joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16280
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x60
xor r12d, r12d
mov rbx, rcx
lea rcx, [rax - 0x40]
lea r8d, [r12 + 0x28]
xor edx, edx
mov dword [rax - 0x48], r12d
call fcn.000407c0
xor eax, eax
mov word [rsp + 0x20], r12w
mov qword [rsp + 0x22], rax
mov dword [rsp + 0x2a], eax
mov word [rsp + 0x2e], ax
cmp rbx, r12
je 0x16416
cmp word [rbx], r12w
je 0x16416
cmp word [rbx + 2], r12w
je 0x16416
cmp qword [rbx + 8], r12
je 0x16416
lea rdx, [0x00040e00]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movzx r11d, word [rsp + 0x22]
movzx eax, word [rbx + 2]
add r11d, eax
lea r14d, [r12 + 0x50]
lea ebp, [r12 + 0x20]
movsxd rsi, r11d
add rsi, r14
mov r8d, 0x6e65654b
mov rdx, rsi
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
cmp rax, r12
jne 0x16345
add ebp, 0xffffffff
jne 0x1631f
mov rdi, r12
jmp 0x16352
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.000407c0
cmp rdi, r12
jne 0x16361
mov eax, 0xc000009a
jmp 0x1641b
movzx eax, word [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rdi
add ax, word [rsp + 0x20]
add ax, r14w
mov word [rdi], ax
movzx eax, word [rsp + 0x22]
add ax, word [rbx + 2]
add ax, r14w
mov word [rdi + 2], ax
lea rax, [rdi + 0x10]
mov qword [rdi + 8], rax
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
cmp eax, r12d
mov ebx, eax
jge 0x163bc
mov edx, 0x6e65654b
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x1641b
lea rdx, [0x00040d90]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
cmp eax, r12d
mov ebx, eax
jl 0x163aa
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x30
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x48], 0x240
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov ebx, eax
jmp 0x163aa
mov eax, 0xc000000d
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
Function at 0x167d0
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x30
and dword [rsp + 0x58], 0
mov rsi, r8
mov rbp, rdx
mov r13, rcx
test rdx, rdx
je 0x16901
test r8, r8
je 0x16901
and dword [r8], 0
and dword [rdx], 0
mov rax, qword [0x0006a670]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
test rax, rax
je 0x16834
lea rcx, [r11 + 0x10]
mov qword [r11 - 0x28], rcx
mov rcx, r13
call rax
jmp 0x16844
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
mov edi, eax
cmp eax, 0xc0000023
jne 0x168fd
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x168fd
mov r12, rax
mov edi, 0x20
mov r8d, 0x6e65654b
mov rdx, r12
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
jne 0x16888
add edi, 0xffffffff
jne 0x16865
jmp 0x16895
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.000407c0
test rbx, rbx
jne 0x168a1
mov edi, 0xc000009a
jmp 0x168fd
mov rax, qword [0x0006a670]
mov r9d, dword [rsp + 0x58]
mov r8, rbx
mov edx, 2
test rax, rax
je 0x168cb
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov rcx, r13
call rax
jmp 0x168de
lea rax, [rsp + 0x58]
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
mov edi, eax
test eax, eax
js 0x168ef
mov eax, dword [rbx + 0x14]
mov dword [rbp], eax
mov eax, dword [rbx + 0x20]
mov dword [rsi], eax
mov edx, 0x6e65654b
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
jmp 0x16906
mov eax, 0xc000000d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x16928
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
xor edi, edi
mov r12, r9
mov rsi, r8
mov rbp, rdx
mov r13, rcx
mov dword [rsp + 0x60], edi
cmp rcx, rdi
je 0x16a8a
cmp rdx, rdi
je 0x16a8a
cmp r8, rdi
je 0x16a8a
cmp r9, rdi
jne 0x16973
mov dword [r8], edi
mov rax, qword [0x0006a678]
xor r9d, r9d
lea r8d, [r9 + 2]
cmp rax, rdi
je 0x1699b
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
mov rcx, r13
mov dword [rsp + 0x20], edi
call rax
jmp 0x169af
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
cmp eax, 0xc0000023
jne 0x16a86
mov eax, dword [rsp + 0x60]
cmp eax, edi
je 0x16a86
mov r14, rax
mov ebx, 0x20
mov r8d, 0x6e65654b
mov rdx, r14
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
jne 0x169f3
add ebx, 0xffffffff
jne 0x169d0
jmp 0x16a00
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.000407c0
test rdi, rdi
jne 0x16a0c
mov ebx, 0xc000009a
jmp 0x16a86
mov r10, qword [0x0006a678]
lea rax, [rsp + 0x60]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x60]
mov r8d, 2
mov rdx, rbp
mov rcx, r13
mov dword [rsp + 0x20], eax
test r10, r10
je 0x16a3e
call r10
jmp 0x16a44
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
test eax, eax
js 0x16a78
mov eax, dword [rdi + 8]
cmp dword [rsi], eax
jae 0x16a58
mov ebx, 0xc0000023
jmp 0x16a73
test r12, r12
je 0x16a6e
lea rdx, [rdi + 0xc]
mov r8, rax
mov rcx, r12
call fcn.00040300
jmp 0x16a73
mov ebx, 0xc000000d
mov eax, dword [rdi + 8]
mov dword [rsi], eax
mov edx, 0x6e65654b
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x16a8f
mov eax, 0xc000000d
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x16b54
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x60
and qword [rax + 0x10], 0
mov esi, r9d
mov r12d, r8d
mov rbp, rdx
mov rdi, rcx
test rdx, rdx
je 0x16c42
test r9d, r9d
je 0x16c42
mov rbx, qword [rsp + 0xa0]
test rbx, rbx
je 0x16c42
xor edx, edx
lea rcx, [rax - 0x40]
lea r8d, [rdx + 0x28]
call fcn.000407c0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.000166f4
test eax, eax
js 0x16c47
mov rdi, qword [rsp + 0x88]
test rdi, rdi
je 0x16c20
mov rax, qword [0x0006a680]
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov r9d, r12d
mov rdx, rbp
mov rcx, rdi
mov qword [rsp + 0x20], rbx
test rax, rax
je 0x16bf9
call rax
jmp 0x16bff
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ebx, eax
test eax, eax
js 0x16c16
mov rax, cr8
test al, al
jne 0x16c16
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwFlushKey]
mov rdi, qword [rsp + 0x88]
jmp 0x16c25
mov ebx, 0xc000000d
mov rax, qword [0x0006a6e0]
mov rcx, rdi
test rax, rax
je 0x16c38
call rax
jmp 0x16c3e
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
jmp 0x16c47
mov eax, 0xc000000d
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret

Function at 0x16c64
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x28
test rcx, rcx
jne 0x16c74
mov eax, 0xc000000d
jmp 0x16c8a
mov rax, qword [0x0006a698]
test rax, rax
je 0x16c84
call rax
jmp 0x16c8a
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
add rsp, 0x28
ret
Function at 0x17ccc
Capabilities:
Map section object

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0xb0
xor esi, esi
xor eax, eax
mov rbx, rcx
mov rdi, rdx
mov dword [rsp + 0x74], eax
lea rcx, [r11 - 0x40]
lea r8d, [rsi + 0x28]
xor edx, edx
mov dword [rsp + 0x70], esi
mov qword [r11 + 0x20], rsi
mov qword [r11 + 0x18], rsi
mov qword [r11 + 8], rsi
mov qword [r11 - 0x50], rax
mov dword [r11 - 0x48], esi
call fcn.000407c0
cmp rbx, rsi
je 0x17ea2
cmp rdi, rsi
je 0x17ea2
mov dword [rsp + 0x68], 0x100
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0xe0]
mov edx, 0x100020
mov dword [rsp + 0x28], 0x80
mov qword [rdi], rsi
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x88], rsi
mov dword [rsp + 0x98], 0x240
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rsi
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
cmp eax, esi
mov ebx, eax
jl 0x17e9e
mov rax, qword [rsp + 0xe0]
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov edx, 0xf001f
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], rsi
mov dword [rsp + 0x20], 0x10
mov dword [rsp + 0x98], 0x240
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rsi
call qword [sym.imp.ntoskrnl.exe_ZwCreateSection]
cmp eax, esi
mov ebx, eax
jl 0x17e90
mov rcx, qword [rsp + 0xd0]
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], 0x100000
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0xe8]
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov r8, rdi
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov rcx, qword [rsp + 0xd0]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
jmp 0x17ea7
mov eax, 0xc000000d
add rsp, 0xb0
pop rdi
pop rsi
pop rbx
ret
Function at 0x17eb8
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov rdi, rcx
xor ebx, ebx
mov esi, ebx
mov dword [rax - 0x28], ebx
cmp rcx, rbx
je 0x17f8c
cmp rdx, rbx
je 0x17f8c
cmp r8, rbx
je 0x17f8c
mov qword [r8], rbx
mov eax, 0x5a4d
cmp ax, word [rcx]
jne 0x17f82
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x17f82
mov ecx, dword [rax + rcx + 0x88]
cmp ecx, ebx
je 0x17f82
lea r12, [rdi + rcx]
cmp esi, dword [r12 + 0x18]
jae 0x17f82
mov r8d, esi
mov eax, dword [r12 + 0x20]
lea rcx, [rdi + rax]
mov ecx, dword [rcx + r8*4]
add rcx, rdi
mov eax, dword [r12 + 0x24]
lea rdx, [rdi + rax]
movzx r8d, word [rdx + r8*2]
mov eax, dword [r12 + 0x1c]
lea rdx, [rdi + rax]
mov r15d, dword [rdx + r8*4]
mov rdx, r14
call qword [sym.imp.ntoskrnl.exe__stricmp]
cmp eax, ebx
jne 0x17f7a
mov qword [r13], r15
mov ebx, 1
mov dword [rsp + 0x20], ebx
jmp 0x17f82
inc esi
mov dword [rsp + 0x24], esi
jmp 0x17f29
jmp 0x17f88
mov eax, ebx
jmp 0x17f8e
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
ret

Function at 0x18060
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xe0
or qword [rax + 0x20], 0xffffffffffffffff
xor ebx, ebx
mov dword [rax - 0x40], 0x30
mov qword [rax - 0x38], rbx
mov dword [rax - 0x28], 0x240
mov qword [rax - 0x30], rcx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov dword [rax - 0x80], 0x100
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbx
lea r9, [rax - 0x78]
lea r8, [rax - 0x40]
mov edx, 0x80100000
lea rcx, [rax + 0x20]
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
cmp eax, 0xc0000034
je 0x18160
cmp eax, 0xc000003a
je 0x18160
cmp eax, 0xc0000033
je 0x18160
cmp eax, 0xc0000039
je 0x18160
cmp eax, 0xc0000123
je 0x18160
cmp qword [rsp + 0x78], 5
je 0x18160
cmp eax, ebx
jl 0x18160
mov dword [rsp + 0x80], ebx
xor edx, edx
lea r8d, [rdx + 0x24]
lea rcx, [rsp + 0x84]
call fcn.000407c0
mov dword [rsp + 0x20], 4
mov r9d, 0x28
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp eax, ebx
jl 0x18160
mov ebx, 1
mov rcx, qword [rsp + 0x108]
cmp rcx, 0xffffffffffffffff
je 0x18174
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
add rsp, 0xe0
pop rbx
ret
Function at 0x182e4
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x0004b108]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rdi, rcx
mov rbx, r8
mov esi, edx
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x50], 0
call fcn.000407c0
mov byte [rsp + 0x20], 0x90
mov byte [rsp + 0x21], 0xa8
mov byte [rsp + 0x22], 0xbe
mov byte [rsp + 0x23], 0xa5
mov byte [rsp + 0x24], 0xba
mov byte [rsp + 0x25], 0xa9
mov byte [rsp + 0x26], 0xbe
mov byte [rsp + 0x27], 0x93
mov byte [rsp + 0x28], 0xb8
mov byte [rsp + 0x29], 0xa8
mov byte [rsp + 0x2a], 0xa5
mov byte [rsp + 0x2b], 0x90
mov byte [rsp + 0x2c], 0xbf
mov byte [rsp + 0x2d], 0xb8
mov byte [rsp + 0x2e], 0xa8
mov byte [rsp + 0x2f], 0x90
mov byte [rsp + 0x30], 0xcc
mov byte [rsp + 0x38], 0xa8
mov byte [rsp + 0x39], 0xa9
mov byte [rsp + 0x3a], 0xbf
mov byte [rsp + 0x3b], 0xa7
mov byte [rsp + 0x3c], 0xb8
mov byte [rsp + 0x3d], 0xa3
mov byte [rsp + 0x3e], 0xbc
mov byte [rsp + 0x3f], 0x90
mov byte [rsp + 0x40], 0xa8
mov byte [rsp + 0x41], 0xa8
mov byte [rsp + 0x42], 0x90
mov byte [rsp + 0x43], 0xa0
mov byte [rsp + 0x44], 0xa3
mov byte [rsp + 0x45], 0xad
mov byte [rsp + 0x46], 0xa8
mov byte [rsp + 0x47], 0xa9
mov byte [rsp + 0x48], 0xbe
mov byte [rsp + 0x49], 0xcc
lea rax, [rsp + 0x20]
mov ecx, 0x11
xor byte [rax], 0xcc
inc rax
sub rcx, 1
jne 0x183d9
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe__strlwr]
lea r11, [rsp + 0x38]
mov eax, 0x12
xor byte [r11], 0xcc
inc r11
sub rax, 1
jne 0x183fa
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe__strlwr]
lea r8, [rsp + 0x50]
mov edx, esi
mov rcx, rdi
call fcn.00018188
mov edi, eax
test eax, eax
je 0x18472
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe__strlwr]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_strstr]
test rax, rax
je 0x18452
test rbx, rbx
je 0x18452
mov dword [rbx], 1
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_strstr]
test rax, rax
je 0x18472
test rbx, rbx
je 0x18472
mov dword [rbx], 1
mov eax, edi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.00040240
add rsp, 0x170
pop rdi
pop rsi
pop rbx
ret
Function at 0x18498
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x0004b108]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r12, rcx
xor ebx, ebx
mov byte [rsp + 0x38], bl
xor eax, eax
mov qword [rsp + 0x39], rax
mov dword [rsp + 0x41], eax
mov word [rsp + 0x45], ax
mov byte [rsp + 0x47], al
mov byte [rsp + 0x20], 0x30
mov byte [rsp + 0x21], bl
mov r14d, ebx
mov dword [rsp + 0x34], ebx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, bl
je 0x1866b
movsxd rdi, dword [r12 + 0x3c]
add rdi, r12
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, bl
je 0x1866b
movsxd rax, dword [r12 + 0x3c]
lea rsi, [rax + r12 + 0x18]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, bl
je 0x1866b
mov eax, 0x5a4d
cmp word [r12], ax
jne 0x1866b
cmp dword [rdi], 0x4550
jne 0x1866b
mov ecx, 0x20b
cmp word [rsi], cx
je 0x18561
mov eax, 0x10b
cmp word [rsi], ax
jne 0x1866b
movzx r13d, word [rdi + 6]
mov word [rsp + 0x24], r13w
movzx eax, word [rdi + 0x14]
cmp word [rsi], cx
jne 0x1857d
movzx edi, ax
add rdi, rsi
jmp 0x18583
movzx edi, ax
add rdi, rsi
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, bl
je 0x1866b
movzx eax, r13w
lea rcx, [rax + rax*4]
lea rcx, [rdi + rcx*8]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, bl
je 0x1866b
mov esi, ebx
mov dword [rsp + 0x30], ebx
movzx eax, r13w
cmp esi, eax
jae 0x1866b
mov eax, esi
lea r13, [rax + rax*4]
mov r15d, dword [rdi + r13*8 + 0x10]
mov eax, dword [rdi + r13*8 + 0x14]
mov dword [rsp + 0x2c], eax
cmp r14d, ebx
jne 0x18638
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov rax, qword [rdi + r13*8]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_strstr]
cmp rax, rbx
je 0x18627
cmp r15d, ebx
jne 0x18627
cmp dword [rsp + 0x2c], ebx
jne 0x18627
test dword [rdi + r13*8 + 0x24], 0xe0000020
je 0x18627
mov byte [rax], 0x31
mov r14d, 1
mov dword [rsp + 0x34], r14d
inc esi
mov dword [rsp + 0x30], esi
mov r13w, word [rsp + 0x24]
jmp 0x185b4
mov eax, esi
lea rcx, [rax + rax*4]
lea rcx, [rdi + rcx*8]
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_strstr]
cmp rax, rbx
je 0x1865d
mov ebx, 1
mov dword [rsp + 0x28], ebx
jmp 0x1866b
mov rcx, r12
call fcn.000186a4
mov ebx, eax
mov dword [rsp + 0x28], eax
jmp 0x18673
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.00040240
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x186a4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rsi, rcx
xor ebx, ebx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, bl
je 0x187f8
movsxd rbp, dword [rsi + 0x3c]
add rbp, rsi
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, bl
je 0x187f8
movsxd rax, dword [rsi + 0x3c]
lea rdi, [rax + rsi + 0x18]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, bl
je 0x187f8
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x187f8
cmp dword [rbp], 0x4550
jne 0x187f8
mov eax, 0x20b
cmp word [rdi], ax
je 0x18746
mov eax, 0x10b
cmp word [rdi], ax
jne 0x187f8
cmp dword [rdi + 0x6c], 0x10
mov r12d, dword [rdi + 0x10]
jne 0x18762
cmp dword [rdi + 0xc4], ebx
jmp 0x18756
cmp dword [rdi + 0x7c], 0x10
mov r12d, dword [rdi + 0x10]
jne 0x18762
cmp dword [rdi + 0xd4], ebx
jne 0x18762
mov ebx, 1
jmp 0x187f8
movzx eax, word [rbp + 0x14]
mov r13d, ebx
lea rsi, [rax + rbp + 0x18]
cmp bx, word [rbp + 6]
jae 0x187f8
mov edi, 1
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, bl
je 0x187f8
mov ecx, dword [rsi + 0xc]
cmp r12d, ecx
jbe 0x1879a
add ecx, dword [rsi + 8]
cmp r12d, ecx
jb 0x187ac
movzx eax, word [rbp + 6]
add r13d, edi
add rsi, 0x28
cmp r13d, eax
jae 0x187f8
jmp 0x1877d
mov ebp, 5
lea rdx, [0x000410e0]
mov rcx, rsi
mov r8, rbp
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, ebx
je 0x187f8
lea rdx, [0x000410f0]
mov r8, rbp
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, ebx
je 0x187f8
lea r8d, [rbp - 1]
lea rdx, [0x00041100]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, ebx
cmovne ebx, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x19594
Capabilities:
Attach user process memory

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r12
sub rsp, 0x50
mov r12, rcx
mov rdi, qword [rcx + 0x20]
mov eax, dword [0x0006a930]
mov rbx, qword [rax + rdi]
test rbx, rbx
je 0x1966a
mov rax, qword [0x000422a8]
cmp rbx, qword [rax]
jae 0x1966a
and qword [r11 - 0x38], 0
xor edx, edx
lea r8d, [rdx + 0x28]
lea rcx, [r11 - 0x30]
call fcn.000407c0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov eax, dword [0x0006a908]
mov rbx, qword [rax + rbx]
mov esi, dword [0x0006a918]
add rsi, rbx
mov edi, dword [0x0006a920]
add rdi, rbx
mov rax, qword [rsi + 8]
cmp rax, rbx
jae 0x19644
cmp qword [rdi + 8], rbx
jae 0x19644
add rax, rbx
mov qword [rsi + 8], rax
add qword [rdi + 8], rbx
mov r8, rdi
mov rdx, rsi
mov rcx, r12
call fcn.000191ec
sub qword [rdi + 8], rbx
sub qword [rsi + 8], rbx
jmp 0x1965d
cmp rax, rbx
jbe 0x1965d
cmp qword [rdi + 8], rbx
jbe 0x1965d
mov r8, rdi
mov rdx, rsi
mov rcx, r12
call fcn.000191ec
jmp 0x1965f
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop r12
ret
Function at 0x19b90
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x0004b108]
xor rax, rsp
mov qword [rsp + 0xe8], rax
lea rdi, [rdx + 0x40]
mov ebp, r8d
mov rsi, rdx
mov rbx, qword [rdi]
xor edx, edx
mov qword [rsp + 0x68], rcx
lea rcx, [r11 - 0x47]
lea r8d, [rdx + 0x20]
mov dword [rsp + 0x60], ebp
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rdi
mov byte [r11 - 0x48], 0
call fcn.000407c0
xor edx, edx
lea rcx, [rsp + 0x99]
lea r8d, [rdx + 0x20]
mov byte [rsp + 0x98], 0
call fcn.000407c0
and dword [rsp + 0x70], 0
xor eax, eax
test byte [rsi], 1
mov dword [rsp + 0x74], eax
jne 0x19dbe
lea rcx, [0x00062ba0]
xor edx, edx
mov r8d, 0x1000
call fcn.000407c0
test ebp, ebp
je 0x19c7a
lea rbx, [0x00062ba0]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
lea r9, [0x000411a0]
lea r8, [0x000411b0]
not rcx
mov edx, 0x1000
dec rcx
add rcx, rbx
call fcn.00018c20
sub rbp, 1
jne 0x19c38
mov rbx, qword [rsp + 0x80]
mov ebp, dword [rsp + 0x60]
lea rdi, [rsi + 0x40]
lea rcx, [rsp + 0xc0]
mov edx, 0x21
call fcn.0001a7f4
test eax, eax
je 0x19ca4
lea rcx, [rsi + 0x94]
lea rdx, [rsp + 0xc0]
call fcn.000190e0
lea rcx, [rsp + 0x98]
mov edx, 0x21
call fcn.0001a7f4
test eax, eax
je 0x19cce
lea rcx, [rsi + 0xa8]
lea rdx, [rsp + 0x98]
call fcn.000190e0
test byte [rsi], 8
lea rdx, [0x00062ba0]
lea rax, [0x000411c0]
lea r8, [0x000411d0]
lea r9, [0x000411f0]
cmovne r8, rax
cmp rdi, rbx
mov rdi, rdx
lea rax, [0x000411e0]
cmove r9, rax
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x50], rax
mov eax, dword [rsi + 0xa4]
not rcx
mov dword [rsp + 0x48], eax
mov rax, qword [rsi + 0x68]
dec rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsi + 0x58]
add rcx, rdx
mov qword [rsp + 0x38], rax
mov rax, qword [rsi + 8]
mov edx, 0x1000
mov qword [rsp + 0x30], rax
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea r8, [0x00041200]
call fcn.00018c20
mov rsi, qword [rsp + 0x68]
xor eax, eax
and qword [rsp + 0x40], rax
or rcx, 0xffffffffffffffff
lea rdx, [0x00062ba0]
mov rdi, rdx
xor r9d, r9d
xor r8d, r8d
repne scasb al, byte [rdi]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
not rcx
lea rax, [rsp + 0x88]
dec rcx
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rdx
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov rdi, qword [rsp + 0x78]
jmp 0x19dd8
mov rsi, qword [rsp + 0x68]
jmp 0x19dd8
lea rdx, [rbx - 0x30]
lea r8d, [rbp + 1]
mov rcx, rsi
call fcn.00019b90
mov rbx, qword [rbx]
cmp rdi, rbx
jne 0x19dc5
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.00040240
mov rbx, qword [rsp + 0x128]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret