joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140103f80
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x140192040]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x1401a3928], 0
je 0x140103fc6
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1400b4140
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [0x1401a3930]
test rdi, rdi
je 0x140104067
test byte [0x140194144], 1
je 0x140103fa9
cmp byte [rdi + 0x17], 0
jns 0x140103fe8
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1401a3928], rax
inc rax
cmp rax, 1
ja 0x140103fa9
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400e6840
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x14010412b
xor esi, esi
jmp 0x140103fa9
mov ecx, 0x18
call fcn.1400b2e18
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1400e6840
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x1401667f0]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.1400febb0
movsx rax, byte [rdi + 0x17]
mov rcx, rdi
test rax, rax
jns 0x1401040d1
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
test rax, rax
jne 0x1401040f7
lea rdx, str.debug.log
mov r8d, 9
mov rcx, rdi
call fcn.14007bf60
mov qword [0x1401a3930], rdi
jmp 0x140103fd6
add rax, rax
test rax, rax
je 0x1401040d6
lea rdx, [rax - 2]
cmp word [rcx + rax - 2], 0x5c
mov rax, rdx
jne 0x1401040fa
cmp rdx, 0xfffffffffffffffe
je 0x1401040d6
sar rdx, 1
inc rdx
mov rcx, rdi
mov r8, 0xffffffffffffffff
call fcn.140079140
jmp 0x1401040d6
mov rcx, qword [0x1401a3930]
lea rdx, [rsp + 0x40]
call fcn.140036150
mov rcx, qword [0x1401a3930]
call fcn.140100bf0
cmp word [rax], 0x5c
je 0x140104167
mov rcx, qword [0x1401a3930]
lea rdx, [0x14016a12e]
mov r8d, 1
call fcn.14007bf60
mov rcx, qword [0x1401a3930]
lea rdx, str.debug.log
mov r8d, 9
call fcn.14007bf60
mov rcx, qword [0x1401a3930]
cmp byte [rcx + 0x17], 0
jns 0x140104190
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1401a3928], rax
inc rax
cmp rax, 1
ja 0x140103fa9
mov qword [0x1401a3928], 0
jmp 0x140104060
Function at 0x14011e540
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
movabs rax, 0x4000000000
mov qword [rcx + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x40], xmm0
mov eax, 1
ret
Function at 0x140122bf0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov edx, dword [rsp + 0xe0]
mov rax, qword [0x140192040]
xor rax, rsp
mov qword [rsp + 0x78], rax
movsxd r8, dword [rcx + 0x108]
lea ecx, [rdx + 4]
mov r11d, ecx
shr r11d, 6
xor eax, eax
mov r10d, 0
cmp r11, r8
jae 0x140122c4e
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 5
and r10d, 0x20
lea ecx, [rdx + 3]
mov r11d, ecx
shr r11d, 6
cmp r11, r8
jae 0x140122c6a
mov rax, qword [r9 + r11*8]
shr rax, cl
shl eax, 4
and eax, 0x10
or eax, r10d
lea ecx, [rdx + 2]
mov r14d, ecx
shr r14d, 6
xor r10d, r10d
mov r11d, 0
cmp r14, r8
jae 0x140122c94
mov r11, qword [r9 + r14*8]
shr r11, cl
shl r11d, 3
and r11d, 8
or eax, r11d
lea ecx, [rdx + 1]
mov r11d, ecx
shr r11d, 6
cmp r11, r8
jae 0x140122cb5
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 2
and r10d, 4
or eax, r10d
mov r11d, edx
shr r11d, 6
xor r10d, r10d
cmp r11, r8
jae 0x140122cd7
mov ecx, edx
mov r10, qword [r9 + r11*8]
shr r10, cl
add r10d, r10d
and r10d, 2
or eax, r10d
test edx, edx
je 0x140122cfd
dec edx
mov r10d, edx
shr r10d, 6
xor ecx, ecx
cmp r10, r8
jae 0x140122cfb
mov r8, qword [r9 + r10*8]
xor ecx, ecx
bt r8, rdx
setb cl
or eax, ecx
mov r14d, eax
shr r14d, 5
mov ecx, r14d
dec ecx
neg r14
and ecx, eax
xor eax, 0x3f
mov r15d, r14d
and r15d, eax
or r15d, ecx
mov eax, r15d
shr eax, 1
sub r15, rax
xor r12d, r12d
mov r8d, 0xd8
mov rcx, rsi
xor edx, edx
call fcn.1400e6840
mov r13, r15
not r13
mov r8, r12
xor r8, r15
dec r8
and r8, r13
sar r8, 0x3f
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, rsi
mov r9, rbx
call fcn.14011fb20
inc r12
add rbx, 0xd8
cmp r12, 0x11
jne 0x140122d3b
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [0x1401667f0]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
add rsi, 0x48
movsxd rcx, dword [rdi + 0x148]
test rcx, rcx
jle 0x140122e08
xor eax, eax
xor edx, edx
or rdx, qword [rsi + rax*8]
inc rax
cmp rcx, rax
jne 0x140122dac
test rdx, rdx
sete dl
test ecx, ecx
je 0x140122e58
mov rax, qword [rdi + 0x140]
xor r8d, r8d
lea r9, [rsp + 0x30]
sub r10, r10
jmp 0x140122de0
mov r10, qword [rax + r8*8]
sbb r10, qword [rsi + r8*8]
mov qword [r9 + r8*8], r10
lea r8, [r8 + 1]
dec rcx
jne 0x140122de0
sbb r10, r10
movsxd rax, dword [rdi + 0x148]
test rax, rax
jle 0x140122e27
xor ecx, ecx
jmp 0x140122e1c
mov dl, 1
jmp 0x140122dbe
xor r8d, r8d
mov qword [rsp + rcx*8 + 0x30], r8
inc rcx
cmp rax, rcx
je 0x140122e27
test dl, dl
jne 0x140122e0c
mov r8, qword [rsp + rcx*8 + 0x30]
jmp 0x140122e0f
test eax, eax
je 0x140122e58
and r14d, 1
neg r14
mov rcx, r14
not rcx
xor edx, edx
mov r8, qword [rsp + rdx*8 + 0x30]
and r8, r14
mov r9, qword [rsi + rdx*8]
and r9, rcx
or r9, r8
mov qword [rsi + rdx*8], r9
inc rdx
cmp rax, rdx
jne 0x140122e3a
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400b4140
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401244b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r12, r8
mov rdi, rdx
mov rsi, rcx
mov r13, qword [rsp + 0xb0]
mov rcx, qword [rcx + 0x38]
add rcx, r13
setb dl
movabs rax, 0xfffffffe0
cmp rcx, rax
seta r8b
xor eax, eax
or r8b, dl
jne 0x14012472f
mov r14, r9
lea rbp, [rsi + 0x50]
mov rbx, qword [rsi + 0x160]
mov r15, qword [rsi + 0x150]
mov rax, qword [rsi + 0x158]
mov qword [rsp + 0x30], rax
mov qword [rsi + 0x38], rcx
cmp dword [rsi + 0x174], 0
je 0x14012453f
lea rcx, [rsi + 0x40]
mov rdx, rbp
mov rax, r15
call qword [0x140185120]
mov dword [rsi + 0x174], 0
mov eax, dword [rsi + 0x170]
test eax, eax
je 0x1401245a6
test r13, r13
je 0x140124724
mov cl, byte [r12]
inc r12
mov edx, eax
mov r8b, byte [rsi + rdx + 0x10]
xor r8b, cl
mov byte [r14], r8b
xor byte [rsi + rdx + 0x40], cl
inc r14
lea r8, [r13 - 1]
inc eax
and eax, 0xf
je 0x140124581
cmp r13, 1
mov r13, r8
jne 0x140124552
test eax, eax
jne 0x140124724
lea rcx, [rsi + 0x40]
mov qword [rsp + 0x28], rbp
mov rdx, rbp
mov rax, r15
mov r15, r8
call qword [0x140185120]
mov r8, r15
jmp 0x1401245ae
mov qword [rsp + 0x28], rbp
mov r8, r13
mov ebp, dword [rsi + 0xc]
bswap ebp
cmp r8, 0xc00
jb 0x14012466b
lea rax, [rsi + 0x40]
mov qword [rsp + 0x38], rax
lea r13, [rsi + 0x10]
mov rax, r14
mov rcx, r12
mov qword [rsp + 0x40], r8
mov r15, rcx
mov r14, rax
mov r9d, 0xc00
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x28]
mov r8, r15
mov rax, qword [rsp + 0x30]
call qword [0x140185120]
xor r12d, r12d
mov rcx, rsi
mov rdx, r13
mov r8, rdi
mov rax, rbx
call qword [0x140185120]
inc ebp
mov eax, ebp
bswap eax
mov dword [rsi + 0xc], eax
mov rax, qword [rsi + 0x10]
xor rax, qword [r15 + r12]
mov qword [r14 + r12], rax
mov rax, qword [rsi + 0x18]
xor rax, qword [r15 + r12 + 8]
mov qword [r14 + r12 + 8], rax
add r12, 0x10
cmp r12, 0xc00
jne 0x1401245ff
mov r8, qword [rsp + 0x40]
add r8, 0xfffffffffffff400
lea rax, [r14 + r12]
lea rcx, [r15 + r12]
cmp r8, 0xbff
ja 0x1401245d3
add r14, r12
add r15, r12
mov r12, r15
mov r9, r8
and r9, 0xff0
je 0x1401246e3
lea rcx, [rsi + 0x40]
mov rdx, qword [rsp + 0x28]
mov r15, r8
mov r8, r12
mov rax, qword [rsp + 0x30]
call qword [0x140185120]
mov r8, r15
lea r15, [rsi + 0x10]
mov rcx, rsi
mov rdx, r15
mov r13, r8
mov r8, rdi
mov rax, rbx
call qword [0x140185120]
mov r8, r13
inc ebp
mov eax, ebp
bswap eax
mov dword [rsi + 0xc], eax
mov rax, qword [rsi + 0x10]
xor rax, qword [r12]
mov qword [r14], rax
mov rax, qword [rsi + 0x18]
xor rax, qword [r12 + 8]
mov qword [r14 + 8], rax
add r14, 0x10
add r12, 0x10
add r8, 0xfffffffffffffff0
cmp r8, 0xf
ja 0x140124698
test r8, r8
je 0x140124740
lea rdx, [rsi + 0x10]
mov rcx, rsi
mov r15, r8
mov r8, rdi
mov rax, rbx
call qword [0x140185120]
mov r8, r15
inc ebp
bswap ebp
mov dword [rsi + 0xc], ebp
xor eax, eax
mov ecx, eax
mov dl, byte [r12 + rcx]
xor byte [rsi + rcx + 0x40], dl
xor dl, byte [rsi + rcx + 0x10]
mov byte [r14 + rcx], dl
inc rax
cmp r8, rax
jne 0x14012470a
mov dword [rsi + 0x170], eax
mov eax, 1
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x140124724
Function at 0x14014f230
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rdx, rdx
je 0x14014f243
cmp dword [0x1401aaf20], ecx
jle 0x14014f24a
add rsp, 0x28
pop rdi
pop rsi
ret
mov rsi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
mov rcx, rsi
mov rdx, rdi
call fcn.14014f290
test edi, edi
je 0x14014f243
cmp byte [rsi + rdi - 1], 0xa
je 0x14014f243
lea rcx, [0x1401674ab]
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14014f290

Function at 0x14014f290
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140192040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
lea r14, [rsp + 0x34]
mov r15, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, rsi
jae 0x14014f307
mov dword [rsp + 0x34], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r15
mov ecx, dword [rsp + 0x34]
test eax, eax
cmovne eax, ecx
je 0x14014f307
add rdi, rax
test ecx, ecx
jne 0x14014f2cd
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400b4140
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1401574a0
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x1401574df
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x1401574af
mov dword [rsi], 7
jmp 0x1401574af
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.14006d1b0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x1401574bb
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1401574bb
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x140157591
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x1401574b1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401574af
Function at 0x14001121c
Capabilities:
Terminate process

Disassembly:
jmp 0x140013910
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400112b2
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014c60
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014c80
xor al, al
jmp 0x140014d01
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014c93
xor al, al
jmp 0x140014d01
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014cbd
xor al, al
jmp 0x140014d01
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014cd1
xor al, al
jmp 0x140014d01
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014ce3
xor al, al
jmp 0x140014d01
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014cff
xor al, al
jmp 0x140014d01
mov al, 1
add rsp, 0x38
ret
Function at 0x180002890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movsxd rax, dword [rcx + 0x3c]
xor r8d, r8d
mov r10, rdx
mov r9, rcx
mov ebx, dword [rax + rcx + 0x88]
add rbx, rcx
mov qword [0x180058b80], rbx
mov r11d, dword [rbx + 0x18]
test r11d, r11d
je 0x18000291a
mov esi, dword [rbx + 0x24]
mov r14d, dword [rbx + 0x20]
movzx ebp, byte [rdx]
nop word [rax + rax]
lea rax, [rsi + r8*2]
movzx edi, word [rax + r9]
lea rax, [r14 + r8*4]
mov edx, dword [rax + r9]
add rdx, r9
movzx ecx, byte [rdx]
cmp cl, bpl
jne 0x180002912
mov rax, r10
sub rdx, r10
test cl, cl
je 0x180002933
movzx ecx, byte [rdx + rax + 1]
inc rax
cmp cl, byte [rax]
je 0x180002902
inc r8d
cmp r8d, r11d
jb 0x1800028e0
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov eax, dword [rbx + 0x1c]
add rax, r9
mov eax, dword [rax + rdi*4]
add rax, r9
jmp 0x18000291c
Function at 0x180011d70
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
test rdx, rdx
je 0x180011d96
imul r8d, r8d, 0x343fd
lea rcx, [rcx + 1]
add r8d, 0x269ec3
mov eax, r8d
shr eax, 0x10
xor byte [rcx - 1], al
sub rdx, 1
jne 0x180011d75
ret
Function at 0x18002de0d
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [0x180058bc4]
syscall
ret
Function at 0x140001144
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rax, section..text
mov rdi, rcx
mov qword [rcx + 0x70], rax
lea rbx, [0x140003030]
mov qword [rcx + 0x80], rax
lea rdx, [0x140001cb0]
lea rax, [0x140001020]
mov qword [rcx + 0xe0], rax
lea rax, [0x140001220]
mov qword [rcx + 0x68], rax
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [0x140003040]
mov r9d, 0x22
mov qword [rsp + 0x30], rax
mov r8, rbx
mov byte [rsp + 0x28], 0
xor edx, edx
and dword [rsp + 0x20], 0
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jns 0x1400011c6
lfence
jmp 0x140001211
lea rdx, [0x140001ce0]
lea rcx, [0x140003020]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rdx, rbx
lea rcx, [0x140003020]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov ebx, eax
lfence
test eax, eax
jns 0x140001204
mov rcx, qword [0x140003040]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, ebx
jmp 0x140001211
mov rax, qword [rdi + 0x28]
or dword [rax + 0x68], 0x20
call fcn.1400017b8
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140001248
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 8], rax
movups xmm0, xmmword [rdx]
xor edi, edi
lea rdx, [rbp - 0x60]
mov r14, r8
mov qword [rbp - 0x60], rdi
movdqu xmmword [rbp - 0x48], xmm0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 0x58], xmm0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rbp - 0x60]
mov r15d, eax
test rcx, rcx
jne 0x1400012b0
mov eax, 0xc0000001
jmp 0x140001395
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov rcx, qword [rbp - 0x60]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rbp - 0x60]
test rbx, rbx
je 0x140001330
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov rsi, rax
mov ecx, dword [rax + 0xc]
add rcx, 0xc
mov ebx, dword [rcx]
cmp rbx, rcx
je 0x140001385
mov ecx, dword [rbx + 0x30]
test ecx, ecx
je 0x14000131d
mov edx, ecx
lea rcx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, 1
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x14000132b
mov eax, dword [rsi + 0xc]
mov ebx, dword [rbx]
add rax, 0xc
cmp rbx, rax
jmp 0x1400012ef
mov edi, dword [rbx + 0x18]
jmp 0x140001385
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rsi, rax
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rbx, qword [rcx]
cmp rbx, rcx
je 0x140001385
mov rdx, qword [rbx + 0x60]
test rdx, rdx
je 0x140001371
lea rcx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8b, 1
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
test al, al
jne 0x140001381
mov rax, qword [rsi + 0x18]
mov rbx, qword [rbx]
add rax, 0x10
cmp rbx, rax
jmp 0x140001347
mov rdi, qword [rbx + 0x30]
lea rcx, [rbp - 0x38]
mov qword [r14], rdi
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, r15d
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001870
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400013b8
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r9
mov esi, r8d
mov rbx, rdx
and qword [rsp + 0x30], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov r15d, eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x140001419
mov eax, 0xc0000001
jmp 0x140001504
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140001460
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x14000140f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov rdi, rax
test rax, rax
jne 0x1400014b8
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
jmp 0x14000140f
mov r8, rsi
mov rdx, rdi
mov rcx, r14
call fcn.140001a00
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov eax, r15d
jmp 0x140001504
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140001870
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140001520
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r9
mov esi, r8d
mov rbx, rdx
and qword [rsp + 0x30], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov r15d, eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x140001581
mov eax, 0xc0000001
jmp 0x14000166c
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1400015c8
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x140001577
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov rdi, rax
test rax, rax
jne 0x140001620
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
jmp 0x140001577
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.140001a00
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov eax, r15d
jmp 0x14000166c
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140001870
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x140001794
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
mov qword [0x140003018], rcx
mov rdx, rcx
lea rcx, [0x140001d40]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
add rsp, 0x28
ret
Function at 0x1800013b0
Capabilities:
Allocate or change rwx memory
Enumerate processes via ntquerysysteminformation
Execute shellcode via indirect call
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18011b1c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rdx
lea r9, [rsp + 0x30]
mov rdi, rcx
xor ebx, ebx
xor edx, edx
mov dword [rsp + 0x30], ebx
mov ecx, 5
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x18000145f
mov eax, dword [rsp + 0x30]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x28], 4
lea rdx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x20], 0x3000
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
cmovns rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x18000145f
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbx
mov ecx, 5
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x180001480
mov rcx, rbx
call fcn.180001360
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180070b40
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov rdx, rsi
mov rcx, rbx
call rdi
test al, al
je 0x180001496
mov eax, dword [rbx]
add rbx, rax
cmp dword [rbx], 0
jne 0x180001480
mov rcx, rbx
call fcn.180001360
mov al, 1
jmp 0x180001461