joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14017d280
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov r8, qword [0x1402c5210]
xor esi, esi
mov rbp, rcx
test r8, r8
je 0x14017d2ad
mov rax, qword [0x1402c5220]
test rax, rax
jne 0x14017d382
call fcn.14017cf20
mov rdi, rax
test rax, rax
je 0x14017d40c
mov qword [rsp + 0x50], r14
mov r14d, 0x5a4d
cmp word [rax], r14w
jne 0x14017d317
mov ecx, dword [rax + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14017d317
cmp dword [rcx + rdi], 0x4550
jne 0x14017d317
lea rdx, [rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017d317
cmp dword [rdx + 4], esi
je 0x14017d317
lea r8, [rdi + rax]
mov word [rsp + 0x20], si
lea r9, str.PowerGetActiveScheme
mov rcx, rdi
call fcn.140177a80
mov r8, rax
jmp 0x14017d31a
mov r8, rsi
cmp word [rdi], r14w
mov r14, qword [rsp + 0x50]
mov qword [0x1402c5210], r8
jne 0x14017d378
mov ecx, dword [rdi + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x14017d378
cmp dword [rcx + rdi], 0x4550
jne 0x14017d378
lea rdx, [rdi + 0x88]
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x14017d378
cmp dword [rdx + 4], esi
je 0x14017d378
lea r8, [rdi + rax]
mov word [rsp + 0x20], si
lea r9, str.PowerWriteSecurityDescriptor
mov rcx, rdi
call fcn.140177a80
mov r8, qword [0x1402c5210]
jmp 0x14017d37b
mov rax, rsi
mov qword [0x1402c5220], rax
test r8, r8
je 0x14017d3fa
test rax, rax
je 0x14017d3fa
lea rdx, [rsp + 0x58]
xor ecx, ecx
mov rax, r8
call qword [case.0x14013b5a0.0]
nop dword [rax]
test eax, eax
je 0x14017d3b7
mov ecx, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
jmp sym.SystemInformer.exe_QiDosErrorToNtStatus
test rbp, rbp
je 0x14017d3c0
mov rsi, qword [rbp + 8]
mov rdx, qword [rsp + 0x58]
mov r8, rsi
mov rax, qword [0x1402c5220]
mov ecx, 0xe
call qword [case.0x14013b5a0.0]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
jmp sym.SystemInformer.exe_QiDosErrorToNtStatus
mov eax, 0xc000007a
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x60]
mov eax, 0xc0000135
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401805a0
Capabilities:
Map section object

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
mov dword [rsp + 0x48], 2
lea rax, [r11 + 0x20]
mov rbx, rdx
mov qword [r11 + 0x20], 1
xor edx, edx
lea r8, [r11 + 0x18]
mov dword [rsp + 0x40], edx
xor r9d, r9d
mov dword [rsp + 0x38], 2
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], rdx
mov qword [r11 - 0x38], rdx
mov qword [r11 + 0x18], rdx
lea rdx, [r9 - 1]
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jns 0x1401805fb
lfence
add rsp, 0x50
pop rbx
ret
mov rdx, qword [rsp + 0x70]
mov r8, rbx
mov rcx, 0xffffffffffffffff
call sym.SystemInformer.exe_QiGetProcessMappedFileName
mov rdx, qword ds:[rsp + 0x70]
mov rcx, 0xffffffffffffffff
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, ebx
add rsp, 0x50
pop rbx
ret

Function at 0x140183f60
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov ebx, edx
mov r12, rcx
mov r14d, edx
mov rdx, qword [0x1402c4f58]
mov edi, r8d
lea rcx, [rbx*8]
call sym.SystemInformer.exe_QiCreateObject
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov r15, rax
test ebx, ebx
je 0x1401840e9
mov qword [rsp + 0x40], rbp
mov ebp, edi
mov qword [rsp + 0x48], rsi
mov rsi, rax
shl rbp, 3
nop dword [rax + rax]
mov rdx, qword [0x1402c4f58]
mov rcx, rbp
call sym.SystemInformer.exe_QiCreateObject
cmp dword [0x1402baf40], 0xffffffff
mov rdi, rax
mov ecx, dword [0x1402c7eac]
jae 0x140183ffd
cmp ecx, 0x40
jae 0x140183ffd
lfence
mov rax, qword gs:[0x30]
mov rbx, qword [rax + rcx*8 + 0x1480]
jmp 0x140184009
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rdi, rdi
je 0x1401840c1
mov eax, dword [rbx]
cmp eax, 0x40
jae 0x140184025
mov qword [rbx + rax*8 + 8], rdi
inc dword [rbx]
jmp 0x1401840c1
mov rcx, qword [rbx + 0x210]
test rcx, rcx
jne 0x14018405b
lea edx, [rcx + 4]
mov dword [rbx + 0x20c], 0x40
mov rcx, qword [0x1402c5110]
mov r8d, 0x200
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rcx, rax
mov qword [rbx + 0x210], rax
mov eax, dword [rbx + 0x20c]
cmp dword [rbx + 0x208], eax
jne 0x1401840b1
add eax, eax
mov edx, 4
mov r9d, eax
shl r9, 3
mov dword [rbx + 0x20c], eax
test rcx, rcx
jne 0x140184097
mov rcx, qword [0x1402c5110]
mov r8, r9
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
jmp 0x1401840a7
mov r8, rcx
mov rcx, qword [0x1402c5110]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov rcx, rax
mov qword [rbx + 0x210], rax
mov eax, dword [rbx + 0x208]
mov qword [rcx + rax*8], rdi
inc dword [rbx + 0x208]
mov r8, rbp
mov qword [rsi], rdi
xor edx, edx
mov rcx, rdi
call fcn.140207110
add rsi, 8
sub r14, 1
jne 0x140183fc0
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov qword [r12], r15
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140186120
Capabilities:
Get user security identifier

Disassembly:
push r12
push r14
push r15
sub rsp, 0x60
movzx eax, word [rcx]
mov r15, r9
mov word [rsp + 0x38], ax
mov r14, r8
add ax, 2
mov r12, rdx
cmp qword [rcx], 0xfffe
mov word [rsp + 0x3a], ax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x40], rax
jbe 0x140186166
mov eax, 0xc0000106
add rsp, 0x60
pop r15
pop r14
pop r12
ret
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x50], r13
call fcn.140185c80
xor r13d, r13d
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x20], rcx
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x80], r13
lea r8d, [r13 + 1]
call qword [sym.imp.ADVAPI32.dll_LsaLookupNames2]
mov rdx, qword ds:[rsp + 0x80]
mov ebp, eax
test eax, eax
js 0x1401862e7
mov ecx, dword [rdx]
sub ecx, 7
cmp ecx, 1
jbe 0x1401862e2
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0x58], rdi
test r12, r12
je 0x140186231
mov rsi, qword [rdx + 8]
lea edx, [r13 + 4]
movzx ecx, byte [rsi + 1]
lea rdi, [rcx*4 + 8]
mov rcx, qword [0x1402c5110]
mov r8, rdi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8, rdi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.1402074d0
mov rdx, qword [rsp + 0x80]
mov qword [r12], rbx
test r14, r14
je 0x1401862c1
movsxd rax, dword ds:[rdx + 0x10]
test eax, eax
js 0x1401862b1
lea rdx, [rax + rax*2]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
lea rax, [rcx + rdx*8]
movzx ecx, word [rcx + rdx*8]
test cx, cx
jne 0x14018626d
nop
call sym.SystemInformer.exe_QiReferenceEmptyString
mov rbx, rax
mov qword [r14], rax
jmp 0x1401862b9
mov rdx, qword [0x1402c4fb8]
mov rdi, rcx
mov rsi, qword [rax + 8]
add rcx, 0x12
call sym.SystemInformer.exe_QiCreateObject
mov rbx, rax
mov qword [rax], rdi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rdi], r13w
test rsi, rsi
je 0x1401862ac
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.1402074d0
mov qword [r14], rbx
jmp 0x1401862b9
call sym.SystemInformer.exe_QiReferenceEmptyString
mov qword [r14], rax
mov rdx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x88]
test r15, r15
je 0x1401862e7
mov eax, dword [rdx]
mov dword [r15], eax
jmp 0x1401862e7
mov ebp, 0xc0000073
mov rcx, qword [rsp + 0x30]
mov r13, qword [rsp + 0x50]
test rcx, rcx
je 0x140186304
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140186312
mov rcx, rdx
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov eax, ebp
mov rbp, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop r12
ret
Function at 0x140186780
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rdi, rdx
test byte [0x1402c15b8], 1
mov rsi, rcx
mov dword [rsp + 0x60], ebx
jne 0x1401868c5
lock bts qword [0x1402c15b8], 0x1f
jae 0x1401867d9
test byte [0x1402c15b8], 1
nop dword [rax + rax]
jne 0x1401868c5
xor edx, edx
lea rcx, [0x1402c15b8]
call sym.SystemInformer.exe_QifWaitForEvent
jmp 0x1401868c5
lea r8, str.sechost.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x14018680f
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x14018680b
mov edx, ecx
shr rdx, 1
jmp 0x140186843
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x140186835
nop
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x140186820
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.1401776c0
mov rcx, rax
test rax, rax
je 0x1401868b2
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401868b2
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401868b2
cmp dword [rdx + rcx], 0x4550
jne 0x1401868b2
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401868b2
cmp dword [rdx + 4], ebx
je 0x1401868b2
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.LsaLookupUserAccountType
call fcn.140177a80
mov rbx, rax
lea rcx, [0x1402c15b8]
mov qword [0x1402c9030], rbx
call sym.SystemInformer.exe_QifSetEvent
mov rax, qword [0x1402c9030]
test rax, rax
jne 0x1401868e6
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [case.0x14013b5a0.0]
test eax, eax
js 0x1401868fe
mov ecx, dword [rsp + 0x60]
mov dword [rdi], ecx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140187da0
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
call fcn.140185ba0
mov edx, dword [rbx + 2]
cmp edx, dword [rax + 2]
jne 0x140187eb2
movzx edx, word [rbx + 6]
cmp dx, word [rax + 6]
jne 0x140187eb2
cmp dword ds:[rbx + 8], 1
jne 0x140187eb2
mov eax, dword [rbx + 0xc]
lea rcx, [rsp + 0x28]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x10]
mov dword [rsp + 0x2c], eax
mov eax, dword [rbx + 0x14]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x34], eax
call sym.SystemInformer.exe_QiFormatGuid
mov rbx, rax
test rax, rax
je 0x140187eb2
mov rdx, qword [0x1402c4fb8]
mov qword [rsp + 0x58], rbp
mov rbp, qword [rax + 8]
mov qword [rsp + 0x60], rsi
mov rsi, qword [rax]
and rsi, 0xfffffffffffffffe
mov qword [rsp + 0x68], rdi
sub rsi, 4
lea rcx, [rsi + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rsi
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rsi], ax
add rbp, 2
je 0x140187e75
mov rcx, qword [rdi + 8]
mov r8, rsi
mov rdx, rbp
call fcn.1402074d0
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
cmp eax, 1
jne 0x140187e97
call fcn.14013fb00
mov rax, rdi
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401e0100
add rsp, 0x40
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401e0100
add rsp, 0x40
pop rbx
ret

Function at 0x140189180
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x60
xor r8d, r8d
mov qword [rsp + 0x28], 0
mov rbx, rdx
mov qword [rsp + 0x20], 0x30
mov rdx, rcx
lea r9, [rsp + 0x30]
lea rcx, [r8 - 1]
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
test eax, eax
js 0x14018920d
mov rdx, qword ds:[rsp + 0x38]
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14018920d
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14018920d
mov r8, qword [rax + rdx + 0xe8]
mov rcx, r8
shr rcx, 0x20
test r8d, r8d
je 0x14018920d
test ecx, ecx
je 0x14018920d
mov eax, r8d
add rax, rdx
cmp rbx, rax
jb 0x14018920d
add ecx, r8d
add rcx, rdx
cmp rbx, rcx
jae 0x14018920d
mov al, 1
add rsp, 0x60
pop rbx
ret
xor al, al
add rsp, 0x60
pop rbx
ret

Function at 0x140189480
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [0x1402c9048]
test rbx, rbx
je 0x1401894fd
mov qword [rsp + 0x58], rdi
xor edi, edi
nop dword [rax]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], edi
mov r9d, 0x20
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x48]
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x48], 0x10000
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov r8d, 0x10000
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtFlushInstructionCache]
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1401894a0
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbx
ret
Function at 0x140189520
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x60
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x140189542
sub rbx, rax
add rbx, 0x10000
mov qword [rsp + 0x80], rsi
cmp rbx, rdi
jae 0x14018963e
xor esi, esi
nop word [rax + rax]
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x14018957b
add rbx, 0x8000000
jmp 0x140189635
xorps xmm0, xmm0
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0x30]
mov rdx, rbx
movups xmmword [rsp + 0x30], xmm0
lea rcx, [r8 - 1]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
test eax, eax
js 0x14018963e
cmp dword [rsp + 0x50], 0x10000
mov rcx, qword [rsp + 0x48]
jne 0x14018961a
cmp rcx, 0x10000
jb 0x14018961a
xor r8d, r8d
mov dword [rsp + 0x28], 0x40
lea r9, [rsp + 0x78]
mov qword [rsp + 0x78], 0x10000
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x20], 0x3000
lea rcx, [r8 - 1]
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jns 0x140189656
cmp eax, 0xc0000604
je 0x14018963e
add rbx, 0x10000
jmp 0x140189635
mov rbx, qword [rsp + 0x30]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x140189635
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x140189560
xor eax, eax
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
mov rax, qword [rsp + 0x70]
jmp 0x140189640

Function at 0x140189660
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x14018977f
xor esi, esi
nop dword [rax]
nop dword [rax + rax]
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x1401896bb
sub rbx, 0x8000000
jmp 0x140189776
xorps xmm0, xmm0
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0x30]
mov rdx, rbx
movups xmmword [rsp + 0x30], xmm0
lea rcx, [r8 - 1]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
test eax, eax
js 0x14018977f
cmp dword [rsp + 0x50], 0x10000
jne 0x14018975a
cmp qword [rsp + 0x48], 0x10000
jb 0x14018975a
xor r8d, r8d
mov dword [rsp + 0x28], 0x40
lea r9, [rsp + 0x78]
mov qword [rsp + 0x78], 0x10000
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x20], 0x3000
lea rcx, [r8 - 1]
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jns 0x140189793
cmp eax, 0xc0000604
je 0x14018977f
sub rbx, 0x10000
jmp 0x140189776
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x1401896a0
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rax, qword [rsp + 0x70]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140190640
Capabilities:
Get file attributes

Disassembly:
push rsi
sub rsp, 0x80
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rdx
mov dword [rsp + 0x30], 0x60
mov rdx, rcx
mov dword [rsp + 0x28], 1
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x20], 5
mov r9d, 0x80
mov r8d, 0x120089
call sym.SystemInformer.exe_QiCreateFile
test eax, eax
jns 0x140190698
lfence
jmp 0x14019073c
mov qword [rsp + 0xa8], rdi
lea r8, [rsp + 0x60]
mov rdi, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov rcx, rdi
mov dword [rsp + 0x20], 5
mov r9d, 0x18
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x1401906ed
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsp + 0x48], xmm0
cmp qword [rsp + 0x50], 0
jne 0x1401906ed
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, 0xc0000011
jmp 0x140190734
mov rdx, rdi
mov qword [rsp + 0xa0], rbx
call fcn.1401d6330
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtClose]
test rbx, rbx
je 0x140190727
cmp dword [rbx], 0
jne 0x14019071f
test rsi, rsi
je 0x14019071b
mov qword [rsi], rbx
xor eax, eax
jmp 0x14019072c
mov rcx, rbx
call fcn.1401d5cc0
mov eax, 0xc0000102
mov rbx, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401e0100
add rsp, 0x80
pop rsi
ret
Function at 0x140191ce0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x28
mov r9, rcx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], r8
cmp r8, 0x40
jae 0x140191cff
mov eax, 0xc000001f
add rsp, 0x28
ret
lea rax, [rdx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140191e12
lea rcx, [rdx + 0x40]
cmp rcx, rdx
jb 0x140191e04
lea rax, ds:[rdx + r8]
cmp rcx, rax
ja 0x140191e04
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x140191d3d
mov eax, 0xc000012f
add rsp, 0x28
ret
lfence
movsxd rax, dword [rdx + 0x3c]
cmp rax, r8
jae 0x140191dfa
cmp rax, 0x10000000
jae 0x140191dfa
add rdx, rax
mov rcx, qword [r9 + 0x10]
mov rax, qword [r9 + 8]
lea r10, [rdx + 0x18]
cmp r10, rdx
jb 0x140191dec
cmp rdx, rax
jb 0x140191dec
lea r8, [rax + rcx]
cmp r10, r8
ja 0x140191dec
movzx eax, word [rdx + 6]
lea rcx, [rax + rax*4]
movzx eax, word [rdx + 0x14]
lea rax, [rax + rcx*8]
add rax, 0x18
add rax, rdx
cmp rax, rdx
jb 0x140191de1
cmp rax, r8
ja 0x140191de1
cmp dword [rdx], 0x4550
jne 0x140191dfa
movzx eax, word [r10]
mov word [r9 + 0x30], ax
mov ecx, 0x10b
sub ax, cx
mov ecx, 0xfeff
test cx, ax
jne 0x140191dfa
mov qword [r9 + 0x18], rdx
movzx eax, word [rdx + 6]
mov dword [r9 + 0x20], eax
movzx ecx, word [rdx + 0x14]
add rcx, 0x18
add rcx, rdx
mov qword [r9 + 0x28], rcx
xor eax, eax
add rsp, 0x28
ret
mov ecx, 0xc0000005
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
mov ecx, 0xc0000005
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
nop
jmp 0x140191e17
mov eax, 0xc000007b
add rsp, 0x28
ret
mov ecx, 0xc0000005
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
nop
jmp 0x140191e17
mov eax, 0xc000000d
add rsp, 0x28
ret
Function at 0x140191e20
Capabilities:
Get file attributes
Map section object

Disassembly:
push rsi
push rdi
push r12
push r15
sub rsp, 0xc8
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor r15b, r15b
mov qword [rsp + 0x70], rdx
xor r12d, r12d
mov rsi, r8
mov rdi, rdx
test rdx, rdx
jne 0x140191eb5
test rcx, rcx
jne 0x140191e65
mov eax, 0xc0000030
jmp 0x140192024
mov qword ss:[rsp + 0x40], r12
mov rdx, rcx
mov dword [rsp + 0x38], 0x60
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x30], 1
xor r9d, r9d
mov dword [rsp + 0x28], 1
mov r8d, 0x100081
mov dword [rsp + 0x20], 0x80
call sym.SystemInformer.exe_QiCreateFileWin32Ex
test eax, eax
js 0x140192024
mov rdi, qword [rsp + 0x70]
mov r15b, 1
mov qword [rsp + 0xc0], rbx
lea r8, [rsp + 0x88]
mov qword [rsp + 0xb8], rbp
lea rdx, [rsp + 0x70]
mov r9d, 0x18
mov qword [rsp + 0xb0], r14
mov rcx, rdi
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x140191fb6
movups xmm0, xmmword [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
lea r9, [rsp + 0x58]
movups xmmword [rsp + 0x70], xmm0
mov rax, qword [rsp + 0x78]
lea rcx, [rsp + 0x60]
lea edx, [r8 + 5]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 2
call qword [sym.imp.ntdll.dll_NtCreateSection]
mov ebx, eax
test eax, eax
js 0x140191fb6
mov rax, qword [rsp + 0x58]
lea r8, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x50], rax
lea rdx, [r9 - 1]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov rcx, qword ds:[rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140191fb6
mov rbp, qword [rsp + 0x68]
mov r14, qword [rsp + 0x58]
jmp 0x140191fc0
mov rbp, qword [rsp + 0x50]
mov r14, qword [rsp + 0x50]
test r15b, r15b
je 0x140191fce
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x14019200a
mov r8, r14
mov rdx, rbp
mov rcx, rsi
call fcn.140191ce0
mov ebx, eax
test eax, eax
jns 0x14019200c
cmp qword [rsi + 8], r12
je 0x14019200c
lfence
mov rdx, qword [rsi + 8]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov qword [rsi + 8], r12
mov eax, ebx
mov rbp, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401e0100
add rsp, 0xc8
pop r15
pop r12
pop rdi
pop rsi
ret
Function at 0x140192060
Capabilities:
Get file attributes
Map section object

Disassembly:
push rdi
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor r15b, r15b
mov qword [rsp + 0x70], rdx
mov rdi, r8
mov r14, rdx
test rdx, rdx
jne 0x1401920e6
test rcx, rcx
jne 0x1401920a5
mov eax, 0xc0000030
jmp 0x1401922a4
mov dword [rsp + 0x30], 0x60
mov rdx, rcx
mov dword [rsp + 0x28], 1
lea rcx, [rsp + 0x70]
mov r9d, 0x80
mov dword [rsp + 0x20], 1
mov r8d, 0x100081
call sym.SystemInformer.exe_QiCreateFile
test eax, eax
js 0x1401922a4
mov r14, qword [rsp + 0x70]
mov r15b, 1
mov qword [rsp + 0xc8], rbx
lea r8, [rsp + 0x88]
mov qword [rsp + 0xc0], rbp
lea rdx, [rsp + 0x70]
mov qword [rsp + 0xb8], rsi
mov r9d, 0x18
mov rcx, r14
mov qword [rsp + 0xb0], r12
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
xor r12d, r12d
mov esi, eax
test eax, eax
js 0x1401921f6
movups xmm0, xmmword [rsp + 0x88]
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x58]
mov dword [rsp + 0x28], 0x8000000
lea edx, [r12 + 5]
movups xmmword [rsp + 0x70], xmm0
mov rax, qword [rsp + 0x78]
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 2
call qword [sym.imp.ntdll.dll_NtCreateSection]
mov esi, eax
test eax, eax
js 0x1401921f6
mov rax, qword [rsp + 0x58]
lea r8, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
lea rdx, [r12 - 1]
mov dword [rsp + 0x48], 2
xor r9d, r9d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x68], r12
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov rcx, qword ds:[rsp + 0x60]
mov esi, eax
call qword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x1401921f6
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
jmp 0x140192200
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x50]
test r15b, r15b
je 0x14019220e
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x140192282
movzx eax, word [rbx]
mov ecx, 0x457f
mov word [rdi], ax
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbp
cmp ax, cx
je 0x14019224b
mov ecx, 0x5a4d
cmp ax, cx
je 0x14019223b
mov ebx, 0xc00001a3
jmp 0x14019225f
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.140191ce0
jmp 0x140192259
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.1401da080
mov ebx, eax
test eax, eax
jns 0x14019227e
nop
cmp qword [rdi + 8], r12
je 0x14019227e
lfence
mov rdx, qword [rdi + 8]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov qword [rdi + 8], r12
mov eax, ebx
jmp 0x140192284
mov eax, esi
mov rsi, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401e0100
add rsp, 0xd0
pop r15
pop r14
pop rdi
ret