joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007b6d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1400f5480]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [r9 + 0x10]
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov r15, rcx
cmp rbx, 0x20
ja 0x14007b7c4
xor r12d, r12d
nop dword [rax + rax]
mov r10, qword [rdi + 8]
mov r9, r12
test rbx, rbx
je 0x14007b758
lea rax, [rsp + 0x20]
sub r10, rax
nop dword [rax]
nop dword [rax + rax]
lea r8, [rsp + 0x20]
mov ecx, 0x20
add r8, r9
movzx edx, byte [r10 + r8]
lea eax, [rdx - 0x41]
cmp al, 0x19
cmova ecx, r12d
inc r9
xor cl, dl
mov byte [r8], cl
cmp r9, rbx
jb 0x14007b730
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14007af40
mov dword [rsi], eax
test eax, eax
jne 0x14007b781
mov rax, qword [r15]
lea rdx, [rsp + 0x20]
mov r8, rbx
movzx ecx, byte [rax + 0x48]
call fcn.1400844b0
mov dword [rsi], eax
cmp dword [rsi], r12d
jne 0x14007b7ec
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14007b410
test eax, eax
je 0x14007b7c4
mov ecx, dword [r14]
test eax, ecx
jne 0x14007b7e5
or ecx, eax
xor r8d, r8d
mov dword [r14], ecx
mov rdx, rdi
lea rcx, [r15 + 8]
call fcn.140084a40
cmp al, 2
jne 0x14007b7c4
mov rbx, qword [rdi + 0x10]
cmp rbx, 0x20
jbe 0x14007b710
mov eax, 0x1a
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008f0b0
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 0x37
jmp 0x14007b7c9
xor r8d, r8d
lea rcx, [r15 + 8]
mov rdx, rdi
call fcn.140084a40
cmp al, 2
jne 0x14007b863
mov rdx, qword [rdi + 0x10]
cmp rdx, 0x20
ja 0x14007b863
mov r11, qword [rdi + 8]
mov r10, r12
test rdx, rdx
je 0x14007b84a
lea rax, [rsp + 0x20]
sub r11, rax
nop dword [rax]
lea r9, [rsp + 0x20]
mov ecx, 0x20
add r9, r10
movzx r8d, byte [r11 + r9]
lea eax, [r8 - 0x41]
cmp al, 0x19
cmova ecx, r12d
inc r10
xor cl, r8b
mov byte [r9], cl
cmp r10, rdx
jb 0x14007b820
lea rcx, [rsp + 0x20]
call fcn.14007b410
cmp eax, 0x10
jne 0x14007b863
or dword [r14], eax
xor eax, eax
jmp 0x14007b7c9
mov rax, qword [rdi + 8]
mov qword [r15 + 0x18], rax
xor eax, eax
jmp 0x14007b7c9
Function at 0x14008cd68
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14008cda2
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14008cda7
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14008cdf0
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400d77c0]
cmp byte [rcx + rax], 0
je 0x14008cdf0
dec r8
sub rdx, 1
jne 0x14008cdd6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14008fa1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14008fa66
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14008fa66
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14008fa66
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008fa66
cmp dword [rcx + 0x84], 0xe
jbe 0x14008fa66
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14008fa68
xor al, al
add rsp, 0x28
ret

Function at 0x14009f5d8
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14009f46b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14009f46b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14009f46b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14009f46b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14009f46b
cmp dword [rcx + 0x84], 0xe
jbe 0x14009f46b
cmp dword [rcx + 0xf8], 0
je 0x14009f46b
mov ecx, ebx
call fcn.14009f50c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14009f2fc
cmp dword [rbp + 0x20], 0
je 0x14009f4b8
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14009f4c0
int3
xor r8d, r8d
xor edx, edx
jmp 0x14009f404
Function at 0x1400b2da0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400b2dc8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400b2dc8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400014c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x870
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x880]
mov rax, qword [rax + 0x28]
mov eax, dword [rax + 0x68]
or eax, 0x20
mov rcx, qword [rsp + 0x880]
mov rcx, qword [rcx + 0x28]
mov dword [rcx + 0x68], eax
mov rax, qword [rsp + 0x888]
mov qword [rsp + 0x888], rax
call fcn.1400013d0
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140001532
jmp 0x14000162c
xor edx, edx
lea rcx, [0x140001380]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutineEx]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140001551
jmp 0x14000162c
lea rcx, [0x1400013b0]
call qword [sym.imp.ntoskrnl.exe_PsSetLoadImageNotifyRoutine]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14000156e
jmp 0x14000162c
lea rcx, [0x140001460]
call qword [sym.imp.ntoskrnl.exe_PsSetCreateThreadNotifyRoutine]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14000158b
jmp 0x14000162c
mov rcx, qword [rsp + 0x880]
call section..text
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400015b6
mov edx, dword [rsp + 0x20]
lea rcx, [0x140004f40]
call fcn.14000169f
nop
jmp 0x14000162c
mov rax, qword [rsp + 0x880]
lea rcx, [fcn.140001310]
mov qword [rax + 0x68], rcx
mov rcx, qword [rsp + 0x880]
call fcn.1400021c0
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x830
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 1
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov dword [rsp + 0x838], eax
mov byte [rsp + 0x83c], 1
mov byte [rsp + 0x83d], 1
mov byte [rsp + 0x83e], 0
lea rcx, [rsp + 0x30]
call fcn.14000c460
mov dword [rsp + 0x20], eax
xor eax, eax
test eax, eax
jne 0x14000151d
cmp dword [rsp + 0x20], 0
je 0x140001641
mov rcx, qword [rsp + 0x880]
call fcn.140001310
nop
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.140001670
add rsp, 0x870
pop rdi
ret
Function at 0x1400026a0
Capabilities:
Access pe header
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x30], 0xc0000001
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1400027a0
mov dword [rsp + 0x44], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x18]
cmp eax, 0x10b
jne 0x140002703
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0x34], eax
jmp 0x14000270f
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x14000279e
mov rdi, qword [rsp + 0x70]
xor eax, eax
mov rcx, qword [rsp + 0x48]
rep stosb byte [rdi], al
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x44]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
mov dword [rsp + 0x30], eax
lea r9, [0x140005010]
lea r8, [0x140005020]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
nop
jmp 0x1400027c4
mov dword [rsp + 0x30], 0xc000000d
lea r9, [0x140005010]
lea r8, [0x140005050]
xor edx, edx
mov ecx, 0x4d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
nop
jmp 0x1400027ee
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140001670
add rsp, 0x60
pop rdi
ret
Function at 0x140004600
Capabilities:
Access pe header

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x48], 0
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140004663
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x24], eax
jmp 0x1400047fe
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x18]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x10b
je 0x140004686
cmp dword [rsp + 0x30], 0x20b
je 0x140004695
jmp 0x1400046a5
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x34]
mov qword [rsp + 0x40], rax
jmp 0x1400046b5
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x40], rax
jmp 0x1400046b5
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x24], eax
jmp 0x1400047fe
lea r9, [rsp + 0x60]
mov r8w, 5
mov dl, 1
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlImageDirectoryEntryToData]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400046e3
cmp dword [rsp + 0x60], 0
jne 0x140004718
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x16]
and eax, 1
test eax, eax
je 0x140004700
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x34], eax
jmp 0x14000470b
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x24], eax
jmp 0x1400047fe
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
sub rcx, rax
mov rax, rcx
add rax, qword [rsp + 0x88]
mov qword [rsp + 0x50], rax
cmp dword [rsp + 0x60], 0
je 0x1400047f3
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 4]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x140004766
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x24], eax
jmp 0x1400047fe
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x60]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x20]
sub rax, 8
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
xor edx, edx
mov ecx, 2
div rcx
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
add rax, 8
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
call fcn.140004350
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400047ee
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x24], eax
jmp 0x1400047fe
jmp 0x140004738
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140001670
add rsp, 0x78
ret
Function at 0x14000b70c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
and dword [rsp + 0x30], 0
lea rax, [r11 - 0x28]
mov rdi, r9
mov qword [r11 - 0x30], rax
mov ebx, r8d
mov dword [rsp + 0x20], 0x10
lea r9, [r11 - 0x20]
mov r8d, 2
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
nop dword [rax + rax]
test eax, eax
js 0x14000b76e
cmp dword [rsp + 0x3c], 4
jne 0x14000b769
mov ebx, dword [rsp + 0x44]
jmp 0x14000b76e
mov eax, 0xc0000024
mov dword [rdi], ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001670
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x14000b78c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r14, qword [rsp + 0x80]
mov esi, r8d
and dword [rsp + 0x78], 0
mov rbp, rdx
mov r12, rcx
and qword [r14], 0
movzx eax, word [rdx]
add eax, 0x1f
and eax, 0xfffffff8
lea edi, [rax + r9]
cmp edi, eax
jb 0x14000b8f8
mov r8d, 0x62527050
mov edx, edi
mov ecx, 0x200
mov r15d, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14000b8f1
mov r8d, r15d
xor edx, edx
mov rcx, rax
call fcn.140004cc0
lea rax, [rsp + 0x78]
mov r15d, 1
mov qword [rsp + 0x28], rax
mov r9, rbx
mov r8d, r15d
mov dword [rsp + 0x20], edi
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jns 0x14000b8c6
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
nop dword [rax + rax]
cmp edi, 0x80000005
je 0x14000b864
cmp edi, 0xc0000023
je 0x14000b864
mov eax, edi
jmp 0x14000b8fd
mov edx, dword [rsp + 0x78]
mov ecx, 0x200
mov r8d, 0x62527050
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14000b8f1
mov r8d, dword [rsp + 0x78]
xor edx, edx
mov rcx, rax
call fcn.140004cc0
lea rax, [rsp + 0x78]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov r8d, r15d
mov eax, dword [rsp + 0x78]
mov rdx, rbp
mov rcx, r12
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x14000b8d4
test esi, esi
je 0x14000b8ea
cmp dword [rbx + 4], esi
je 0x14000b8ea
mov edi, 0xc0000024
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
nop dword [rax + rax]
jmp 0x14000b85d
mov qword [r14], rbx
xor eax, eax
jmp 0x14000b8fd
mov eax, 0xc000009a
jmp 0x14000b8fd
mov eax, 0xc0000095
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14000b918
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
xorps xmm0, xmm0
mov rbp, rdx
movzx edx, word [r8]
mov rdi, r8
movups xmmword [rax - 0x18], xmm0
movzx eax, word [r8 + 2]
mov r14, rcx
sub rax, rdx
cmp rax, 2
jb 0x14000b98e
mov rax, qword [r8 + 8]
xor esi, esi
shr rdx, 1
lea r9d, [rsi + 1]
mov word [rax + rdx*2], si
mov rdx, rbp
movzx eax, word [r8]
add eax, 2
mov dword [rsp + 0x28], eax
mov rax, qword [r8 + 8]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
nop dword [rax + rax]
mov ebx, eax
jmp 0x14000ba0b
lea rcx, [rsp + 0x30]
call fcn.14000bbe8
xor esi, esi
mov ebx, eax
test eax, eax
js 0x14000ba0b
movzx r8d, word [rdi]
mov rdx, qword [rdi + 8]
mov rcx, qword [rsp + 0x38]
mov word [rsp + 0x30], r8w
call fcn.140004a00
mov rax, qword [rsp + 0x38]
lea r9d, [rsi + 1]
movzx ecx, word [rsp + 0x30]
xor r8d, r8d
shr rcx, 1
mov rdx, rbp
mov word [rax + rcx*2], si
mov rcx, r14
movzx eax, word [rsp + 0x30]
add eax, 2
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
nop dword [rax + rax]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14000badc
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
xorps xmm0, xmm0
lea rcx, [rax - 0x18]
mov rbx, r9
movups xmmword [rax - 0x18], xmm0
mov edi, r8d
call fcn.140001ca8
test eax, eax
js 0x14000bb30
mov eax, dword [rsp + 0x70]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov r9d, edi
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14000c210
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x88
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0x1000
mov byte [rsp + 0x50], 0x68
mov byte [rsp + 0x51], 0
mov byte [rsp + 0x52], 0
mov byte [rsp + 0x53], 0
mov byte [rsp + 0x54], 0
mov byte [rsp + 0x55], 0x68
mov byte [rsp + 0x56], 0
mov byte [rsp + 0x57], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x59], 0
mov byte [rsp + 0x5a], 0x6a
mov byte [rsp + 0x5b], 0
mov byte [rsp + 0x5c], 0x6a
mov byte [rsp + 0x5d], 0
mov byte [rsp + 0x5e], 0xe8
mov byte [rsp + 0x5f], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x61], 0
mov byte [rsp + 0x62], 0
mov byte [rsp + 0x63], 0xba
mov byte [rsp + 0x64], 0
mov byte [rsp + 0x65], 0
mov byte [rsp + 0x66], 0
mov byte [rsp + 0x67], 0
mov byte [rsp + 0x68], 0xc7
mov byte [rsp + 0x69], 2
mov byte [rsp + 0x6a], 0x7e
mov byte [rsp + 0x6b], 0x1e
mov byte [rsp + 0x6c], 0x37
mov byte [rsp + 0x6d], 0xc0
mov byte [rsp + 0x6e], 0xba
mov byte [rsp + 0x6f], 0
mov byte [rsp + 0x70], 0
mov byte [rsp + 0x71], 0
mov byte [rsp + 0x72], 0
mov byte [rsp + 0x73], 0x89
mov byte [rsp + 0x74], 2
mov byte [rsp + 0x75], 0xc2
mov byte [rsp + 0x76], 4
mov byte [rsp + 0x77], 0
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x14000c440
mov rax, qword [rsp + 0x40]
add rax, 0x200
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0xa8]
movzx ecx, word [rcx]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0xa8]
movzx ecx, word [rcx + 2]
mov word [rax + 2], cx
mov rax, qword [rsp + 0x40]
add rax, 0x210
mov rcx, qword [rsp + 0x38]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0xa8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 4]
mov rdx, qword [rsp + 0xa8]
mov edi, ecx
mov rsi, qword [rdx + 8]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x50]
mov rdi, qword [rsp + 0x40]
mov rsi, rax
mov ecx, 0x28
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x40]
add rax, 0x5e0
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x38]
mov dword [rax + 6], ecx
mov rax, qword [rsp + 0x40]
add rax, 0xf
mov rcx, qword [rsp + 0xa0]
sub rcx, rax
mov rax, rcx
sub rax, 4
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0xf], eax
mov rax, qword [rsp + 0x40]
add rax, 0x5e8
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0x14], eax
mov rax, qword [rsp + 0x40]
add rax, 0x5ec
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0x1f], eax
mov rax, qword [rsp + 0x40]
jmp 0x14000c442
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140001670
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x14000f320
Capabilities:
Inspect section memory permissions

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x18
mov dword [rsp], 1
mov eax, dword [rsp + 0x20]
and eax, 0x2000000
test eax, eax
je 0x14000f34c
mov dword [rsp], 1
jmp 0x14000f416
mov eax, dword [rsp + 0x20]
and eax, 0x20000000
test eax, eax
je 0x14000f3e3
mov eax, dword [rsp + 0x20]
and eax, 0x80000000
test eax, eax
je 0x14000f38e
movzx eax, byte [rsp + 0x28]
test eax, eax
je 0x14000f37d
mov dword [rsp + 4], 4
jmp 0x14000f385
mov dword [rsp + 4], 0x40
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x14000f3e1
mov eax, dword [rsp + 0x20]
and eax, 0x40000000
test eax, eax
je 0x14000f3bf
movzx eax, byte [rsp + 0x28]
test eax, eax
je 0x14000f3ae
mov dword [rsp + 8], 2
jmp 0x14000f3b6
mov dword [rsp + 8], 0x20
mov eax, dword [rsp + 8]
mov dword [rsp], eax
jmp 0x14000f3e1
movzx eax, byte [rsp + 0x28]
test eax, eax
je 0x14000f3d2
mov dword [rsp + 0xc], 2
jmp 0x14000f3da
mov dword [rsp + 0xc], 0x10
mov eax, dword [rsp + 0xc]
mov dword [rsp], eax
jmp 0x14000f416
mov eax, dword [rsp + 0x20]
and eax, 0x80000000
test eax, eax
je 0x14000f3f9
mov dword [rsp], 4
jmp 0x14000f416
mov eax, dword [rsp + 0x20]
and eax, 0x40000000
test eax, eax
je 0x14000f40f
mov dword [rsp], 2
jmp 0x14000f416
mov dword [rsp], 1
mov eax, dword [rsp]
add rsp, 0x18
ret
Function at 0x14000f420
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14000f58c
mov dword [rsp + 0x58], 0
lea r9, [rsp + 0x58]
mov r8w, 0xa
mov dl, 1
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlImageDirectoryEntryToData]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14000f58a
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x14000f4b2
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x38], rax
jmp 0x14000f4bf
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000f58a
mov rax, qword [rsp + 0x80]
shr rax, 0x20
mov ecx, dword [rsp + 0x80]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
lea rcx, [rsp + 0x5c]
call qword [sym.imp.ntoskrnl.exe_RtlRandomEx]
mov eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x14000f552
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x14000f536
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x40], rax
jmp 0x14000f543
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
jmp 0x14000f58a
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x14000f572
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x58]
mov qword [rsp + 0x48], rax
jmp 0x14000f57f
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x3c]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x50]
mov dword [rax], ecx
jmp 0x14000f594
mov dword [rsp + 0x28], 0xc000007b
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140001670
add rsp, 0x78
ret