joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004e2b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14004e2d2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14004e2e8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14004e304
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14004e306
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x14004e340
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14004e3e7
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x14004e37b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x14004e3c1
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x14004e400
cmp rbx, rax
ja 0x14004e390
mov r8, rdi
test rdi, rdi
je 0x14004e3e7
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x14004e3ea
Function at 0x14004e7e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14004e80d
xor eax, eax
jmp 0x14004e962
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x14004e838
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x14004e838
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14004e962
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14004e955
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14004e87b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14004e8a6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004e95a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004e915
sub eax, 1
je 0x14004e915
cmp eax, 2
jne 0x14004e955
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004e95a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14004e943
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14004e955
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14004e95a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14010ea20
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14004ed20
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14004edf3
cmp byte [rcx + 0x71], 0
je 0x14004edf3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14004edef
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004edb4
sub eax, 1
je 0x14004edb8
cmp eax, 2
jne 0x14004edef
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010ea20
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14004ede6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14004edef
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14004ed9c
xor al, al
jmp 0x14004ed9c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010ea20
add rsp, 0x60
pop rbx
ret
Function at 0x14004fb10
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rdx
xor edi, edi
mov dword [rsp + 0x20], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
lea ecx, [rdi + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14004fbf0
nop dword [rax]
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov r9, rcx
mov rdx, qword [rsp + 0x28]
sub r9, rdx
cmp r8, r9
jae 0x14004fb95
lea rcx, [r8 + rdx]
mov qword [rsp + 0x30], rcx
jmp 0x14004fbd3
jbe 0x14004fbd3
mov rax, qword [rsp + 0x38]
sub rax, rdx
cmp r8, rax
jbe 0x14004fbb8
mov rdx, r8
lea rcx, [rsp + 0x28]
call fcn.140050100
mov rcx, qword [rsp + 0x30]
jmp 0x14004fbce
sub r8, r9
lea rbx, [rcx + r8]
xor edx, edx
call fcn.14010faca
mov rcx, rbx
mov qword [rsp + 0x30], rbx
mov rdx, qword [rsp + 0x28]
sub rcx, rdx
lea r9, [rsp + 0x20]
mov r8d, ecx
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14004fb70
mov r11, qword [rsp + 0x28]
test eax, eax
js 0x14004fc4e
lea r9, [r11 + 8]
mov r10d, edi
mov ebx, dword [r11]
test ebx, ebx
je 0x14004fc4e
nop word [rax + rax]
movzx r8d, word [r9 + 0x26]
add r8, 0x28
add r8, r9
mov rax, rsi
sub r8, rsi
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14004fc35
inc rax
test ecx, ecx
jne 0x14004fc22
test edx, edx
je 0x14004fc4a
inc r10d
add r9, 0x128
cmp r10d, ebx
jb 0x14004fc10
jmp 0x14004fc4e
mov rdi, qword [r9 + 0x10]
test r11, r11
je 0x14004fc8b
mov rdx, qword [rsp + 0x38]
sub rdx, r11
mov rax, r11
cmp rdx, 0x1000
jb 0x14004fc83
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004fc83
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r11
call fcn.14010efc8
mov rax, rdi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010ea20
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14004fcc0
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov r14, r8
mov rbp, rdx
mov rdx, r14
lea r8, [rsp + 0x30]
mov r9d, 0x40
mov rdi, rcx
call fcn.14004fe80
mov eax, 0x5a4d
cmp word [rsp + 0x30], ax
jne 0x14004fe6e
movsxd rdx, dword [rsp + 0x6c]
lea r8, [rsp + 0x70]
add rdx, r14
mov r9d, 0x108
mov rcx, rdi
call fcn.14004fe80
cmp dword [rsp + 0x70], 0x4550
jne 0x14004fe6e
mov eax, 0x20b
cmp word [rsp + 0x88], ax
jne 0x14004fe6e
mov rbx, qword [rsp + 0xf8]
xor ecx, ecx
mov rdx, rbx
mov qword [rsp + 0x20], rbx
shr rdx, 0x20
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13d, dword [rsp + 0x24]
mov rcx, rdi
mov r15d, ebx
mov r9d, r13d
mov r8, rax
mov rsi, rax
lea rdx, [r15 + r14]
call fcn.14004fe80
test rsi, rsi
je 0x14004fe6e
mov r10d, dword [rsi + 0x20]
mov r11, rsi
mov edi, dword [rsi + 0x24]
sub r11, r15
mov ebx, dword [rsi + 0x18]
add r10, r11
mov qword [rsp + 0x1d8], r12
add rdi, r11
mov r12d, dword [rsi + 0x1c]
xor r9d, r9d
add r12, r11
test rbx, rbx
je 0x14004fe03
nop word [rax + rax]
mov r8d, dword [r10]
mov rax, rbp
add r8, r11
sub r8, rbp
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14004fdf3
inc rax
test ecx, ecx
jne 0x14004fde0
test edx, edx
je 0x14004fe40
inc r9
add r10, 4
cmp r9, rbx
jb 0x14004fdd0
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov r12, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14010ea20
add rsp, 0x190
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
movzx eax, word [rdi + r9*2]
mov ebx, dword [r12 + rax*4]
cmp rbx, r15
jb 0x14004fe57
lea rax, [r15 + r13]
cmp rbx, rax
jbe 0x14004fe03
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rax, [r14 + rbx]
jmp 0x14004fe16
xor eax, eax
jmp 0x14004fe1e
Function at 0x140050260
Capabilities:
Parse pe header
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x38], rdx
xor r15d, r15d
mov qword [rcx], r15
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], r15
mov qword [rcx + 0x20], r15
mov qword [rcx + 0x28], r15
cmp rcx, rdx
je 0x140050313
mov r14, qword [rdx + 8]
mov rbp, qword [rdx]
sub r14, rbp
mov edx, r15d
sub rdx, r15
cmp r14, rdx
jbe 0x1400502fa
movabs rbx, 0x7fffffffffffffff
cmp r14, rbx
ja 0x1400503ea
mov r8, rdx
shr r8, 1
mov rax, rbx
sub rax, r8
cmp rdx, rax
ja 0x1400502f2
lea rbx, [r8 + rdx]
cmp rbx, r14
cmovb rbx, r14
mov rdx, rbx
call fcn.1400507d0
mov rbx, qword [rdi]
mov r8, r14
mov rdx, rbp
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [r14 + rbx]
mov qword [rdi + 8], rax
mov rcx, qword [rdi]
mov qword [rdi + 0x30], rcx
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
mov qword [rdi + 0x38], rdx
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400503ad
cmp dword [rdx], 0x4550
jne 0x1400503ad
mov eax, 0x20b
cmp word [rdx + 0x18], ax
jne 0x1400503ad
mov rcx, qword [rsi]
test rcx, rcx
je 0x140050382
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140050372
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400503a6
mov rcx, r8
call fcn.14010efc8
mov qword [rsi], r15
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], r15
mov rax, rdi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010ea20
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r10, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x30]
call fcn.1400503f0
mov rcx, rax
call fcn.14004de60
mov rdx, rax
mov rcx, r10
call fcn.14004f1e0
lea rdx, [0x14004f3b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140050240
int3
Function at 0x140050410
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r14
push r15
mov rbx, qword [rcx + 0x38]
mov r9, rdx
xor r8d, r8d
mov r14, rcx
mov rax, qword [rbx + 0xb0]
lea rdx, [rbx + 0x18]
movzx r10d, word [rbx + 6]
mov qword [rsp + 0x20], rax
dec r10d
mov r11d, eax
movzx eax, word [rbx + 0x14]
add rdx, rax
test r10d, r10d
jle 0x140050464
nop
mov eax, dword [rdx + 0x34]
cmp r11, rax
jb 0x140050464
inc r8d
add rdx, 0x28
cmp r8d, r10d
jl 0x140050450
mov r15d, dword [rdx + 0x14]
xor esi, esi
mov eax, dword [rdx + 0xc]
sub r15, rax
add r15, r11
sub r9, qword [rbx + 0x30]
je 0x140050571
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x140050571
mov qword [rsp + 0x28], rbp
mov ebp, eax
mov qword [rsp + 0x30], rdi
nop word [rax + rax]
mov rcx, qword [r14 + 0x38]
xor r8d, r8d
mov rbx, qword [r14]
add rbx, rsi
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
movzx r10d, word [rcx + 6]
add rdx, rax
mov r11d, dword [rbx + r15]
dec r10d
test r10d, r10d
jle 0x1400504e4
nop dword [rax]
mov eax, dword [rdx + 0x34]
cmp r11, rax
jb 0x1400504e4
inc r8d
add rdx, 0x28
cmp r8d, r10d
jl 0x1400504d0
mov edi, dword [rdx + 0x14]
lea r10, [r15 + 8]
mov eax, dword [rdx + 0xc]
lea r10, [r10 + rbx]
mov r8d, dword [rbx + r15 + 4]
sub rdi, rax
add rdi, r11
add rsi, 8
sub r8, 8
shr r8, 1
je 0x14005055e
lea rsi, [rsi + r8*2]
nop
movzx ecx, word [r10]
mov eax, ecx
movzx edx, cx
and eax, 0xfff
shr edx, 0xc
add rax, qword [r14]
add rax, rdi
test edx, edx
je 0x140050554
sub edx, 1
je 0x14005054a
sub edx, 1
je 0x140050544
sub edx, 1
je 0x14005053f
cmp edx, 7
jne 0x140050554
add qword [rax], r9
jmp 0x140050554
add word [rax], r9w
jmp 0x140050554
mov rcx, r9
shr rcx, 0x10
add word [rax], cx
add r10, 2
sub r8, 1
jne 0x140050510
cmp rsi, rbp
jb 0x1400504a0
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
pop r15
pop r14
pop rsi
ret
Function at 0x140050580
Capabilities:
Enumerate pe sections
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r15, rdx
mov rsi, rcx
mov qword [rsp + 0x20], rdx
mov r8, qword [rcx + 0x38]
mov r10d, dword [r8 + 0x90]
movzx eax, word [r8 + 0x14]
lea r9, [r8 + 0x18]
add r9, rax
xor edx, edx
movzx ecx, word [r8 + 6]
dec ecx
test ecx, ecx
jle 0x1400505d3
nop
mov eax, dword [r9 + 0x34]
cmp r10, rax
jb 0x1400505d3
inc edx
add r9, 0x28
cmp edx, ecx
jl 0x1400505c0
mov r14d, dword [r9 + 0x14]
mov eax, dword [r9 + 0xc]
sub r14, rax
add r14, r10
add r14, qword [rsi]
mov eax, dword [r14 + 0xc]
test eax, eax
je 0x140050769
mov r11d, eax
mov rcx, qword [rsi + 0x38]
movzx eax, word [rcx + 0x14]
lea r10, [rcx + 0x18]
add r10, rax
mov rdx, r10
xor r8d, r8d
movzx r9d, word [rcx + 6]
dec r9d
test r9d, r9d
jle 0x140050629
mov eax, dword [rdx + 0x34]
cmp r11, rax
jb 0x140050629
inc r8d
add rdx, 0x28
cmp r8d, r9d
jl 0x140050615
mov ebp, dword [rdx + 0x14]
mov eax, dword [rdx + 0xc]
sub rbp, rax
add rbp, r11
mov r11, qword [rsi]
add rbp, r11
mov r8d, dword [r14 + 0x10]
mov rcx, r10
xor edx, edx
test r9d, r9d
jle 0x140050663
nop dword [rax]
mov eax, dword [rcx + 0x34]
cmp r8, rax
jb 0x140050663
inc edx
add rcx, 0x28
cmp edx, r9d
jl 0x140050650
mov edi, dword [rcx + 0x14]
mov eax, dword [rcx + 0xc]
sub rdi, rax
add rdi, r11
add rdi, r8
mov eax, dword [r14]
test eax, eax
je 0x1400506a9
mov edx, eax
xor ecx, ecx
test r9d, r9d
jle 0x140050696
mov eax, dword [r10 + 0x34]
cmp rdx, rax
jb 0x140050696
inc ecx
add r10, 0x28
cmp ecx, r9d
jl 0x140050682
mov ebx, dword [r10 + 0x14]
mov eax, dword [r10 + 0xc]
sub rbx, rax
add rbx, r11
add rbx, rdx
jmp 0x1400506ac
mov rbx, rdi
mov r9, qword [rbx]
test r9, r9
je 0x140050750
nop dword [rax + rax]
mov rax, r9
not rax
test rax, rax
jns 0x140050760
mov rcx, qword [rsi + 0x38]
movzx eax, word [rcx + 0x14]
add rax, 0x18
add rax, rcx
xor edx, edx
movzx r8d, word [rcx + 6]
dec r8d
test r8d, r8d
jle 0x140050703
nop dword [rax]
mov ecx, dword [rax + 0x34]
cmp r9, rcx
jb 0x140050703
inc edx
add rax, 0x28
cmp edx, r8d
jl 0x1400506f0
mov edx, dword [rax + 0x14]
mov ecx, dword [rax + 0xc]
sub rdx, rcx
lea rax, [rdx + 2]
add rax, r9
add rax, qword [rsi]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbp
mov rcx, qword [r15 + 0x38]
test rcx, rcx
je 0x140050759
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call qword [rax + 0x10]
mov qword [rdi], rax
add rbx, 8
add rdi, 8
mov r9, qword [rbx]
test r9, r9
jne 0x1400506c0
add r14, 0x14
jmp 0x1400505e4
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rcx, qword [r15 + 0x38]
test rcx, rcx
je 0x140050786
mov rax, qword [rcx]
cmp rcx, r15
setne dl
call qword [rax + 0x20]
mov qword [r15 + 0x38], 0
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400511c0
Capabilities:
Encode data using xor
Unload driver

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov r8, rcx
mov dword [rbp - 0x55], 0xf000dd
mov ecx, 0x34
mov dword [rbp - 0x51], 0xe300e6
xor r10d, r10d
mov dword [rbp - 0x59], ecx
mov dword [rbp - 0x4d], 0xf500ec
mov eax, r10d
mov dword [rbp - 0x49], 0xfa00f3
mov r9d, 0x81
mov dword [rbp - 0x45], 0xd600f0
mov dword [rbp - 0x41], 0xed00e6
mov dword [rbp - 0x3d], 0xe600ee
mov dword [rbp - 0x39], 0xfe00e6
mov dword [rbp - 0x35], 0xce00f4
mov dword [rbp - 0x31], 0xcd00c0
mov dword [rbp - 0x2d], 0xc200c6
mov dword [rbp - 0x29], 0xd500d2
mov dword [rbp - 0x25], 0xd900c5
mov dword [rbp - 0x21], 0xee00ee
mov dword [rbp - 0x1d], 0xfb00ef
mov dword [rbp - 0x19], 0xd400f1
mov dword [rbp - 0x15], 0xcd00e2
mov dword [rbp - 0x11], 0xd000cd
mov dword [rbp - 0xd], 0xc900d7
mov dword [rbp - 9], 0xfb00cb
mov dword [rbp - 5], 0xde00cc
mov dword [rbp - 1], 0xff00f7
mov dword [rbp + 3], 0xdc00c8
mov dword [rbp + 7], 0xd900d9
mov dword [rbp + 0xb], 0xd700d2
mov dword [rbp + 0xf], 0xe800c0
mov dword [rbp + 0x13], 0xb5
nop dword [rax]
nop dword [rax + rax]
mov ecx, eax
lea rdx, [rbp - 0x55]
lea rdx, [rdx + rcx*2]
lea ecx, [r9 + rax]
inc eax
xor word [rdx], cx
mov ecx, dword [rbp - 0x59]
cmp eax, ecx
jb 0x1400512c0
mov word [rbp + rcx*2 - 0x55], r10w
lea rdx, [rbp - 0x55]
lea rcx, [rbp + 0x17]
call fcn.140051910
cmp qword [rbp + 0x2f], 8
lea rdx, [rbp + 0x17]
lea rcx, [rbp + 0x37]
cmovae rdx, qword [rbp + 0x17]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rbp + 0x37]
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
test eax, eax
lea rcx, [rbp + 0x17]
setns bl
call fcn.140051690
movzx eax, bl
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14010ea20
mov rbx, qword [rsp + 0xe8]
add rsp, 0xd0
pop rbp
ret
Function at 0x140051340
Capabilities:
Delete file
Delete registry key
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
mov eax, 0x21
mov dword [rbp - 0x38], eax
movdqa xmm0, xmmword [0x140122000]
movdqu xmmword [rbp - 0x34], xmm0
movdqa xmm1, xmmword [0x140121760]
movdqu xmmword [rbp - 0x24], xmm1
mov dword [rbp - 0x14], 0xa2d2
xor edi, edi
mov edx, edi
test eax, eax
je 0x1400513b7
nop dword [rax]
mov eax, edx
lea rcx, [rbp - 0x34]
add rcx, rax
lea eax, [rdx - 0x7f]
xor byte [rcx], al
inc edx
mov eax, dword [rbp - 0x38]
cmp edx, eax
jb 0x1400513a0
mov byte [rbp + rax - 0x34], dil
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x34]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1400514d1
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1400513e6
mov rdx, qword [rsi]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ebx, eax
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400514d1
lea rdx, [rsi + 0x20]
cmp qword [rdx + 0x18], 8
jb 0x14005141c
mov rbx, qword [rdx]
mov rcx, qword [rdx + 0x10]
lea rsi, [rbx + rcx*2]
jmp 0x140051427
mov rax, qword [rdx + 0x10]
lea rsi, [rdx + rax*2]
mov rbx, rdx
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x28], rdi
mov r8d, 0xf
mov qword [rbp - 0x20], r8
mov rdx, rsi
sub rdx, rbx
sar rdx, 1
cmp rdx, 0x10
jb 0x140051459
lea rcx, [rbp - 0x38]
call fcn.140051be0
mov qword [rbp - 0x28], rdi
mov r8, qword [rbp - 0x20]
lea rax, [rbp - 0x38]
mov qword [rbp - 0x40], rax
cmp rbx, rsi
je 0x1400514ab
movzx r9d, byte [rbx]
cmp rdi, r8
jae 0x14005148f
lea rax, [rdi + 1]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x38]
cmp r8, 0x10
cmovae rax, qword [rbp - 0x38]
mov byte [rax + rdi], r9b
mov byte [rax + rdi + 1], 0
jmp 0x140051498
lea rcx, [rbp - 0x38]
call fcn.14004f610
add rbx, 2
mov r8, qword [rbp - 0x20]
cmp rbx, rsi
je 0x1400514ab
mov rdi, qword [rbp - 0x28]
jmp 0x140051466
lea rcx, [rbp - 0x38]
cmp r8, 0x10
cmovae rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, eax
lea rcx, [rbp - 0x38]
call fcn.14004ef80
test ebx, ebx
je 0x1400514d1
mov al, 1
jmp 0x1400514d3
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14010ea20
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret