joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140144370
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov ecx, 0xd8
mov esi, r8d
mov rdi, rdx
call qword [fcn.140167bc0]
mov rbx, rax
test rax, rax
jne 0x1401443ad
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
lea rax, [0x1401c2ca8]
lea rcx, [rbx + 0x18]
mov qword [rsp + 0x38], rbp
mov qword [rbx], rax
lea rax, [rcx + 0x58]
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rax
cmp esi, 0x40
jbe 0x140144401
call qword [0x1401c2ca8]
mov rcx, qword [rbx + 8]
mov r8d, esi
mov rdx, rdi
call qword [fcn.140142190]
mov rdi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
add rdi, 0x58
mov rcx, rdi
call qword [fcn.140142260]
mov esi, reloc.WS2_32.dll_recv
mov rcx, qword [rbx + 8]
call qword [0x1401c2ca8]
mov rcx, qword [rbx + 0x10]
call qword [0x1401c2ca8]
xor ebp, ebp
test rsi, rsi
je 0x14014446b
mov rbp, rsi
nop
movzx eax, byte [rdi]
lea rdx, [rsp + 0x30]
mov r8d, 1
xor al, 0x36
mov byte [rsp + 0x30], al
mov rcx, qword [rbx + 8]
call qword [fcn.140142190]
movzx eax, byte [rdi]
lea rdx, [rsp + 0x30]
xor al, 0x5c
mov r8d, 1
lea rdi, [rdi + 1]
mov byte [rsp + 0x30], al
mov rcx, qword [rbx + 0x10]
call qword [fcn.140142190]
dec rsi
jne 0x140144420
cmp rbp, 0x40
jae 0x1401444a6
mov edi, 0x40
sub rdi, rbp
mov rcx, qword [rbx + 8]
lea rdx, [0x1401bb0a3]
mov r8d, 1
call qword [fcn.140142190]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1401bb0b1]
mov r8d, 1
call qword [fcn.140142190]
dec rdi
jne 0x140144473
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140166f1e
Capabilities:
Terminate process

Disassembly:
push rbx
push rsi
push rdi
push r15
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, qword [str.WININET.DLL]
mov qword [rsp + 0x70], rbp
jo 0x14016709e
mov dword [rsp + 0x30], esi

Function at 0x140166f30
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [str.KERNEL32.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [str.SHLWAPI.dll]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, qword [str.Xde_]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [0x140232f54]
xor ebx, ebx
mov rsi, rax
mov qword [rsp + 0x68], rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, 0x104
xor ecx, ecx
mov rdx, rax

Function at 0x140166f50
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [str.KERNEL32.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [str.SHLWAPI.dll]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, qword [str.Xde_]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [0x140232f54]
xor ebx, ebx
mov rsi, rax
mov qword [rsp + 0x68], rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, 0x104
xor ecx, ecx
mov rdx, rax
Function at 0x140166f8c
Capabilities:
Terminate process

Disassembly:
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, rdi
call rsi
mov r10, qword [0x140232ee4]
mov r9, rax
cmp dword [r10], ebx
je 0x140167045
movzx r8d, word [rax]
mov edx, ebx
test r8w, r8w
invalid

Function at 0x140166f94
Capabilities:
Terminate process

Disassembly:
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, rdi
call rsi
mov r10, qword [0x140232ee4]
mov r9, rax
cmp dword [r10], ebx
je 0x140167045
movzx r8d, word [rax]
mov edx, ebx
test r8w, r8w
invalid

Function at 0x140167000
Capabilities:
Terminate process

Disassembly:
movzx eax, r8w
lea ecx, [rcx + 1]
movzx r8d, word [r9 + rcx*2]
add edx, eax
test r8w, r8w
jne fcn.140167000

Function at 0x1401670c8
Capabilities:
Terminate process

Disassembly:
mov rdi, rax
mov dword [rsp + 0x20], ebx
lea edx, [r9 + 1]
call rsi
test rax, rax
je 0x14016715a
mov ecx, dword [0x140232f08]
xor r9d, r9d
mov rdx, qword [str.https:__app.physics.wisc.edu_backup_status_Thad_e2_80_99s_20Mac_20mini.txt]
xor r8d, r8d
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ecx
mov rcx, rax
call rbp
test rax, rax
je 0x14016715a
mov r8d, dword [0x140232f54]
invalid
invalid
invalid
invalid

Function at 0x140167160
Capabilities:
Terminate process

Disassembly:
jo 0x14016709e
mov dword [rsp + 0x30], esi
lea r14, [r9 + 0x20a]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, qword [str.InternetOpenA]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [str.InternetOpenUrlA]
add byte [rax - 0x75], cl
iretd
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [str.InternetReadFile]
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140232ed4]
or eax, 0xcbe31
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x60], ebx
invalid
mov r8, qword [0x140232f3c]
mov r9d, reloc.WS2_32.dll_recv
mov rdx, qword [0x140232e94]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140175b64
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1401759cc
Function at 0x140180b74
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x140180ba0
call fcn.14016a3d4
mov dword [rax], socket
call fcn.140175f10
jmp 0x140180ca6
mov eax, dword [rcx + 0x18]
test al, 0x83
je 0x140180ca6
test al, 0x40
jne 0x140180ca6
test al, 2
je 0x140180bc2
or eax, 0x20
mov dword [rcx + 0x18], eax
jmp 0x140180ca6
or eax, 1
mov dword [rcx + 0x18], eax
test eax, 0x10c
jne 0x140180bd6
call fcn.14017c66c
jmp 0x140180bdd
mov rax, qword [rcx + 0x10]
mov qword [rcx], rax
mov rcx, rdi
call fcn.14017b5b4
mov r8d, dword [rdi + 0x24]
mov rdx, qword [rdi + 0x10]
mov ecx, eax
call fcn.14017dbf8
mov dword [rdi + 8], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x140180c95
test byte [rdi + 0x18], 0x82
jne 0x140180c63
mov rcx, rdi
call fcn.14017b5b4
cmp eax, 0xffffffff
je 0x140180c4e
mov rcx, rdi
call fcn.14017b5b4
cmp eax, 0xfffffffe
je 0x140180c4e
mov rcx, rdi
call fcn.14017b5b4
mov rcx, rdi
lea rsi, [0x140238b90]
movsxd rbx, eax
sar rbx, 5
call fcn.14017b5b4
and eax, 0x1f
imul rax, rax, 0x58
add rax, qword [rsi + rbx*8]
jmp 0x140180c55
lea rax, [0x140232e80]
mov al, byte [rax + 8]
and al, 0x82
cmp al, 0x82
jne 0x140180c63
bts dword [rdi + 0x18], 0xd
cmp dword [rdi + 0x24], 0x200
jne 0x140180c82
test byte [rdi + 0x18], 8
je 0x140180c82
test dword [rdi + 0x18], 0x400
jne 0x140180c82
mov dword [rdi + 0x24], 0x1000
mov rcx, qword [rdi]
add dword [rdi + 8], 0xfffffffe
movzx eax, word [rcx]
add rcx, 2
mov qword [rdi], rcx
jmp 0x140180cab
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [rdi + 0x18], eax
and dword [rdi + 8], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002608
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x14000a460]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rsi, rdx
mov qword [0x14000a530], rcx
mov rbx, rcx
mov r14d, 0x80
mov r8d, r14d
lea rcx, [rsp + 0x70]
xor edx, edx
mov edi, 0xc0000001
call fcn.140006d40
mov r8d, r14d
lea rcx, [rbp - 0x10]
xor edx, edx
call fcn.140006d40
mov r8d, r14d
lea rdx, [rsp + 0x70]
lea rcx, [0x140007620]
call fcn.140001320
test al, al
je 0x140002771
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8d, r14d
lea rdx, [rbp - 0x10]
lea rcx, [0x140007620]
call fcn.140001374
test al, al
je 0x140002771
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r9d, [r14 - 0x5e]
mov byte [rsp + 0x28], 0
lea r8, [rsp + 0x48]
xor edx, edx
mov dword [rsp + 0x20], 0x100
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov edi, eax
test eax, eax
js 0x140002771
mov rax, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov qword [0x14000a528], rax
lea rcx, [rsp + 0x58]
or dword [rax + 0x30], 4
mov rax, qword [rsp + 0x40]
btr dword [rax + 0x30], 7
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov edi, eax
test eax, eax
jns 0x14000272f
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x140002771
lea rax, [0x1400025e8]
mov ecx, 0x1c
lea rdi, [rbx + 0x70]
rep stosq qword [rdi], rax
lea rax, [0x140002798]
mov qword [rbx + 0xe0], rax
call fcn.1400015d4
call fcn.140003b18
mov rcx, rbx
call fcn.140005114
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
call fcn.140004d28
xor edi, edi
mov eax, edi
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.140006ab0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140002c60
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rsi, rdx
test rcx, rcx
je 0x140002cb4
test rdx, rdx
je 0x140002cb4
lea rdx, [rax + 0x18]
mov qword [rax + 0x18], rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140002cb4
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rbx
call sub.ntoskrnl.exe_PsReferenceProcessFilePointer
test eax, eax
jns 0x140002cc6
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor al, al
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rsi + rdi*2], bx
jne 0x140002cca
mov rcx, qword [rsp + 0x30]
add edi, edi
movzx eax, word [rcx + 0x58]
cmp eax, edi
jb 0x140002d11
movzx r8d, word [rcx + 0x5a]
xor edx, edx
mov rcx, qword [rcx + 0x60]
call fcn.140006d40
mov rcx, qword [rsp + 0x30]
mov rdx, rsi
mov r8d, edi
mov rcx, qword [rcx + 0x60]
call fcn.140006e40
mov rax, qword [rsp + 0x30]
mov bl, 1
mov word [rax + 0x58], di
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
jmp 0x140002cb6

Function at 0x140002d2c
Capabilities:
Create thread

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov qword [0x14000a538], rcx
lea rax, [0x140002bd4]
xor ecx, ecx
mov dword [rsp + 0x40], 0x30
mov qword [r11 - 0x30], rcx
lea r8, [r11 - 0x38]
mov qword [r11 - 0x48], rcx
xorps xmm0, xmm0
mov dword [rsp + 0x58], 0x200
xor r9d, r9d
mov qword [r11 - 0x28], rcx
mov edx, 0x1fffff
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x58], rcx
mov qword [r11 + 8], rcx
lea rcx, [r11 + 8]
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0x78
ret
Function at 0x140002f5c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov r10, rcx
xor r9d, r9d
test rcx, rcx
jne 0x140002f86
xor eax, eax
jmp 0x140003045
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], r9
movsxd rax, dword [rcx + 0x3c]
test r8b, r8b
je 0x140002fa2
add rcx, 0x88
jmp 0x140002fa6
add rcx, 0x78
add rcx, rax
mov ecx, dword [rcx]
add rcx, r10
mov esi, dword [rcx + 0x1c]
add rsi, r10
mov r8d, dword [rcx + 0x20]
add r8, r10
mov qword [rsp + 8], r8
mov edx, dword [rcx + 0x24]
add rdx, r10
mov qword [rsp + 0x10], rdx
test r14d, 0xffff0000
jne 0x140002fdd
movzx eax, r14w
sub eax, dword [rcx + 0x10]
jmp 0x140003016
mov ecx, dword [rcx + 0x18]
mov dword [rsp], ecx
mov eax, ecx
dec ecx
mov dword [rsp], ecx
test eax, eax
je 0x140003038
mov eax, dword [r8]
add rax, r10
mov rdi, r14
sub rdi, rax
movzx r11d, byte [rax]
movzx ebx, byte [rax + rdi]
sub r11d, ebx
jne 0x14000300e
inc rax
test ebx, ebx
jne 0x140002ffa
test r11d, r11d
jne 0x140003024
movzx eax, word [rdx]
mov r9d, dword [rsi + rax*4]
add r9, r10
mov qword [rsp + 0x18], r9
jmp 0x140003038
add r8, 4
mov qword [rsp + 8], r8
add rdx, 2
mov qword [rsp + 0x10], rdx
jmp 0x140002fe3
jmp 0x140003042
mov rax, r9
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x140003a08
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14000a460]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor esi, esi
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x140003aa1
mov rcx, qword [rsp + 0x20]
mov ebx, 0xc0000001
call qword [sym.imp.ntoskrnl.exe_PsGetProcessImageFileName]
mov rcx, qword [rsp + 0x20]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.140006d40
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdi + rcx], sil
jne 0x140003a78
lea r8d, [rcx + 1]
mov rcx, rdi
lea rdx, [rsp + 0x30]
call fcn.140005f04
lea rcx, [rsp + 0x30]
call fcn.1400017fc
test al, al
cmovne ebx, esi
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140006ab0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140003e10
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x14000a460]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rdx, [0x140007770]
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp + 0xf], 0
lea rax, [rbp - 9]
xorps xmm0, xmm0
mov qword [rbp + 0x17], rax
movdqu xmmword [rbp + 0x27], xmm0
mov dword [rbp + 7], 0x30
mov dword [rbp + 0x1f], 0x240
mov rax, cr8
test al, al
je 0x140003e76
mov eax, 0xc0000001
jmp 0x140003f75
and dword [rsp + 0x50], 0
lea r9, [rbp - 0x19]
and qword [rsp + 0x48], 0
lea r8, [rbp + 7]
mov dword [rsp + 0x40], 0x20
lea rcx, [rbp - 0x29]
mov dword [rsp + 0x38], 1
mov edx, 0x80000000
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x140003f73
mov rcx, qword [rbp - 0x29]
lea r8, [rbp + 0x37]
and dword [rbp + 0x37], 0
lea rdx, [rbp - 0x19]
xor eax, eax
mov dword [rsp + 0x20], 5
mov qword [rbp + 0x3b], rax
mov qword [rbp + 0x43], rax
mov dword [rbp + 0x4b], eax
lea r9d, [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x140003f69
mov eax, dword [rbp + 0x3f]
mov cl, 1
mov edx, eax
mov dword [0x14000a728], eax
call fcn.1400045d8
and qword [rsp + 0x40], 0
lea rcx, [rbp - 0x21]
and dword [rbp - 0x1d], 0
xor r9d, r9d
and dword [rbp - 0x21], 0
xor r8d, r8d
mov qword [rsp + 0x38], rcx
xor edx, edx
mov ecx, dword [0x14000a728]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov qword [0x14000a720], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
jns 0x140003f69
mov rcx, qword [0x14000a720]
call fcn.140004628
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140006ab0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rbp
ret
Function at 0x140003f94
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov eax, 0x5a4d
mov r8d, edx
mov rbp, rcx
cmp word [rcx], ax
je 0x140003fc5
or eax, 0xffffffff
jmp 0x1400040dc
movsxd rsi, dword [rcx + 0x3c]
add rsi, rbp
cmp dword [rsi], 0x4550
jne 0x140003fbd
mov eax, 0x78
mov ecx, 0x20b
cmp word [rsi + 0x18], cx
mov rcx, rsi
lea edx, [rax + 0x10]
cmove eax, edx
mov r12d, dword [rax + rsi]
mov edx, r12d
mov eax, dword [rax + rsi + 4]
mov dword [rsp + 0x78], eax
call fcn.1400040f4
or edi, 0xffffffff
cmp eax, edi
je 0x1400040da
mov ebx, eax
mov rcx, rsi
add rbx, rbp
mov eax, dword [rbx + 0x18]
mov edx, dword [rbx + 0x1c]
mov dword [rsp + 0x60], eax
call fcn.1400040f4
mov edx, dword [rbx + 0x24]
mov rcx, rsi
mov r15d, eax
call fcn.1400040f4
mov edx, dword [rbx + 0x20]
mov rcx, rsi
mov r14d, eax
call fcn.1400040f4
cmp r15d, edi
je 0x1400040da
cmp r14d, edi
je 0x1400040da
cmp eax, edi
je 0x1400040da
lea rbx, [r14 + rbp]
mov r14d, eax
lea r13, [r15 + rbp]
add r14, rbp
xor r15d, r15d
cmp dword [rsp + 0x60], r15d
jbe 0x1400040da
mov edx, dword [r14]
mov rcx, rsi
call fcn.1400040f4
cmp eax, edi
je 0x1400040bc
mov ecx, eax
movzx eax, word [rbx]
add rcx, rbp
mov edx, dword [r13 + rax*4]
cmp edx, r12d
jb 0x14000409b
mov eax, dword [rsp + 0x78]
add eax, r12d
cmp edx, eax
jb 0x1400040bc
mov r10, qword [rsp + 0x70]
sub r10, rcx
movzx eax, byte [rcx]
movzx r9d, byte [rcx + r10]
sub eax, r9d
jne 0x1400040b8
inc rcx
test r9d, r9d
jne 0x1400040a3
test eax, eax
je 0x1400040d0
inc r15d
add r14, 4
add rbx, 2
cmp r15d, dword [rsp + 0x60]
jae 0x1400040da
jmp 0x14000406f
mov rcx, rsi
call fcn.1400040f4
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400040f4
Capabilities:
Enumerate pe sections

Disassembly:
movzx eax, word [rcx + 0x14]
lea r9, [rcx + 0x18]
movzx r11d, word [rcx + 6]
add r9, rax
xor r10d, r10d
test r11d, r11d
je 0x140004128
mov ecx, dword [r9 + 0xc]
cmp ecx, edx
ja 0x14000411c
add ecx, dword [r9 + 8]
cmp ecx, edx
ja 0x14000412c
add r9, 0x28
inc r10d
cmp r10d, r11d
jl 0x14000410c
or eax, 0xffffffff
ret
mov ecx, dword [r9 + 0x14]
or eax, 0xffffffff
sub ecx, dword [r9 + 0xc]
add edx, ecx
cmp edx, r8d
cmovb eax, edx
ret
Function at 0x140004e58
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
cmp dword [0x14000a7c8], 0
movzx ebx, r8w
movzx edi, dx
movzx esi, cx
jne 0x140004ef2
and qword [r11 - 0x68], 0
lea rax, [0x140004c34]
and qword [rbp + 7], 0
lea r8, [rbp + 0x27]
and qword [rbp + 0x2f], 0
lea rcx, [rbp + 7]
and qword [rbp + 0x37], 0
xorps xmm0, xmm0
mov dword [0x14000a7c8], r9d
mov edx, 0x1fffff
mov qword [r11 - 0x70], rax
xor r9d, r9d
and qword [r11 - 0x78], 0
mov dword [rbp + 0x27], 0x30
mov dword [rbp + 0x3f], 0x200
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
jns 0x140004ee8
xor al, al
jmp 0x140004fa9
mov rcx, qword [rbp + 7]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, dword [0x14000a450]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [0x14000a7d0], rax
test rax, rax
je 0x140004f70
mov r8d, dword [0x14000a450]
lea rdx, [0x140004634]
mov rcx, rax
call fcn.140006e40
and qword [rsp + 0x30], 0
lea rax, [0x140004cb8]
and qword [rbp + 0x2f], 0
lea r8, [rbp + 0x27]
and qword [rbp + 0x37], 0
lea rcx, [rbp + 7]
mov qword [rsp + 0x28], rax
xorps xmm0, xmm0
and qword [rsp + 0x20], 0
xor r9d, r9d
mov edx, 0x1fffff
mov dword [rbp + 0x27], 0x30
mov dword [rbp + 0x3f], 0x200
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
lea rdx, [rbp + 0xf]
lea rcx, [0x14000bb80]
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
lea rcx, [rbp + 0xf]
mov word [0x14000a7bc], si
mov word [0x14000a7c0], di
mov word [0x14000a7c4], bx
mov byte [0x14000a7b8], 1
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
mov al, 1
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14000554c
Capabilities:
Create thread

Disassembly:
sub rsp, 0x78
cmp qword [0x14000a808], 0
je 0x14000555e
mov al, 1
jmp 0x1400055ce
cmp byte [0x14000a800], 0
jne 0x14000556b
xor al, al
jmp 0x1400055ce
and qword [rsp + 0x30], 0
lea rax, [0x1400055d4]
and qword [rsp + 0x48], 0
lea r8, [rsp + 0x40]
and qword [rsp + 0x50], 0
lea rcx, [0x14000a808]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor r9d, r9d
mov edx, 0x1fffff
mov byte [0x14000a801], 1
mov dword [rsp + 0x40], 0x30
mov dword [rsp + 0x58], 0x200
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
setns al
add rsp, 0x78
ret

Function at 0x140005d14
Capabilities:
Create thread

Disassembly:
sub rsp, 0x78
cmp qword [0x14000a828], 0
je 0x140005d26
mov al, 1
jmp 0x140005d82
and qword [rsp + 0x30], 0
lea rax, [0x140005710]
and qword [rsp + 0x48], 0
lea r8, [rsp + 0x40]
and qword [rsp + 0x50], 0
lea rcx, [0x14000a828]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor r9d, r9d
mov edx, 0x1fffff
mov dword [rsp + 0x40], 0x30
mov dword [rsp + 0x58], 0x200
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
setns al
add rsp, 0x78
ret
Function at 0x1400063bc
Capabilities:
Hash data with crc32

Disassembly:
xor ecx, ecx
lea rdx, [0x14000a830]
mov eax, ecx
mov r8d, 8
test al, 1
je 0x1400063da
shr eax, 1
xor eax, 0xedb88320
jmp 0x1400063dc
shr eax, 1
sub r8, 1
jne 0x1400063cd
mov dword [rdx], eax
inc ecx
add rdx, 4
cmp ecx, 0x100
jb 0x1400063c5
ret

Function at 0x140006694
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rsi, rdx
mov dword [rbp + 0x17], 0x30
xor edx, edx
mov r14, rcx
lea rcx, [rbp + 0x1f]
mov edi, 0xc0000001
lea r8d, [rdx + 0x28]
call fcn.140006d40
and qword [rbp + 0x67], 0
xor eax, eax
and dword [rbp + 7], 0
mov dword [rbp + 0xb], eax
mov qword [rbp + 0xf], rax
test r14, r14
je 0x1400067f1
test rsi, rsi
je 0x1400067f1
mov edx, 0x1018
xor ecx, ecx
mov r8d, 0x52454e4d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
jne 0x140006718
mov edi, 0xc0000017
jmp 0x1400067e2
xor eax, eax
mov rdi, rbx
mov ecx, 0x1018
mov edx, 0x800
rep stosb byte [rdi], al
and qword [rbx + 8], rax
lea rcx, [rbx + 0x14]
mov byte [rbx], al
movzx eax, word [rsi]
mov dword [rbx + 0x10], eax
movzx r9d, word [rsi]
mov r8, qword [rsi + 8]
shr r9, 1
call fcn.140005e80
and dword [rsp + 0x50], 0
lea r9, [rbp + 7]
and qword [rsp + 0x48], 0
lea r8, [rbp + 0x17]
and qword [rbp + 0x1f], 0
lea rcx, [rbp + 0x67]
mov dword [rsp + 0x40], 0x28
mov eax, 1
mov dword [rsp + 0x38], eax
xorps xmm0, xmm0
mov dword [rsp + 0x30], eax
mov edx, 0x110000
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp + 0x17], 0x30
mov dword [rbp + 0x2f], 0x240
mov qword [rbp + 0x27], r14
movdqu xmmword [rbp + 0x37], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov edi, eax
test eax, eax
js 0x1400067d4
mov rcx, qword [rbp + 0x67]
lea rdx, [rbp + 7]
mov r9d, 0x1018
mov dword [rsp + 0x20], 0xa
mov r8, rbx
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov edi, eax
mov edx, 0x52454e4d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x67]
test rcx, rcx
je 0x1400067f1
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r11, [rsp + 0xa0]
not edi
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
shr edi, 0x1f
mov al, dil
mov rsp, r11
pop r14
pop rdi
pop rbp
ret