joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140008008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x140008008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140008008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140008008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret
Function at 0x140830aa8
Capabilities:
Encode data using xor

Disassembly:
and byte [rsp + rbx - 0x5e3691be], bh
mov rbx, qword [rsp + rbx - 0x5e3691ae]
add qword [rsp + 0x10], 0xffffffffbf8003fb
cmp byte [rsp + 0x50], 0x1e
mov word [rsp + 0x28], 0xfad
not dword [rsp + 0x50]
call fcn.140728829
add dword [rax + 9], esp
imul ebp, dword [rsi], 0x16666f7
mov al, 0xf9
leave
mov esi, 0xbfd75940
pop rax
xor ecx, esp
lodsb al, byte [rsi]
fsubr qword [rbx - 0x22]
imul edx, dword [rdi], 0xffffffa4
cmp eax, 0x4591f6c
scasd eax, dword [rdi]
cmp byte [rsi - 0x2b76eda8], bh
add byte [rcx + 0xe], al
jno 0x140830ae7
imul ecx, dword [rax], 0x59
cld
invalid

Function at 0x1408e4033
Capabilities:
Encrypt data using rc4 prga

Disassembly:
adc rsi, r10
mov qword [rsp], rdi
push r15
add rsi, r14
push r13
mov r15d, r11d
movzx r10d, r11b
movzx r9d, r15w
lea r9, [rsp + r10*4 - 0x300]
push rbx
xor r10, 0x6e11e79f
sub r15w, r15w
push rax
sub r15b, 0xb5
lea r15, [r9 + r10 - 0x6e11e991]
push r10
seta r10b
inc r10d
and r15b, 0xf0
rol r11w, 0x6a
mov qword [rsp + r10 - 0x6e11e701], rcx
push rdx
sar r11b, 0x22
or r11w, r11w
push r8
push r10
neg r11
mov rsp, r15

Function at 0x1408f8f64
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rbp], 0xffffffff8c85fa9c
mov qword [rsp + rbp + 0x18], rbx
sbb rsi, 0xffffffffec24199c
mov qword [rsp + rbp*8], r8
rol esi, 0xba
and ebp, ebp
push rax
jge 0x1408d642b

Function at 0x140906923
Capabilities:
Encode data using base64

Disassembly:
lea r11, [r10*8 - 0x5fde37dd]
mov r11, rbp
movzx r8d, r10b
pop r8
movsx esi, r10w
call fcn.1408e5a4d
movsx r8d, bp
push r14
movzx eax, si
je 0x140908db2
bswap r8d
xor bp, si
not r8d
call fcn.1408d61a0
mov rax, qword [rax + rbp - 0x62941802]
sub rsp, 0x18
push 0xffffffff9420eb04
lea rsp, [rsp + 8]
call rax
mov r10d, 0xf305021f
mov rsp, qword [rbp + riz - 0x10]
mov rbp, qword [rbp + riz - 8]
mov qword [rbp + riz], rax
jmp 0x1408d6411
push r12
adc r8d, dword [rsp + rbp + 0x80]
rol eax, 0x3f
jae 0x1408e14e9

Function at 0x1409069b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sal edx, 3
or ax, ax
neg eax
jp 0x140905bdd
jmp 0x1408fc2ba
test ebx, ebx
push 0x6a2cfe89
call fcn.14090f8a9
mov ebx, 0x4e0a5521
movzx bx, byte [rbx + r10 - 0x4e0a5521]
mov ebp, 0xd022fd94
mov bpl, byte [r10 + 2]
push 0x1a254608
call fcn.1408d870b
mov rax, rbp
push 0x3319070d
add rax, rdx
mov qword [rbp + riz - 8], rax
lea rsp, [rsp + 8]
mov qword [rbp + riz - 0x10], rsp
push 0x190dc214
lea rsp, [rsp + 8]
sub rsp, rcx
jmp 0x1409075e2
pop rax
mov eax, 0x15004b8f
shl ecx, 3
xor al, 0x81
setb al
ja 0x1408d0cf6
mov rsi, rdi
movzx edx, ax
jmp 0x1408e409a
push 0xffffffff99b4b2ab
lea rsp, [rsp + 8]
and rsp, 0xfffffffffffffff0
add rsp, rcx
jmp 0x1408de23d
Function at 0x140aad6af
Capabilities:
Encode data using xor

Disassembly:
test rbx, rbx
jmp 0x140ad139a
lea rsp, [rsp + 0x10]
je 0x140ad1406
mov edx, 0xbc97d6b8
sar rdx, 0x60
setb dl
push r8
lea r8, [0x140ac2178]
mov edx, 0x3fad2d2d
push rdx
movzx edx, byte [rdx + rbp - 0x3fad2d2d]
xor edx, edi
sal word [rsp + 3], 0x6e
inc qword [rsp]
and edx, 0xff
mov edx, dword [r8 + rdx*4]
shr edi, 8
xor edi, edx
inc rbp
ror word [rsp + 3], 0xe1
xor edi, 0x1431a730
not byte [rsp + 4]
dec rbx
lea rsp, [rsp + 8]
jne 0x140ad13ba
pop r8
not edi
call fcn.140ab1129
Function at 0x1400010f0
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x140009620]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rsi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x68]
lea r8d, [rdx + 0x30]
call fcn.140005a80
xor edi, edi
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x30], rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
xor edx, edx
lea r8d, [rdi + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140005a80
lea r9d, [rdi + 0x30]
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rsi
call sub.ntoskrnl.exe_ZwQueryInformationProcess
lea rcx, [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test ebx, ebx
cmove edi, dword [rsp + 0x58]
mov eax, edi
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140005510
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140001694
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
mov rbp, rdx
lea rdx, [rax - 0x18]
mov ecx, ecx
mov edi, r9d
mov rsi, r8
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jne 0x1400016f2
mov rax, qword [rsp + 0x70]
mov r9, rsi
mov rcx, qword [rsp + 0x30]
mov r8d, edi
mov rdx, rbp
mov qword [rsp + 0x20], rax
call fcn.14000170c
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000170c
Capabilities:
Attach user process memory

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140009620]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, r9
mov r12d, r8d
mov r15, rdx
mov r13, rcx
mov r14, qword [rsp + 0xf0]
mov qword [rsp + 0x50], r14
xor esi, esi
mov qword [rsp + 0x38], rsi
mov edi, 0xc0000001
mov dword [rsp + 0x30], edi
xor edx, edx
lea r8d, [rsi + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140005a80
and qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140001795
mov eax, edi
jmp 0x140001840
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPages]
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x1400017c6
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov eax, 0xc0000001
jmp 0x140001840
lea rdx, [rsp + 0x58]
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, r15
call fcn.140002f80
test al, al
je 0x140001812
mov r8, r12
mov rdx, r15
mov rcx, rdi
call fcn.1400018d0
mov rsi, rax
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
jmp 0x140001812
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
test r14, r14
je 0x14000183c
mov dword [r14], esi
jmp 0x14000183c
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140005510
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140001a5c
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, r9
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
mov rdx, rbx
call fcn.1400010f0
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jne 0x140001ada
mov rax, qword [rsp + 0x78]
mov r9, rdi
mov rcx, qword [rsp + 0x30]
mov r8d, esi
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.140001af4
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140001af4
Capabilities:
Attach user process memory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140009620]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r15, qword [rsp + 0xe0]
mov rax, r9
mov rbx, qword [rsp + 0xe8]
mov r13, rdx
mov dword [rsp + 0x30], r8d
mov r12, rcx
xor esi, esi
mov edx, r15d
and qword [rsp + 0x20], rsi
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
xor ebp, ebp
mov r14d, 0xc0000001
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
and qword [rsp + 0x20], rsi
lea edx, [rsi + 8]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
test rdi, rdi
je 0x140001b8c
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPages]
mov rsi, rax
test rbx, rbx
je 0x140001ba8
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPages]
mov rbp, rax
xor edx, edx
lea rcx, [rsp + 0x38]
lea r8d, [rdx + 0x30]
call fcn.140005a80
lea rdx, [rsp + 0x38]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
test rsi, rsi
je 0x140001bf2
test rbx, rbx
je 0x140001bf2
mov r8d, dword [rsp + 0x30]
mov r9, rsi
mov qword [rsp + 0x28], rbp
mov rdx, r13
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntoskrnl.exe_ZwQueryVirtualMemory]
mov r14d, eax
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test rsi, rsi
je 0x140001c0e
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
test rbp, rbp
je 0x140001c1f
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
test rdi, rdi
je 0x140001c2d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
test rbx, rbx
je 0x140001c3b
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
mov eax, r14d
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140005510
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001f44
Capabilities:
Complete processing asynchronous io request

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x18]
mov rbx, rcx
test rax, rax
je 0x140001f74
mov ecx, dword [rax]
call fcn.140003304
and dword [rbx + 0x30], 0
xor edx, edx
mov rcx, rbx
mov qword [rbx + 0x38], 4
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
add rsp, 0x20
pop rbx
ret

Function at 0x140001f7c
Capabilities:
Complete processing asynchronous io request

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x18]
mov rbx, rcx
test rax, rax
je 0x140001fac
mov ecx, dword [rax]
call fcn.140003324
and dword [rbx + 0x30], 0
xor edx, edx
mov rcx, rbx
mov qword [rbx + 0x38], 4
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
add rsp, 0x20
pop rbx
ret

Function at 0x140001fb4
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140009620]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [rcx + 0x18]
mov rbx, rcx
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], 0
jne 0x140001fdd
inc eax
lea rcx, str.MFC.exe
mov edx, eax
mov r8, rdi
mov r9d, eax
call sub.ntoskrnl.exe_memcpy_s
movups xmm0, xmmword [0x140006000]
lea r8, [rsp + 0x20]
mov esi, 0x18
movsd xmm1, qword [0x140006010]
mov r9d, esi
mov edx, esi
movsd qword [rsp + 0x30], xmm1
mov rcx, rdi
movups xmmword [rsp + 0x20], xmm0
call sub.ntoskrnl.exe_memcpy_s
and dword [rbx + 0x30], 0
xor edx, edx
mov rcx, rbx
mov qword [rbx + 0x38], rsi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140005510
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400020ac
Capabilities:
Complete processing asynchronous io request

Disassembly:
push rbx
mov eax, 0x1000
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [0x140009620]
xor rax, rsp
mov qword [rsp + 0xff0], rax
mov rax, qword [rcx + 0x18]
mov rbx, rcx
test rax, rax
je 0x1400020f7
mov ecx, dword [rax]
call fcn.14000338c
and dword [rbx + 0x30], 0
xor edx, edx
mov rcx, rbx
mov qword [rbx + 0x38], 4
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
lea rcx, [rsp + 0x20]
call fcn.140003f04
mov rcx, qword [rsp + 0xff0]
xor rcx, rsp
call fcn.140005510
add rsp, 0x1000
pop rbx
ret

Function at 0x14000211c
Capabilities:
Complete processing asynchronous io request

Disassembly:
push rbx
mov eax, 0x1000
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [0x140009620]
xor rax, rsp
mov qword [rsp + 0xff0], rax
mov rax, qword [rcx + 0x18]
mov rbx, rcx
test rax, rax
je 0x140002167
mov ecx, dword [rax]
call fcn.1400033b4
and dword [rbx + 0x30], 0
xor edx, edx
mov rcx, rbx
mov qword [rbx + 0x38], 4
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
lea rcx, [rsp + 0x20]
call fcn.140003f04
mov rcx, qword [rsp + 0xff0]
xor rcx, rsp
call fcn.140005510
add rsp, 0x1000
pop rbx
ret
Function at 0x14000218c
Capabilities:
Complete processing asynchronous io request

Disassembly:
sub rsp, 0x28
mov rdx, qword [rcx + 0x18]
test rdx, rdx
je 0x1400021b5
mov eax, dword [rdx + 8]
add eax, dword [rdx + 4]
add dword [rdx], eax
xor edx, edx
and dword [rcx + 0x30], 0
mov qword [rcx + 0x38], 4
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
add rsp, 0x28
ret

Function at 0x1400021bc
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140009620]
xor rax, rsp
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [0x140006020]
lea r8, [rsp + 0x20]
mov eax, dword [0x140006038]
movsd xmm1, qword [0x140006030]
mov edi, 0x1c
mov rbx, rcx
movsd qword [rsp + 0x30], xmm1
mov rcx, qword [rcx + 0x18]
mov r9d, edi
mov edx, edi
mov dword [rsp + 0x38], eax
movups xmmword [rsp + 0x20], xmm0
call sub.ntoskrnl.exe_memcpy_s
and dword [rbx + 0x30], 0
xor edx, edx
mov rcx, rbx
mov qword [rbx + 0x38], rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140005510
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140002240
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov rbx, rcx
test rdi, rdi
je 0x14000228f
mov ecx, dword [rdi]
call fcn.140003290
mov esi, 0x10
test rax, rax
je 0x14000227c
mov r9d, esi
mov r8, rax
mov edx, esi
mov rcx, rdi
call sub.ntoskrnl.exe_memcpy_s
and dword [rbx + 0x30], 0
xor edx, edx
mov rcx, rbx
mov qword [rbx + 0x38], rsi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400022a0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x18]
mov rdi, rcx
test rax, rax
je 0x1400022dd
mov ebx, dword [rax + 0x18]
mov r8, rax
mov rdx, qword [rax + 8]
mov r9d, ebx
mov ecx, dword [rax]
call fcn.1400030ec
and dword [rdi + 0x30], 0
xor edx, edx
mov rcx, rdi
mov qword [rdi + 0x38], rbx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400022e8
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1000
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [0x140009620]
xor rax, rsp
mov qword [rsp + 0xff0], rax
mov rsi, qword [rcx + 0x18]
mov rdi, rcx
lea rcx, [rsp + 0x20]
call fcn.140003f04
lea rcx, [rsp + 0x20]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x14000232c
inc eax
lea r8, [rsp + 0x20]
mov r9d, eax
mov rcx, rsi
mov edx, eax
mov ebx, eax
call sub.ntoskrnl.exe_memcpy_s
and dword [rdi + 0x30], 0
xor edx, edx
mov rcx, rdi
mov qword [rdi + 0x38], rbx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rcx, qword [rsp + 0xff0]
xor rcx, rsp
call fcn.140005510
lea r11, [rsp + 0x1000]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140002384
Capabilities:
Complete processing asynchronous io request

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 0
je 0x1400023a3
and dword [rcx + 0x30], 0
xor edx, edx
mov qword [rcx + 0x38], 4
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
add rsp, 0x28
ret

Function at 0x140002460
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x140009620]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rdx, [0x140006060]
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp + 0xf], 0
lea rax, [rbp - 9]
xorps xmm0, xmm0
mov qword [rbp + 0x17], rax
movdqu xmmword [rbp + 0x27], xmm0
mov dword [rbp + 7], 0x30
mov dword [rbp + 0x1f], 0x240
mov rax, cr8
test al, al
je 0x1400024c6
mov eax, 0xc0000001
jmp 0x1400025c3
and dword [rsp + 0x50], 0
lea r9, [rbp - 0x19]
and qword [rsp + 0x48], 0
lea r8, [rbp + 7]
mov dword [rsp + 0x40], 0x20
lea rcx, [rbp - 0x29]
mov dword [rsp + 0x38], 1
mov edx, 0x80000000
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x1400025c1
mov rcx, qword [rbp - 0x29]
lea r8, [rbp + 0x37]
xor eax, eax
mov dword [rsp + 0x20], 5
lea rdx, [rbp - 0x19]
mov qword [rbp + 0x37], rax
mov qword [rbp + 0x3f], rax
mov qword [rbp + 0x47], rax
lea r9d, [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x1400025b7
mov rax, qword [rbp + 0x3f]
mov cl, 1
mov edx, eax
mov dword [0x1400096d0], eax
call fcn.140002e54
and qword [rsp + 0x40], 0
lea rcx, [rbp - 0x21]
and dword [rbp - 0x1d], 0
xor r9d, r9d
and dword [rbp - 0x21], 0
xor r8d, r8d
mov qword [rsp + 0x38], rcx
xor edx, edx
mov ecx, dword [0x1400096d0]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov qword [0x1400096c8], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
jns 0x1400025b7
mov rcx, qword [0x1400096c8]
call fcn.140002ea4
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140005510
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rbp
ret
Function at 0x1400025e0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov eax, 0x5a4d
or edi, 0xffffffff
mov ebp, edx
mov rsi, rcx
cmp word [rcx], ax
jne 0x140002755
movsxd rbx, dword [rcx + 0x3c]
add rbx, rcx
cmp dword [rbx], 0x4550
jne 0x140002755
mov edx, 0x20b
mov eax, 0x88
cmp word [rbx + 0x18], dx
mov r8d, ebp
lea ecx, [rax - 0x10]
cmovne eax, ecx
mov ecx, dword [rax + rbx]
mov edx, ecx
mov eax, dword [rax + rbx + 4]
mov dword [rsp + 0x70], ecx
mov rcx, rbx
mov dword [rsp + 0x88], eax
call fcn.14000276c
cmp eax, edi
je 0x140002755
mov r13d, eax
mov r8d, ebp
add r13, rsi
mov rcx, rbx
mov edx, dword [r13 + 0x1c]
call fcn.14000276c
mov edx, dword [r13 + 0x24]
mov r8d, ebp
mov rcx, rbx
mov r15d, eax
call fcn.14000276c
mov edx, dword [r13 + 0x20]
mov r8d, ebp
mov rcx, rbx
mov r14d, eax
call fcn.14000276c
cmp r15d, edi
je 0x140002755
cmp r14d, edi
je 0x140002755
cmp eax, edi
je 0x140002755
lea rcx, [rsi + r15]
add r14, rsi
mov r15d, eax
xor r12d, r12d
mov eax, dword [r13 + 0x18]
add r15, rsi
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
test eax, eax
je 0x140002755
mov r13d, dword [rsp + 0x70]
mov edx, dword [r15]
mov r8d, ebp
mov rcx, rbx
call fcn.14000276c
cmp eax, edi
je 0x140002734
mov rdx, qword [rsp + 0x28]
mov ecx, eax
movzx eax, word [r14]
add rcx, rsi
mov edx, dword [rdx + rax*4]
cmp edx, r13d
jb 0x140002710
mov eax, dword [rsp + 0x88]
add eax, r13d
cmp edx, eax
jb 0x140002734
mov r9, qword [rsp + 0x80]
sub r9, rcx
movzx eax, byte [rcx]
movzx r8d, byte [rcx + r9]
sub eax, r8d
jne 0x140002730
inc rcx
test r8d, r8d
jne 0x14000271b
test eax, eax
je 0x140002748
inc r12d
add r15, 4
add r14, 2
cmp r12d, dword [rsp + 0x20]
jae 0x140002755
jmp 0x1400026da
mov r8d, ebp
mov rcx, rbx
call fcn.14000276c
mov edi, eax
mov rbx, qword [rsp + 0x78]
mov eax, edi
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000276c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movzx eax, word [rcx + 0x14]
lea r9, [rcx + 0x18]
movzx r11d, word [rcx + 6]
add r9, rax
xor r10d, r10d
mov ebx, r8d
test r11d, r11d
je 0x1400027ac
mov r8d, dword [r9 + 0xc]
cmp r8d, edx
ja 0x1400027a0
mov ecx, dword [r9 + 8]
add ecx, r8d
cmp ecx, edx
ja 0x1400027b5
add r9, 0x28
inc r10d
cmp r10d, r11d
jl 0x14000278c
or eax, 0xffffffff
mov rbx, qword [rsp + 8]
ret
mov eax, dword [r9 + 0x14]
sub eax, r8d
add edx, eax
or eax, 0xffffffff
cmp edx, ebx
cmovb eax, edx
jmp 0x1400027af
Function at 0x140002848
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x170
mov rax, qword [0x140009620]
xor rax, rsp
mov qword [rsp + 0x160], rax
and qword [rsp + 0x50], 0
mov r14, rdx
lea rdx, [rsp + 0x50]
mov rbp, rcx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14000298a
xor esi, esi
jmp 0x14000295f
mov rcx, qword [rdi]
movabs rax, 0xfffffffffff0
shr rcx, 0x10
and rcx, rax
je 0x14000295b
movabs rax, 0xffff000000000000
or rcx, rax
add rcx, 0x30
call qword [sym.imp.ntoskrnl.exe_ObGetObjectType]
test rax, rax
je 0x14000295b
mov rcx, qword [rax + 0x18]
lea rdx, [0x140005f80]
call sub.ntoskrnl.exe_wcscmp
test eax, eax
jne 0x14000295b
mov ebx, dword [rdi + 8]
mov rdx, rsi
mov eax, ebx
mov rcx, rbp
and eax, 0xfe1fffff
or eax, 0x1fffff
mov dword [rdi + 8], eax
call fcn.1400010f0
and ebx, 0x1ffffff
lea r8, [0x140005f90]
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x38], 0x1fffff
mov r9, rbp
mov qword [rsp + 0x30], rdi
mov edx, 0x100
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call fcn.140001294
lea rdx, [r14 - 1]
inc rdx
cmp byte [rdx], 0
jne 0x14000293e
lea r8, [rsp + 0x60]
xor ecx, ecx
mov al, byte [r8 + rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x14000294d
add rsi, 4
mov rcx, qword [rsp + 0x50]
mov rdx, rsi
mov rcx, qword [rcx + 0x418]
call fcn.1400027c8
mov rdi, rax
test rax, rax
jne 0x140002895
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140005510
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret