joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800012b0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp ebx, 1
jne 0x180001326
xor ebx, ebx
lea r8, [0x180002e10]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800012f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r8, [0x1800041d0]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18000131b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x180005b80
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x180025010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [0x180026d50]
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov r13, r9
mov r12, r8
mov r15, rdx
mov r14, rcx
test rax, rax
jne 0x180005c92
mov rax, qword gs:[0x60]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rdi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop word [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x180005c64
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x180005c64
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x180005c5f
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x180005c40
cmp edx, 0x6e2a0391
je 0x180005ccd
test r8d, r8d
jne 0x180005c20
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x180005c79
cmp qword [rax + 0x30], rbp
jne 0x180005bf0
mov rax, rbp
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov qword [0x180026d50], rax
lea rcx, [rsp + 0x30]
mov r9, r13
mov qword [rsp + 0x20], rcx
mov r8, r12
mov rcx, r14
mov rdx, r15
call rax
test eax, eax
setns bpl
mov eax, ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800091f0
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x180005c7c
Function at 0x180006850
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov rax, qword [0x180026d40]
mov ebp, edx
mov r14, rcx
test rax, rax
jne 0x180006942
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov r8, qword [rax + 0x18]
mov rax, qword [r8 + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180006914
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180006914
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x18000690f
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1800068f0
cmp edx, 0x4105fc56
je 0x18000695d
test r8d, r8d
jne 0x1800068d0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x18000692a
cmp qword [rax + 0x30], 0
jne 0x1800068a0
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov qword [0x180026d40], rax
mov r8d, ebp
xor edx, edx
mov ecx, 0x1fffff
call rax
mov rbp, qword [rsp + 0x48]
mov qword [r14], rax
add rsp, 0x20
pop r14
ret
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x18000692c
Function at 0x180017250
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180017278
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180017278
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14003d040
Capabilities:
Terminate process

Disassembly:
adc al, 0x35
in al, 0xb2
jmp 0xc4c0ac8d
cld
pop r11
jmp 0x14003d04d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003d05d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003d045
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003d075
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003d062
sub eax, 3
jb 0x14003d08f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003d0c6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003d0b6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003d0b4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003d0a3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003d002
jmp 0x14003d04d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2ae00
mov dl, 9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003d116
cmp rsi, rcx
jae 0x14003d11e
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003d0fd
cmp al, 0x8f
ja 0x14003d0fd
cmp byte [rsi - 2], 0xf
je 0x14003d103
sub al, 0xe8
cmp al, 1
ja 0x14003d0e7
cmp rsi, rcx
jae 0x14003d11e
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003d0ed
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003d11e
lodsb al, byte [rsi]
jmp 0x14003d0fd
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x3a000]
mov eax, dword [rdi]
or eax, eax
je 0x14003d187
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x3d000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003d12b
jns 0x14003d160
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14003d16a
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003d181
mov qword [rbx], rax
add rbx, 8
jmp 0x14003d14b
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14003d1c1
cmp al, 0xef
ja 0x14003d1b3
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14003d193
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14003d1a2
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x217]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14003d240], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14003d240
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003d230
sub rsp, 0xffffffffffffff80
jmp 0x140029f20
Function at 0x14001c3c4
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
mov rax, qword [0x1400481f8]
xor rax, rsp
mov qword [rbp + 0x88], rax
mov rax, qword gs:[0x58]
mov r13, rcx
mov ecx, 8
mov rdx, qword [rax]
lea rax, str.TieringPinnedSession::MigratePinnedDatabaseToDscAttribute
mov qword [rcx + rdx], rax
lea rcx, [rsp + 0x70]
call fcn.14000865c
xor eax, eax
lea rcx, [rbp + 0x60]
xor r12d, r12d
mov qword [rbp - 0x50], rax
xor edx, edx
mov qword [rbp - 0x48], rax
mov esi, r12d
mov dword [rsp + 0x48], r12d
lea r8d, [rax + 0x28]
mov dword [rsp + 0x4c], r12d
mov r15d, r12d
call sub.msvcrt.dll_memset
mov rcx, qword [r13 + 8]
lea eax, [r12 + 5]
movzx edx, r12w
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x44], edx
xor r9d, r9d
mov rdx, qword [r13 + 0x18]
mov r8d, 0x80000000
mov word [rsp + 0x54], ax
mov dword [rsp + 0x58], r12d
call qword [sym.imp.ESENT.dll_JetMove]
mov r8d, eax
add eax, 0x643
test eax, 0xfffffffd
je 0x14001cc3f
test r8d, r8d
je 0x14001c551
cmp r8d, 0xfffffdef
je 0x14001c4e9
cmp r8d, 0xfffffbbc
je 0x14001c4e9
cmp r8d, 0xfffff8f0
je 0x14001c4e9
cmp r8d, 0xfffffc0d
jne 0x14001c4ca
mov eax, 0x8007000e
jmp 0x14001c4f3
mov eax, r8d
mov ecx, 0xe5e0000
cdq
xor eax, edx
sub eax, edx
mov edx, 0x8e5e0000
test r8d, r8d
movzx eax, ax
cmovs ecx, edx
or eax, ecx
jmp 0x14001c4f3
mov ecx, 0x70
call fcn.14000395c
mov ebx, eax
mov dword [rsp + 0x78], eax
mov rcx, qword [0x140048138]
lea r14, [0x140048138]
mov edi, 1
lea r12d, [rdi + 1]
cmp rcx, r14
je 0x14001c541
test byte [rcx + 0x1c], dil
je 0x14001c541
cmp byte [rcx + 0x19], r12b
jb 0x14001c541
mov r9, qword [r13 + 0x28]
lea edx, [rdi + 0x10]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
lea r8, [0x14003f9a8]
mov r9, qword [r9 + 0x70]
call fcn.140003d20
mov dword [rsp + 0x44], 4
xor r8d, r8d
jmp 0x14001cb24
mov rax, qword [r13 + 0x28]
lea r8, [rbp - 0x80]
mov edi, 1
mov r9d, 0x100080
mov cl, dil
mov rdx, qword [rax]
add rdx, 0x2a0
call fcn.140008bcc
mov dword [rsp + 0x78], eax
mov ebx, eax
test eax, eax
jns 0x14001c5d8
mov rcx, qword [0x140048138]
lea r14, [0x140048138]
lea r12d, [rdi + 1]
cmp rcx, r14
je 0x14001c5c8
test byte [rcx + 0x1c], dil
je 0x14001c5c8
cmp byte [rcx + 0x19], r12b
jb 0x14001c5c8
mov rax, qword [r13 + 0x28]
lea edx, [rdi + 0x11]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003f9a8]
mov dword [rsp + 0x20], ebx
mov r9, qword [rax]
add r9, 0x2a0
call fcn.140008b3c
mov eax, 5
xor r8d, r8d
movzx edx, ax
jmp 0x14001cb2d
mov rcx, qword [r13 + 0x28]
xor edx, edx
call fcn.14001861c
mov rcx, qword [r13 + 0x28]
mov edx, edi
call fcn.14001861c
mov r15d, 0x8007000e
lea r14, [0x140048138]
mov r12d, 2
jmp 0x14001c607
mov rcx, qword [0x140048138]
lea r14, [0x140048138]
cmp rcx, r14
je 0x14001cc7e
mov edi, 1
test byte [rcx + 0x1c], dil
je 0x14001cc7e
cmp byte [rcx + 0x19], 4
jb 0x14001cc7e
mov r9, qword [r13 + 0x28]
lea edx, [rdi + 0xf]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14003f9a8]
mov r9, qword [r9 + 0x70]
call fcn.140003b1c
mov dword [rsp + 0x78], r12d
mov ebx, r12d
Function at 0x140011122
Capabilities:
Hash data using djb2

Disassembly:
jmp 0x140011ea0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400231c9]
call fcn.1400113b1
mov dword [rbp + 4], 0x1505
mov rax, qword [rbp + 0x120]
movzx eax, word [rax]
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
mov dword [rbp + 0xf4], eax
mov rax, qword [rbp + 0x120]
add rax, 2
mov qword [rbp + 0x120], rax
cmp dword [rbp + 0xf4], 0
je 0x140011f08
mov eax, dword [rbp + 4]
shl eax, 5
add eax, dword [rbp + 4]
add eax, dword [rbp + 0x24]
mov dword [rbp + 4], eax
jmp 0x140011ec6
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x14001112c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x140012100
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x228
lea rbp, [rsp + 0x20]
lea rcx, [0x1400232e0]
call fcn.1400113b1
mov rax, qword [rbp + 0x220]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x220]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + rax + 0x88]
mov dword [rbp + 0x44], eax
mov eax, dword [rbp + 0x44]
mov rcx, qword [rbp + 0x220]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 0x220]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x68]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 0x220]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x68]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 0x220]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0xe8], 0
jmp 0x1400121e1
mov rax, qword [rbp + 0xe8]
inc rax
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0x68]
mov eax, dword [rax + 0x14]
cmp qword [rbp + 0xe8], rax
jae 0x140012286
mov rax, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0xe8]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rbp + 0x220]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0xe8]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rbp + 0x88]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0x220]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rcx, qword [rbp + 0x108]
call fcn.140011140
cmp eax, dword [rbp + 0x228]
jne 0x140012281
mov r8, qword [rbp + 0x128]
mov rdx, qword [rbp + 0x108]
lea rcx, str.___Function__s_found_at__p_r_n
call fcn.1400111c2
mov rax, qword [rbp + 0x128]
jmp 0x140012288
jmp 0x1400121d0
xor eax, eax
lea rsp, [rbp + 0x208]
pop rdi
pop rbp
ret
Function at 0x140011140
Capabilities:
Hash data using djb2

Disassembly:
jmp 0x140011f40
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400231c9]
call fcn.1400113b1
mov dword [rbp + 4], 0x1505
mov rax, qword [rbp + 0x120]
movsx eax, byte [rax]
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
mov dword [rbp + 0xf4], eax
mov rax, qword [rbp + 0x120]
inc rax
mov qword [rbp + 0x120], rax
cmp dword [rbp + 0xf4], 0
je 0x140011fa7
mov eax, dword [rbp + 4]
shl eax, 5
add eax, dword [rbp + 4]
add eax, dword [rbp + 0x24]
mov dword [rbp + 4], eax
jmp 0x140011f66
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140011221
Capabilities:
Terminate process

Disassembly:
jmp 0x140013d60
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400112b2
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400150b0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400150d0
xor al, al
jmp 0x140015151
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400150e3
xor al, al
jmp 0x140015151
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001510d
xor al, al
jmp 0x140015151
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015121
xor al, al
jmp 0x140015151
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015133
xor al, al
jmp 0x140015151
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001514f
xor al, al
jmp 0x140015151
mov al, 1
add rsp, 0x38
ret
Function at 0x14000102c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd rdi, dword [rcx + 0x3c]
mov r15, rcx
add rdi, rcx
mov ebp, edx
mov r8d, edx
xor ebx, ebx
mov eax, dword [rdi + 0x88]
mov edx, eax
mov ecx, dword [rdi + 0x8c]
mov dword [rsp + 0x88], ecx
mov rcx, rdi
mov dword [rsp + 0x70], eax
call fcn.140001ac4
test eax, eax
je 0x140001169
mov esi, eax
mov r8d, ebp
add rsi, r15
mov rcx, rdi
mov edx, dword [rsi + 0x1c]
call fcn.140001ac4
mov r12d, eax
test eax, eax
je 0x140001169
mov edx, dword [rsi + 0x24]
mov r8d, ebp
mov rcx, rdi
call fcn.140001ac4
mov r14d, eax
test eax, eax
je 0x140001169
mov edx, dword [rsi + 0x20]
mov r8d, ebp
mov rcx, rdi
call fcn.140001ac4
test eax, eax
je 0x140001169
add r12, r15
mov r13d, eax
mov eax, dword [rsi + 0x18]
add r13, r15
add r14, r15
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], eax
mov r12d, ebx
test eax, eax
je 0x140001169
mov esi, dword [rsp + 0x70]
mov edx, dword [r13]
mov r8d, ebp
mov rcx, rdi
call fcn.140001ac4
test eax, eax
je 0x140001148
mov rdx, qword [rsp + 0x28]
mov ecx, eax
movzx eax, word [r14]
add rcx, r15
mov edx, dword [rdx + rax*4]
cmp edx, esi
jb 0x140001124
mov eax, dword [rsp + 0x88]
add eax, esi
cmp edx, eax
jb 0x140001148
mov r9, qword [rsp + 0x80]
sub r9, rcx
movzx eax, byte [rcx]
movzx r8d, byte [rcx + r9]
sub eax, r8d
jne 0x140001144
inc rcx
test r8d, r8d
jne 0x14000112f
test eax, eax
je 0x14000115c
inc r12d
add r13, 4
add r14, 2
cmp r12d, dword [rsp + 0x20]
jae 0x140001169
jmp 0x1400010ef
mov r8d, ebp
mov rcx, rdi
call fcn.140001ac4
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000159c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rdi, rcx
mov esi, 0xc0000001
test rcx, rcx
je 0x140001786
call fcn.140001a74
mov rbx, rax
test rax, rax
je 0x140001786
mov edx, dword [rax + 0x50]
xor ecx, ecx
mov r8d, 0x5347
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rcx, rax
mov rax, qword [0x1400107c0]
mov qword [rax + 0x30], rcx
mov rax, qword [0x1400107c0]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x140001786
mov r8d, dword [rbx + 0x50]
test r8, r8
je 0x14000160f
xor edx, edx
call fcn.1400026c0
mov rax, qword [0x1400107c0]
mov edx, dword [rbx + 0x54]
mov rcx, qword [rax + 0x30]
test rdx, rdx
je 0x140001637
mov r8, rdi
sub r8, rcx
mov al, byte [r8 + rcx]
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140001628
movsxd r9, dword [rdi + 0x3c]
mov r8d, ebp
add r9, rdi
cmp bp, word [rbx + 6]
jae 0x140001697
mov eax, r8d
lea rcx, [rax + rax*4]
mov rax, qword [0x1400107c0]
mov r10d, dword [r9 + rcx*8 + 0x11c]
mov edx, dword [r9 + rcx*8 + 0x114]
add r10, rdi
mov r11d, dword [r9 + rcx*8 + 0x118]
add rdx, qword [rax + 0x30]
test r11, r11
je 0x14000168b
sub r10, rdx
mov al, byte [r10 + rdx]
mov byte [rdx], al
inc rdx
sub r11, 1
jne 0x14000167c
movzx eax, word [rbx + 6]
inc r8d
cmp r8d, eax
jb 0x140001647
mov rcx, qword [0x1400107c0]
mov rcx, qword [rcx + 0x30]
call fcn.1400014ec
test eax, eax
js 0x140001786
mov rcx, qword [0x1400107c0]
mov rcx, qword [rcx + 0x30]
call fcn.140001798
test eax, eax
js 0x140001786
mov r8d, 8
lea rdx, [0x1400107c0]
lea rcx, [0x140002880]
call fcn.140001cc8
mov esi, eax
test eax, eax
js 0x140001786
mov ecx, dword [rbx + 0x28]
or r9, 0xffffffffffffffff
mov rax, qword [0x1400107c0]
mov ebx, 0x1fffff
mov qword [rsp + 0x68], rbp
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov edx, ebx
add rcx, qword [rax + 0x30]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov esi, eax
test eax, eax
js 0x140001786
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rbp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, ebx
mov qword [rsp + 0x60], rbp
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
js 0x140001779
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
mov rbx, qword [rsp + 0x70]
mov eax, esi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001888
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
and qword [rax - 0x58], 0
lea r9, [rbp + 0x17]
and qword [rbp + 0x6f], 0
lea r8, [rbp + 0x27]
and qword [rbp + 0x67], 0
xorps xmm0, xmm0
and qword [rbp + 0x2f], 0
mov edx, 0x110000
mov dword [rax - 0x60], 0x100
and qword [rax - 0x68], 0
and dword [rax - 0x70], 0
and dword [rax - 0x78], 0
and qword [rax - 0x80], 0
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 4
mov qword [rbp + 0x37], rcx
lea rcx, [rbp + 0x6f]
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp + 0x27], 0x30
mov dword [rbp + 0x3f], 0x240
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
mov ebx, eax
test eax, eax
js 0x1400019a1
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
lea rax, [rbp + 0x67]
and qword [rsp + 0x30], 0
xor r9d, r9d
mov rcx, qword [rbp + 0x6f]
mov edx, 0x110000
mov qword [rsp + 0x28], rax
mov r8, qword [r8]
mov dword [rsp + 0x20], 0x454c4946
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandleWithTag]
mov ebx, eax
test eax, eax
js 0x140001995
mov rax, qword [rbp + 0x67]
xor edx, edx
mov rcx, qword [rax + 0x28]
and qword [rcx + 0x10], 0
mov rcx, qword [rbp + 0x67]
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
test al, al
je 0x14000198b
lea rcx, [rbp + 0x27]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov ebx, eax
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp + 0x6f]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop rbp
ret

Function at 0x140001ac4
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movzx eax, word [rcx + 0x14]
lea r10, [rcx + 0x18]
movzx ebx, word [rcx + 6]
xor r9d, r9d
add r10, rax
mov edi, r8d
cmp r9w, bx
movzx r11d, r9w
jae 0x140001b20
mov r8d, dword [r10 + 0xc]
cmp r8d, edx
ja 0x140001b01
mov ecx, dword [r10 + 8]
add ecx, r8d
cmp ecx, edx
ja 0x140001b0f
add r10, 0x28
inc r11w
cmp r11w, bx
jmp 0x140001aeb
mov eax, dword [r10 + 0x14]
sub eax, r8d
add edx, eax
cmp edx, edi
sbb r9d, r9d
and r9d, edx
mov rbx, qword [rsp + 8]
mov eax, r9d
mov rdi, qword [rsp + 0x10]
ret