLookupProcessByProcessId
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jge 0x14bcc
mov eax, dword [rsp + 0x28]
jmp 0x14c8d
lea rcx, [0x000173a0]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x20]
call fcn.00011f80
movzx eax, al
test eax, eax
je 0x14c77
mov rdx, qword [rsp + 0x70]
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14c77
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov rcx, qword [rsp + 0x70]
rep stosb byte [rdi], al
mov r8d, dword [rsp + 0x2c]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call fcn.00013720
mov dword [rsp + 0x28], eax
mov ecx, dword [rsp + 0x2c]
mov rax, qword [rsp + 0x30]
cmp rcx, qword [rax]
jb 0x14c59
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x28], 0
jmp 0x14c61
mov dword [rsp + 0x28], 0xc0000023
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rsp + 0x30], 0
cmp dword [rsp + 0x28], 0
jl 0x14c89
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [rsp + 0x28]
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x14ca0
Capabilities:
Find process by pid
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov dword [rsp + 0x28], 0xc0000001
mov qword [rsp + 0x20], 0
call fcn.00014fe0
lea r11, [sub.ntoskrnl.exe_PsLookupProcessByProcessId]
test r11, r11
je 0x14cde
cmp qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject], 0
jne 0x14ce8
mov eax, 0xc0000001
jmp 0x14da8
cmp dword [rsp + 0x50], 0
je 0x14d11
mov ecx, dword [rsp + 0x50]
lea rdx, [rsp + 0x20]
call sub.ntoskrnl.exe_PsLookupProcessByProcessId
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jge 0x14d11
mov eax, dword [rsp + 0x28]
jmp 0x14da8
mov rcx, qword [rsp + 0x20]
call fcn.00011f80
movzx eax, al
test eax, eax
je 0x14d92
mov rax, qword [rsp + 0x60]
sub rax, 0x28
xor edx, edx
mov ecx, 0x20
div rcx
mov qword [rsp + 0x30], rax
lea rcx, [0x00017500]
call sub.ntoskrnl.exe_DbgPrint
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x20]
call fcn.00014dc0
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jl 0x14d92
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
cmp qword [rsp + 0x30], rax
jb 0x14d8a
lea rcx, [0x00017520]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x28], 0
jmp 0x14d92
mov dword [rsp + 0x28], 0xc0000023
cmp dword [rsp + 0x28], 0
jl 0x14da4
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [rsp + 0x28]
add rsp, 0x48
ret
Function at 0x15110
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x30], 0xc0000001
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x40], 0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x20], eax
mov edx, dword [rsp + 0x20]
mov r8d, 1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov r11, qword [rsp + 0x60]
mov eax, dword [r11 + 8]
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x40]
mov r8d, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ProbeForWrite]
mov r11, qword [rsp + 0x60]
mov eax, dword [r11 + 0x18]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
shr eax, 2
and eax, 0xfff
mov dword [rsp + 0x44], eax
mov edx, dword [rsp + 0x44]
lea rcx, [0x00017010]
call sub.ntoskrnl.exe_DbgPrint
call fcn.00015fa0
mov r11d, dword [rsp + 0x44]
mov dword [rsp + 0x48], r11d
cmp dword [rsp + 0x48], 0x181
je 0x151ef
jmp 0x15222
lea rcx, [0x00017590]
call fcn.00016040
mov qword [0x00019210], rax
mov rcx, qword [0x00019250]
call fcn.000152e0
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
call fcn.00015240
mov dword [rsp + 0x30], eax
jmp 0x1522a
mov dword [rsp + 0x30], 0xc0000001
mov eax, dword [rsp + 0x30]
add rsp, 0x58
ret
Function at 0x16250
Capabilities:
Access pe header
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
mov rax, qword [0x00019100]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0xa4], 0xc0000001
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xb8], 0
lea rdi, [rsp + 0x58]
lea rsi, [0x000175d0]
mov ecx, 0x3e
rep movsb byte [rdi], byte [rsi]
lea r9, [rsp + 0xb8]
lea r8, [rsp + 0xc0]
mov rdx, 0xffffffffffffffff
lea rcx, [rsp + 0x58]
call fcn.000165e0
mov dword [rsp + 0xa4], eax
cmp dword [rsp + 0xa4], 0
jge 0x162ef
mov eax, 0xc0000001
jmp 0x1647d
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x16447
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x88], 0
je 0x16447
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x88]
mov rax, qword [rsp + 0xc0]
add rax, rcx
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rax + 0x1c]
mov rax, qword [rsp + 0xc0]
add rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rax + 0x20]
mov rax, qword [rsp + 0xc0]
add rax, rcx
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rax + 0x24]
mov rax, qword [rsp + 0xc0]
add rax, rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], 0
jmp 0x163a7
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0xb0]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x40], eax
jae 0x16447
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0xa8]
mov ecx, dword [rax + rcx*4]
mov rax, qword [rsp + 0xc0]
add rax, rcx
mov qword [rsp + 0x98], rax
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe__stricmp]
test eax, eax
jne 0x16442
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + rcx*2]
mov dword [rsp + 0xa0], eax
mov ecx, dword [rsp + 0xa0]
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + rcx*4]
mov rax, qword [rsp + 0xc0]
add rax, rcx
mov qword [rsp + 0x20], rax
mov rcx, qword [0x00019220]
mov rax, qword [rsp + 0x20]
add rax, rcx
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
jmp 0x16447
jmp 0x1639c
jmp 0x16449
cmp dword [rsp + 0x30], 0xffffffff
jne 0x16464
mov rdx, qword [rsp + 0xf0]
lea rcx, [0x00017610]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [rsp + 0xc0]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.00016cc0
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x165e0
Capabilities:
Map section object
Print debug messages

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov dword [rsp + 0x80], 0xc000000d
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x98], 0
cmp qword [rsp + 0x100], 0
je 0x1663a
cmp qword [rsp + 0x110], 0
jne 0x16646
mov eax, dword [rsp + 0x80]
jmp 0x1689d
mov rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0xa0], 0x30
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xb8], 0x240
lea rax, [rsp + 0xd0]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov dword [rsp + 0x68], 0x100
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
lea r8, [rsp + 0xa0]
mov edx, 0x80100000
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0
jge 0x16749
mov edx, dword [rsp + 0x80]
lea rcx, [0x00017630]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x80]
jmp 0x1689d
mov qword [rsp + 0xb0], 0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x20], 8
xor r9d, r9d
lea r8, [rsp + 0xa0]
mov edx, 5
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwCreateSection]
mov dword [rsp + 0x80], eax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [rsp + 0x80], 0
jge 0x167c5
mov edx, dword [rsp + 0x80]
lea rcx, [0x00017660]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x80]
jmp 0x1689d
cmp qword [rsp + 0x108], 0
jne 0x167dc
mov qword [rsp + 0x108], 0xffffffffffffffff
cmp qword [rsp + 0x118], 0
je 0x167f9
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0xe0], rax
jmp 0x16809
lea rax, [rsp + 0x98]
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov dword [rsp + 0x80], eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [rsp + 0x80], 0
jge 0x16896
mov edx, dword [rsp + 0x80]
lea rcx, [0x00017690]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x80]
jmp 0x1689d
mov eax, dword [rsp + 0x80]
add rsp, 0xf8
ret

Function at 0x1b064
Capabilities:
Create device object

Disassembly:
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.0001b008
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp fcn.00011080
Function at 0x140017a40
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x140017ab4
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rcx, rsi
call fcn.140017ad0
lea rax, [rdi + 1]
cmp rax, 2
jb case.default.0x140017aad
mov qword [rsi], rdi
call fcn.140017670
mov rbx, rax
mov r15, qword [rsp + 0x58]
call sym.firefox.exe_GetHandleVerifier
mov rbp, qword [rax]
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, r15
call qword [rbp + 8]
mov ecx, r14d
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov edi, 0xf0fd3f7c
jnp 0x1400a13a9
jg 0x1400a140c
sub al, 0x8b
test al, 0x83
movabs r15, 0x3e8cddfcff7a66cb
pop rax
xchg edi, eax
add al, 0x7f
jp 0x1400a13a6
invalid
cld
fisttp qword [rsi + rdi + 0x7f049758]
invalid
int 0xcd
xchg byte [rax + 0x2e], al
movsb byte [rdi], byte [rsi]
lodsd eax, dword [rsi]
movabs byte [0x30e3fe08108e627f], al
invalid
jrcxz 0x1400a13ef
cmp ah, byte [rax]
sbb cl, byte [rax]
cmp byte [rbx - 0x74], al
mov r9d, fs
invalid
mov r9d, fs
ffreep st(1)
ffreep st(1)
invalid
jnp 0x1400a1393

Function at 0x140017b40
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x140
mov rax, qword [0x140054018]
xor rax, rsp
mov qword [rsp + 0x138], rax
test rdx, rdx
je 0x140017bd0
mov rsi, rdx
mov rdi, rcx
mov r13d, 0xffffffff
lea r14, str.z:_task_1579288126_build_src_security_sandbox_chromium_base_rand_util_win.cc
lea r15, str.success
lea r12, [rsp + 0x28]
jmp 0x140017b98
add rdi, rbx
sub rsi, rbx
je 0x140017bd0
cmp rsi, r13
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140017b90
mov rcx, r12
mov rdx, r14
mov r8d, 0x20
mov r9, r15
call fcn.140013500
mov rcx, r12
call fcn.140013600
jmp 0x140017b90
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140045f60
nop
add rsp, 0x140
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180006000
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x180006028
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x18000604e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180006050
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1800060a9
test ecx, ecx
jle 0x180006089
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1800060a9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1800060a9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x1800060d0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1800060f2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x180006108
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180006124
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180006126
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180006162
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1800061fe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18000619d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1800061de
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1800061fe
cmp rbx, rax
ja 0x1800061b0
test rbx, rbx
je 0x1800061fe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret