joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004f1c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
xor eax, eax
lock xadd dword [rcx + 0x3c], eax
test eax, eax
je 0x14004f1fc
xor eax, eax
jmp 0x14004f3c4
lea r13, [rcx + 0x60]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
mov r15d, edx
mov esi, edx
mov ebp, edx
cmp qword [rdi + 0x20], rdx
jne 0x14004f222
cmp rdi, qword [rbx + 0x10]
jne 0x14004f305
movabs r14, 0x4d54ee85da812030
lea r13, [0x14012c2f8]
cmp rbp, r12
je 0x14004f2e3
mov rbx, qword [rdi]
test rbx, rbx
je 0x14004f2e3
mov dword [rsp + 0x24], edx
mov rcx, qword [0x14012c300]
add rcx, r14
cmp rcx, 1
jbe 0x14004f272
mov rax, qword [0x14012c2f8]
mov edx, 0x3e3
mov rcx, r13
call qword [rax + 0x30]
xor edx, edx
jmp 0x14004f274
mov al, 1
movzx eax, al
add rax, 2
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x3e3
mov qword [rsp + 0x28], r13
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbx + 0x38], xmm0
movsd xmm1, qword [rsp + 0x30]
movsd qword [rbx + 0x48], xmm1
mov rcx, qword [rdi]
test rcx, rcx
je 0x14004f2bd
mov rax, qword [rcx + 0x20]
mov qword [rdi], rax
test rax, rax
jne 0x14004f2b9
mov qword [rdi + 8], rdx
mov qword [rcx + 0x20], rdx
mov qword [rbx + 0x20], rdx
test rsi, rsi
je 0x14004f2d5
mov qword [rsi + 0x20], rbx
inc rbp
mov rsi, rbx
jmp 0x14004f233
mov r15, rbx
inc rbp
mov rsi, rbx
jmp 0x14004f233
cmp qword [rdi], 0
mov r14, qword [rsp + 0x80]
lea r13, [r14 + 0x60]
jne 0x14004f305
mov rdx, rdi
mov rcx, qword [rsp + 0x88]
call fcn.140039570
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, r15
test r15, r15
je 0x14004f3c1
mov rdi, r15
mov r12d, 1
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r15 + 0x20]
mov r15, rcx
mov qword [rdi + 0x20], 0
mov rdi, rcx
xor eax, eax
test rcx, rcx
cmovne rax, rsi
mov rsi, rax
mov dword [rbx + 0x30], r12d
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x14004f372
mov rbx, rdi
test rdi, rdi
jne 0x14004f330
jmp 0x14004f3c1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rbx + 0x20], 0
mov rax, qword [r14 + 0x98]
test rax, rax
je 0x14004f395
mov qword [rax + 0x20], rbx
jmp 0x14004f39c
mov qword [r14 + 0x90], rbx
mov qword [r14 + 0x98], rbx
test r15, r15
je 0x14004f3b3
mov qword [rbx + 0x20], r15
mov qword [r14 + 0x98], rsi
xchg dword [r14 + 0x58], r12d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rax, rbp
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b8e60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x1400b8e85
cvtsi2ss xmm0, rdx
jmp 0x1400b8e9a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x140106a28]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1400b8ec8
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1400b8ec8
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1400b8efa
cmp rbx, 0x200
jae 0x1400b8ef7
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1400b8efa
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400b0440

Function at 0x1400b8f60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14012c040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
mov rcx, qword [0x140130440]
mov rax, qword [rcx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400b8fa8
nop dword [rax]
cmp dword [rax + 0x20], 4
jge 0x1400b8f9c
mov rax, qword [rax + 0x10]
jmp 0x1400b8fa2
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400b8f90
cmp byte [rcx + 0x19], 0
jne 0x1400b9084
cmp dword [rcx + 0x20], 4
jg 0x1400b9084
lea r8, [rcx + 0x28]
mov r10, qword [r8 + 0x10]
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x1400b8fd1
mov rdx, qword [r8]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x1400b9003
movabs r11, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r11
inc rcx
cmp rcx, r10
jb 0x1400b8ff0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400b7720
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400b903e
cmp rcx, qword [rbx + 8]
je 0x1400b903e
cmp qword [rbx + 0x10], 1
jne 0x1400b9042
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400c86b0
add rsp, 0x80
pop rbx
ret
xor al, al
jmp 0x1400b9028
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.1400b90a0
nop
mov r8, rax
lea rdx, str.AcceptEncoding_does_not_accept_any_other_values_if_disabled_is_present._You_set_the_following_encodings:
lea rcx, [rsp + 0x58]
call fcn.14009fd30
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400b8a00
lea rdx, [0x140127730]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, str.invalid_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3
Function at 0x1400c2650
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [rcx + 0x28]
nop
cmp rax, qword [rcx + 0x10]
jb 0x1400c267f
xor al, al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov ecx, select
call fcn.1400c883c
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400c26dc
mov ecx, 8
call fcn.1400c883c
test rax, rax
je 0x1400c26a8
mov qword [rax], rdi
mov qword [rsp + 0x48], rax
lea rsi, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400c11c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400c26fb
jmp 0x1400c26de
xor ebx, ebx
mov rdx, rbx
mov rcx, rdi
call fcn.1400c2490
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov dword [rsi], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x1400c28f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, rcx
xor r15d, r15d
mov eax, dword [rcx + 0x20]
nop
test eax, eax
je 0x1400c2923
lea eax, [r15 - 1]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov eax, 1
xchg dword [rcx + 0x20], eax
cmp rdx, qword [rcx + 8]
cmovb rdx, qword [rcx + 8]
mov rbp, qword [rcx + 0x10]
cmp rdx, rbp
cmovbe rbp, rdx
mov rsi, r15
test rbp, rbp
je 0x1400c29d0
nop dword [rax + rax]
mov rax, qword [rdi + 0x28]
nop
cmp rax, qword [rdi + 0x10]
jae 0x1400c29c8
mov ecx, select
call fcn.1400c883c
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400c29ba
mov ecx, 8
call fcn.1400c883c
test rax, rax
je 0x1400c2986
mov qword [rax], rdi
jmp 0x1400c2989
mov rax, r15
mov qword [rsp + 0x70], rax
lea r14, [rbx + 8]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x1400c11c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400c29e3
jmp 0x1400c29bd
mov rbx, r15
mov rdx, rbx
mov rcx, rdi
call fcn.1400c2490
inc rsi
cmp rsi, rbp
jb 0x1400c2950
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov dword [r14], r15d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x1400c9c18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c9c62
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c9c62
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c9c62
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c9c62
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c9c62
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400c9c64
xor al, al
add rsp, 0x28
ret
Function at 0x1400fa9e0
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x14012c040]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x20]
movsxd rbx, edx
call fcn.140011600
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], rax
cmp rbx, 1
jl 0x1400faa44
imul rdx, rbx, 0xf4240
movabs r8, 0x7fffffffffffffff
mov rcx, r8
sub rcx, rdx
cmp rax, rcx
jge 0x1400faa3f
lea rcx, [rdx + rax]
mov qword [rsp + 0x20], rcx
jmp 0x1400faa44
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x20]
call fcn.140018db0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov r8d, 0x100
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rdx, str.Task_Manager
lea rcx, [rsp + 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400c86b0
add rsp, 0x140
pop rbx
ret
Function at 0x140001d68
Capabilities:
Allocate or change rwx memory
Attach user process memory
Find process by pid

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x60
mov qword [r11 + 0x20], rdx
xor ebx, ebx
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x38], rbx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [r11 - 0x10], rax
mov qword [r11 + 0x10], rbx
lea rdx, [r11 + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140001e00
lea r8, [0x140003b30]
xor edx, edx
lea ebx, [rdx + 0x4d]
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov dword [rsp + 0x20], 0x8d
lea r9, [0x140003be0]
lea r8, [0x140003b50]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x140003bf0]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x140003b90]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
xor eax, eax
jmp 0x140001ed4
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, [rsp + 0x80]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
jns 0x140001eb2
lea r8, [0x140003b30]
xor edx, edx
lea ebx, [rdx + 0x4d]
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov dword [rsp + 0x20], 0x94
lea r9, [0x140003be0]
lea r8, [0x140003b50]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x140003c00]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x140003b90]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x140001df9
xor ecx, ecx
mov rax, qword [rsp + 0x80]
mov qword [rax], rcx
jmp 0x140001ec1
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rax, qword [rsp + 0x80]
add rsp, 0x60
pop rbx
ret

Function at 0x1400020fc
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14000213e
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
lea rax, [0x140003e80]
mov dword [rsp + 0x20], 0x1c001a
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
call qword [sym.imp.ntoskrnl.exe_IoDeleteSymbolicLink]
test eax, eax
jns 0x14000213e
lea rcx, [0x140003ea0]
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x38
ret
Function at 0x14000214c
Capabilities:
Create device object
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [rcx + 0x28]
lea rsi, [fcn.1400020fc]
mov r9d, 0x22
lea r8, [rbp - 0x20]
xor edx, edx
mov rbx, rcx
or dword [rax + 0x68], 0x20
lea rax, [0x140003eb0]
and qword [rbp + 0x10], 0
mov qword [rbp - 0x18], rax
lea rax, [0x140003e80]
mov qword [rbp - 8], rax
lea rax, [rbp + 0x10]
mov qword [r11 - 0x38], rax
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x100
mov qword [rcx + 0x68], rsi
mov dword [rbp - 0x20], 0x240022
mov dword [rbp - 0x10], 0x1c001a
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov edi, eax
test eax, eax
jns 0x140002204
xor edx, edx
lea r8, [0x140003ee0]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea rcx, [0x140003ef0]
call sub.ntoskrnl.exe_DbgPrint
mov rdx, qword [rbx + 0x68]
mov rcx, rbx
cmp rdx, rsi
jne 0x140002200
call fcn.1400020fc
jmp 0x140002261
call rdx
jmp 0x140002261
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov edi, eax
test eax, eax
jns 0x14000222e
lea rcx, [0x140003f00]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
lea rax, [0x1400020b4]
mov qword [rbx + 0x70], rax
lea rcx, [0x140003f20]
lea rax, [0x1400020dc]
mov qword [rbx + 0x80], rax
lea rax, [0x140001edc]
mov qword [rbx + 0xe0], rax
call sub.ntoskrnl.exe_DbgPrint
lea r11, [rsp + 0x60]
mov eax, edi
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140002904
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x50
xorps xmm0, xmm0
mov esi, r8d
xor ebx, ebx
mov rdi, rdx
mov qword [r11 - 0x38], rbx
lea rdx, [r11 + 0x20]
xor eax, eax
mov qword [r11 + 0x20], rbx
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [r11 - 0x10], rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140002961
mov r9d, eax
lea r8, [0x140003f60]
xor edx, edx
lea ecx, [rbx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
xor al, al
jmp 0x1400029e9
mov rcx, qword [rsp + 0x78]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and rdi, 0xfffffffffffff000
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov rdi, rax
test rax, rax
jne 0x14000299d
lea r8, [0x140003f90]
xor edx, edx
lea ecx, [rax + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x1400029d1
call fcn.140002a00
mov rdx, rax
shr rdi, 0xc
mov rcx, rsi
mov bl, 1
shl rcx, 5
lea rax, [rdi + rdi*2]
shl rax, 4
add rdx, rax
mov rax, rcx
xor rax, qword [rdx + 0x10]
and rax, 0xfffffffffffffc1f
xor rax, rcx
mov qword [rdx + 0x10], rax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov al, bl
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140002a94
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov r14, rdx
mov r15, rcx
and qword [r11 + 0x20], 0
and qword [r11 - 0x50], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [r11 - 0x28], rax
and qword [r11 - 0x60], rax
xor edi, edi
mov qword [r11 - 0x68], rdi
lea rdx, [r11 + 0x20]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov esi, eax
test eax, eax
jns 0x140002b40
lea r8, [0x140003b30]
xor edx, edx
lea ecx, [rdi + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov dword [rsp + 0x20], 0x157
lea r9, [0x140004120]
lea r8, [0x140003b50]
xor edx, edx
lea ecx, [rdi + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x140004140]
xor edx, edx
lea ecx, [rdi + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x140003b90]
xor edx, edx
lea ecx, [rdi + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x140002d2d
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, r14
call fcn.140002d4c
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140002b76
mov esi, 0xc0000001
mov dword [rsp + 0xb0], esi
jmp 0x140002bb0
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
mov rdx, rax
mov rcx, r15
call fcn.140002f68
mov esi, eax
mov dword [rsp + 0xb0], eax
test eax, eax
js 0x140002bab
mov rcx, qword [rsp + 0x38]
call fcn.1400033d4
mov esi, eax
mov dword [rsp + 0xb0], eax
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x140002c4e
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002c4e
cmp byte [rdi + 0x31], 0
jne 0x140002c4e
jmp 0x140002bca
xor ecx, ecx
call fcn.1400033d4
test rdi, rdi
je 0x140002cf7
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002cf7
lea rdx, [rsp + 0xb8]
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, 0x103
je 0x140002cf7
mov rax, qword [rdi + 0x18]
mov byte [rax], 0
mov byte [rdi + 0x32], 1
jmp 0x140002cf7
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test r14, r14
je 0x140002d2d
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002d2d
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
mov rsi, qword [rsp + 0xa0]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x140002d4c
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
xor ebx, ebx
mov qword [rbp + 0xf], rcx
mov dword [rsp + 0x50], ebx
lea r9, [rbp - 0x29]
mov qword [rsp + 0x48], rbx
lea r8, [rbp - 1]
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x67]
xorps xmm0, xmm0
mov dword [rsp + 0x38], 1
xor eax, eax
mov dword [rsp + 0x30], 7
mov dword [rbp - 5], eax
mov edx, 0x80000000
lea rax, [rbp + 0x6f]
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x67], rbx
mov qword [rbp - 1], 0x30
mov qword [rbp + 0x17], 0x40
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp + 0x6f], rbx
mov dword [rbp - 0x19], ebx
movups xmmword [rbp - 0x15], xmm0
mov qword [rbp + 0x77], rbx
mov qword [rbp + 7], rbx
movdqu xmmword [rbp + 0x1f], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jns 0x140002e03
mov r8d, eax
lea rcx, [0x140003b70]
mov dl, 1
call fcn.140003448
xor eax, eax
jmp 0x140002f4b
mov rcx, qword [rbp + 0x67]
lea r8, [rbp - 0x19]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea rdx, [rbp - 0x29]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jns 0x140002e44
mov r8d, eax
lea rcx, [0x140003fa0]
mov dl, 1
call fcn.140003448
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x140002dfc
mov r14d, dword [rbp - 0x19]
mov r8d, 0x46494c45
add r14d, 0x1000
mov ecx, 1
and r14d, 0xfffff000
mov edx, r14d
mov r15d, r14d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor edx, edx
mov rsi, rax
test rax, rax
jne 0x140002ed0
lea edi, [rax + 0x4d]
mov ecx, edi
lea r8, [0x140003b30]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r9, [0x140003fc0]
mov dword [rsp + 0x20], 0x84
lea r8, [0x140003b50]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x140003ba0]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x140003b90]
xor edx, edx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x140002e38
xor eax, eax
mov qword [rsp + 0x40], rbx
mov rdi, rsi
mov rcx, r15
rep stosb byte [rdi], al
mov rcx, qword [rbp + 0x67]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov dword [rsp + 0x30], r14d
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
jns 0x140002f2d
mov r8d, eax
lea rcx, [0x140003fe0]
mov dl, 1
call fcn.140003448
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140002f3e
mov rcx, qword [rbp + 0x67]
lea rdx, [rbp - 0x29]
call qword [sym.imp.ntoskrnl.exe_ZwFlushBuffersFile]
mov rbx, rsi
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rax, rbx
mov rbx, qword [rsp + 0x108]
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180551058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1805511df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180551089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18055106f
add dl, dl
jne 0x180551096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805510f6
xor eax, eax
add dl, dl
jne 0x1805510a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805511ad
add dl, dl
jne 0x1805510b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805510c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805510d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805510dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1805510ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18055107e
mov eax, 1
add dl, dl
jne 0x180551106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180551113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805510fb
sub eax, ebx
mov ebx, 1
jne 0x18055114c
mov ecx, 1
add dl, dl
jne 0x18055112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18055113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180551123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18055107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180551168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180551175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18055115d
cmp eax, 0x7d00
jae 0x18055119b
cmp eax, 0x500
jb 0x180551196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18055107e
cmp eax, 0x7f
ja 0x18055119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18055107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1805511d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18055107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x38a09152b
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov rsi, rcx
mov rbx, rdx
test rdx, rdx
je 0x38a09154a
mov rcx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.38a0a1b28

Function at 0x38a091753
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [0x38a0b10f0]
test rax, rax
je 0x38a091765
call rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.out_of_memory_n
mov rcx, rax
call fcn.38a09152b
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop