joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800782e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x40
mov rax, qword gs:[0x60]
mov rdi, rdx
mov rbp, rcx
mov rdx, rcx
mov r8d, 0x14d0
xor ecx, ecx
mov rbx, qword [rax + 0x68]
call fcn.18003bc9c
lea rax, [rsp + 0x30]
mov r9, rdi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rbx
call fcn.18003bcf0
xor r14d, r14d
mov ebx, eax
test eax, eax
js 0x180078391
cmp byte [rdi], r14b
je 0x180078391
cmp word [rsp + 0x30], r14w
je 0x180078380
mov ecx, 0x14d1
movzx r8d, cx
mov rdx, rbp
xor ecx, ecx
call fcn.18003bc9c
test ebx, ebx
js 0x180078398
cmp word [rsp + 0x30], r14w
je 0x180078387
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
mov ecx, 0x14d2
jmp 0x18007834e
cmp byte [rdi], r14b
je 0x180078368
mov byte [rdi], r14b
jmp 0x180078368
mov ecx, 0x14d3
jmp 0x18007834e
mov eax, ebx
jmp 0x18007836a
Function at 0x18007af64
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov rax, qword gs:[0x30]
mov r8d, dword [rax + 0x48]
mov dword [rdx + 0x28], r8d
mov qword [rdx + 0x30], rcx
add rcx, 0x48
call sym.ntdll.dll_RtlAcquireSRWLockExclusive
nop
lea rax, [rdi + 0x10]
lea rcx, [rbx + 0x60]
mov rdx, qword [rcx + 8]
cmp qword [rdx], rcx
je 0x18007afb5
mov ecx, 3
int 0x29
mov qword [rax], rcx
mov qword [rax + 8], rdx
mov qword [rdx], rax
mov qword [rcx + 8], rax
lea rcx, [rbx + 0x48]
call sym.ntdll.dll_RtlReleaseSRWLockExclusive
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18007c270
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword gs:[0x60]
xor ebx, ebx
mov rbp, qword [rdx]
mov r13, rcx
mov r14, r8
mov qword [rdx], rbx
mov r15, rdx
mov r12d, 0x40000002
cmp r13, qword [rax + 0x10]
lea ecx, [rbx + 2]
lea rax, [r11 + 8]
mov rdx, r13
cmove r12d, ecx
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x40], rbx
lea r9d, [rbx + 6]
mov ecx, r12d
mov qword [r11 - 0x48], rbx
xor r8d, r8d
call sym.ntdll.dll_RtlQueryInformationActivationContext
mov edx, 0x80000000
mov ecx, eax
add eax, edx
test edx, eax
je 0x18007c315
mov rsi, qword [rsp + 0x70]
test rsi, rsi
jne 0x18007c31f
mov ebx, 1
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp ecx, 0xc0000023
je 0x18007c2e6
jmp 0x18007c2f5
cmp rsi, qword [r14]
ja 0x1800c3cf4
mov rdi, rbp
lea rax, [rsp + 0x70]
mov r9d, 6
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov rdx, r13
mov ecx, r12d
mov qword [rsp + 0x20], rdi
call sym.ntdll.dll_RtlQueryInformationActivationContext
test eax, eax
js 0x1800c3d24
mov rax, qword [rsp + 0x70]
mov qword [r14], rax
mov qword [r15], rdi
jmp 0x18007c2f0
mov rcx, qword gs:[0x60]
mov edx, 8
mov rsi, qword [rsp + 0x70]
mov r8, rsi
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
mov rdi, rax
test rax, rax
jne 0x18007c32b
jmp 0x18007c2f5
test rdi, rdi
je 0x18007c2f5
cmp rdi, rbp
je 0x18007c2f5
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
nop
jmp 0x18007c2f5
Function at 0x18007c574
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push r15
sub rsp, 0xc0
mov rax, qword [0x1801724e0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
mov dword [rsp + 0x60], 0x30
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
and dword [rsp + 0x78], 0
movdqu xmmword [r11 - 0x48], xmm0
and qword [rcx], 0
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
test dword [rcx + 0xbc], 0x100000
jne 0x1800c3de8
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18008b0e0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop r15
ret
lea r9, [rsp + 0x50]
xor r8d, r8d
lea esi, [r8 + 2]
mov edx, esi
or rcx, 0xffffffffffffffff
call sym.ntdll.dll_NtOpenProcessTokenEx
test eax, eax
js 0x18007c5da
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x94], 2
mov dword [rsp + 0x90], 0xc
mov word [rsp + 0x98], ax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [rsp + 0x60]
lea edx, [rsi + 0x22]
mov rcx, qword [rsp + 0x50]
call sym.ntdll.dll_NtDuplicateToken
test eax, eax
js 0x1800c3f8a
xor eax, eax
mov word [rsp + 0x30], ax
mov byte [rsp + 0x31], 1
mov r9d, esi
lea r8, [rsp + 0x30]
lea edx, [rsi + 2]
mov rcx, qword [rsp + 0x38]
call sym.ntdll.dll_NtSetInformationObject
test eax, eax
js 0x1800c3f7a
lea r9d, [rsi + 6]
lea r8, [rsp + 0x38]
lea edx, [rsi + 3]
mov r15, 0xfffffffffffffffe
mov rcx, r15
call sym.ntdll.dll_NtSetInformationThread
test eax, eax
js 0x1800c3f58
mov dword [rsp + 0xa0], 1
mov dword [rsp + 0x58], 0x14
and dword [rsp + 0x5c], 0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0xa4], rax
mov dword [rsp + 0xac], esi
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9d, [rsi + 0xe]
lea r8, [rsp + 0xa0]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call sym.ntdll.dll_NtAdjustPrivilegesToken
test eax, eax
js 0x1800c3f3a
mov dword [rsp + 0x40], 1
lea r9d, [rsi + 2]
lea r8, [rsp + 0x40]
lea edx, [rsi + 0x10]
mov rcx, r15
call sym.ntdll.dll_NtSetInformationThread
test eax, eax
js 0x1800c3f3a
mov rax, qword [rsp + 0x38]
mov qword [rbx], rax
and qword [rsp + 0x38], 0
nop
and qword [rsp + 0x48], 0
mov r9d, 8
lea r8, [rsp + 0x48]
lea edx, [r9 - 3]
mov rcx, r15
call sym.ntdll.dll_NtSetInformationThread
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1800c3f7a
xor eax, eax
mov word [rsp + 0x30], ax
mov r9d, esi
lea r8, [rsp + 0x30]
lea edx, [rax + 4]
call sym.ntdll.dll_NtSetInformationObject
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1800c3f8a
call sym.ntdll.dll_NtClose
nop
mov rcx, qword [rsp + 0x50]
call sym.ntdll.dll_NtClose
nop
jmp 0x18007c5da
Function at 0x18007cab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
je 0x180027ddd
ret
mov rax, qword [rcx + 8]
lea rdx, [0x180059040]
mov rax, qword [rax]
cmp rax, rdx
je 0x180059040
lea rdx, case.default.0x180027e04
cmp rax, rdx
je case.default.0x180027e04
jmp qword [section..00cfg]
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.180024608
nop
mov edx, dword [0x18015d050]
add edx, 0x200000
mov rcx, qword gs:[0x60]
mov r8, rbx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.180024608
mov rcx, qword gs:[0x60]
mov r8, rbx
mov edx, dword [0x18015d050]
add edx, 0x200000
mov rcx, qword [rcx + 0x30]
add rsp, 0x20
pop rbx
jmp sym.ntdll.dll_RtlFreeHeap
Function at 0x18007d454
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, qword gs:[0x60]
xor edx, edx
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x30], rax
mov rcx, qword gs:[0x60]
mov edi, dword [rax + 4]
mov r8d, edi
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
mov rbx, rax
test rax, rax
je 0x1800c488e
mov rdx, qword [rsp + 0x30]
mov r8d, edi
mov rcx, rax
call sym.ntdll.dll_RtlCopyMemory
mov rax, qword [rbx + 0x40]
mov rcx, rbx
sub rcx, qword [rsp + 0x30]
test rax, rax
je 0x18007d4c3
add rax, rcx
mov qword [rbx + 0x40], rax
mov rax, qword [rbx + 0x58]
test rax, rax
jne 0x18007d577
mov rax, qword [rbx + 0x68]
test rax, rax
je 0x18007d4e0
add rax, rcx
mov qword [rbx + 0x68], rax
mov rax, qword [rbx + 0x78]
test rax, rax
je 0x18007d4f0
add rax, rcx
mov qword [rbx + 0x78], rax
mov rax, qword [rbx + 0xb8]
test rax, rax
je 0x18007d506
add rax, rcx
mov qword [rbx + 0xb8], rax
mov rax, qword [rbx + 0xc8]
test rax, rax
je 0x18007d51c
add rax, rcx
mov qword [rbx + 0xc8], rax
mov rax, qword [rbx + 0xd8]
test rax, rax
je 0x18007d532
add rax, rcx
mov qword [rbx + 0xd8], rax
mov rax, qword [rbx + 0xe8]
test rax, rax
jne 0x1800c4898
mov qword [rsi + 0x20], rbx
lea r8, [rsp + 0x38]
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x30]
mov r9d, 0x8000
or rcx, 0xffffffffffffffff
call sym.ntdll.dll_NtFreeVirtualMemory
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
add rax, rcx
mov qword [rbx + 0x58], rax
jmp 0x18007d4d0
mov eax, 0xc000009a
jmp 0x18007d567
add rax, rcx
mov qword [rbx + 0xe8], rax
jmp 0x18007d542
Function at 0x18007eda4
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rdi, rcx
mov qword [rax + 0x10], rbx
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x2d8]
test rsi, rsi
je 0x18007edf7
add rsi, 0x5d8
je 0x18007ee13
cmp dword [rsi + 0x30], ebx
je 0x18007ee13
test rsi, rsi
je 0x18007edf7
test rdi, rdi
jne 0x18007ee0e
cmp dword [rsi + 0xc], ebx
jne 0x1800c4d8e
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov qword [rcx], rbx
jmp 0x18007edee
mov rsi, rbx
jmp 0x18007ede4
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1800c4da5
test rdi, rdi
je 0x1800c4e24
mov qword [rcx], rax
jmp 0x1800c4e24
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
lea rcx, [0x180114070]
call sym.ntdll.dll_EtwEventRegister
test eax, eax
jne 0x18007edf7
mov rcx, qword [rsp + 0x48]
xor eax, eax
lock cmpxchg qword [rsi + 0x10], rcx
mov rbp, rax
je 0x1800c4deb
mov rcx, qword [rsp + 0x48]
xor edx, edx
call sym.ntdll.dll_EtwNotificationUnregister
test rdi, rdi
je 0x1800c4e24
mov qword [rdi], rbp
jmp 0x1800c4e24
test rdi, rdi
je 0x1800c4df8
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov rax, qword gs:[0x60]
lea rdx, [rsi + 0x30]
xor r8d, r8d
mov rcx, qword [rax + 0x20]
mov rax, qword [rcx + 0x68]
movzx r9d, word [rcx + 0x60]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.180109284
mov ebx, 1
jmp 0x18007edf7
Function at 0x18007fed0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea eax, [rdx - 1]
mov r9, r8
mov r13d, edx
mov rdi, rcx
cmp eax, 1
ja 0x1800c5288
mov rcx, qword [rsp + 0x80]
mov edx, 0xfffffffc
mov r12d, dword [rsp + 0x98]
movzx ebp, word [r8]
add ebp, 3
movzx ecx, word [rcx]
and ebp, edx
add ecx, 3
lea r15d, [r12 + 3]
and ecx, edx
and r15d, edx
add ecx, 0x47
add ebp, r15d
add ebp, ecx
mov rcx, qword [rdi + 0x18]
and ebp, 0xfffffff8
mov edx, dword [rcx + 8]
add edx, ebp
cmp edx, ebp
jb 0x1800c5292
mov ebx, dword [rcx + 4]
cmp edx, ebx
ja 0x1800c529c
mov r14d, dword [rcx + 8]
mov eax, dword [rsp + 0x88]
add r14, rcx
mov dword [r14], ebp
mov rbp, qword [rsp + 0x80]
mov dword [r14 + 4], r13d
movups xmm0, xmmword [r9]
movdqu xmmword [r14 + 8], xmm0
movups xmm1, xmmword [rbp]
mov dword [r14 + 0x30], eax
mov rax, qword [rsp + 0x78]
movdqu xmmword [r14 + 0x18], xmm1
mov qword [r14 + 0x28], rax
mov dword [r14 + 0x34], r12d
mov rax, qword [rdi + 0x18]
movzx r8d, word [r9]
mov rdx, qword [r9 + 8]
mov esi, dword [rax + 8]
add esi, 0x40
mov ebx, esi
lea rcx, [rsi + rax]
call sym.ntdll.dll_RtlCopyMemory
mov rax, qword [rsp + 0x70]
mov qword [r14 + 0x10], rbx
mov rcx, qword [rdi + 0x18]
movzx r8d, word [rbp]
movzx eax, word [rax]
mov rdx, qword [rbp + 8]
add eax, 3
and eax, 0xfffffffc
add esi, eax
mov ebx, esi
add rcx, rbx
call sym.ntdll.dll_RtlCopyMemory
mov qword [r14 + 0x20], rbx
movzx eax, word [rbp]
add eax, 3
and eax, 0xfffffffc
add esi, eax
cmp r13d, 2
jne 0x180080018
mov rcx, qword [rdi + 0x18]
mov r8, r12
mov rdx, qword [rsp + 0x90]
mov ebx, esi
add rcx, rbx
call sym.ntdll.dll_RtlCopyMemory
add esi, r15d
mov qword [r14 + 0x38], rbx
mov rax, qword [rdi + 0x18]
lea ecx, [rsi + 7]
and ecx, 0xfffffff8
mov dword [rax + 8], ecx
mov rax, qword [rdi + 0x18]
inc dword [rax]
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 0xc000000d
jmp 0x18008002d
mov eax, 0xc0000017
jmp 0x18008002d
add ebx, ebx
cmp ebx, edx
jb 0x1800c529c
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, ebx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
mov rsi, rax
test rax, rax
je 0x1800c5292
mov rdx, qword [rdi + 0x18]
mov rcx, rax
mov r8d, dword [rdx + 8]
call sym.ntdll.dll_RtlCopyMemory
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rdi + 0x18]
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
mov r9, qword [rsp + 0x70]
mov qword [rdi + 0x18], rsi
mov dword [rsi + 4], ebx
mov rcx, qword [rdi + 0x18]
jmp 0x18007ff58

Function at 0x180080080
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x18]
mov rbx, rcx
test r8, r8
je 0x1800800b7
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
and qword [rbx + 0x18], 0
xor eax, eax
mov byte [rbx + 0x10], 1
add rsp, 0x20
pop rbx
ret
mov eax, 0xc000011c
jmp 0x1800800b1
Function at 0x1800802a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov ebp, r8d
mov rsi, rdx
mov r14, rcx
mov ebx, r15d
mov edi, r15d
lea r12d, [r15 + 0x10]
cmp word [rdx + 2], r15w
jbe 0x1800802fd
movzx edi, word [rdx + 2]
xor edx, edx
mov rcx, qword gs:[0x60]
add edi, r12d
mov r8d, edi
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
mov rbx, rax
test rax, rax
je 0x1800c535e
lea rax, [rsp + 0x68]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, ebp
mov dword [rsp + 0x20], edi
mov rcx, r14
call sym.ntdll.dll_NtEnumerateKey
mov edi, eax
mov ebp, 0x80000005
test eax, eax
js 0x18008034a
test rbx, rbx
je 0x18008034a
mov eax, dword [rbx + 0xc]
movzx ecx, word [rsi + 2]
cmp ecx, eax
jb 0x180080391
mov rcx, qword [rsi + 8]
lea rdx, [rbx + 0x10]
movzx r8d, ax
mov word [rsi], ax
call sym.ntdll.dll_RtlCopyMemory
cmp edi, ebp
je 0x180080383
test rbx, rbx
je 0x18008036a
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
movzx eax, word [rsp + 0x68]
sub ax, r12w
mov word [rsi], ax
jmp 0x18008034e
mov edi, ebp
jmp 0x18008034a
mov eax, 0xc0000017
jmp 0x18008036c

Function at 0x180080620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ecx, dword [rcx + 0x20]
mov eax, ecx
and al, 3
cmp al, 1
jne 0x18008069f
test cl, 1
je 0x180080665
mov r9d, 8
lea r8, [rdi + 8]
mov rcx, 0xfffffffffffffffe
lea edx, [r9 - 3]
call sym.ntdll.dll_NtSetInformationThread
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x180080665
call sym.ntdll.dll_NtClose
mov r8, qword [rdi + 0x10]
lea rax, [rdi + 0x24]
cmp r8, rax
jne 0x1800c5556
mov rcx, qword [rdi]
call sym.ntdll.dll_NtClose
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp sym.ntdll.dll_RtlFreeHeap
and qword [rsp + 0x28], 0
xor r9d, r9d
and qword [rsp + 0x20], 0
xor edx, edx
mov r8, qword [rdi + 0x10]
mov rcx, qword [rdi]
call sym.ntdll.dll_NtAdjustPrivilegesToken
mov ecx, dword [rdi + 0x20]
jmp 0x180080638
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
nop
jmp 0x180080676
Function at 0x180080b60
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1801724e0]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rax, rcx
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [section..00cfg]
add eax, eax
jne 0x1800c5716
xor eax, eax
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.18008b0e0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
lea rcx, [rsp + 0x60]
mov word [rsp + 0x40], ax
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp qword [0x18015cfd8], rdi
mov ecx, 0x208
mov word [rsp + 0x42], cx
je 0x1800c5826
movzx ebx, word [0x18015cfd0]
xor edx, edx
mov rcx, qword gs:[0x60]
add ebx, eax
add rbx, 2
mov r8, rbx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1800c57b2
mov eax, dword [0x180156a70]
test al, 3
je 0x1800c57a3
lea rax, str.Failed_to_reallocate_the_system_dirs_string___n
xor r9d, r9d
lea r8, str.LdrpInitializePerUserWindowsDirectory
mov qword [rsp + 0x20], rax
mov edx, 0xc81
lea rcx, [0x180118390]
call fcn.1800ca394
mov eax, dword [0x180156a70]
test al, 0x10
je 0x1800c57a8
int3
mov eax, 0xc0000017
jmp 0x180080ba8
lea rdx, [0x18015cfd0]
mov word [rsp + 0x30], di
lea rcx, [rsp + 0x30]
mov word [rsp + 0x32], bx
call sym.ntdll.dll_RtlAppendUnicodeStringToString
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call sym.ntdll.dll_RtlAppendUnicodeStringToString
lea rdx, [0x1801183ac]
lea rcx, [rsp + 0x30]
call sym.ntdll.dll_RtlAppendUnicodeToString
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [0x18015cfd8]
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [0x18015cfd0], xmm0
psrldq xmm0, 8
movq qword [0x18015cfc8], xmm0
call fcn.1800d9624
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call sym.ntdll.dll_LdrAddDllDirectory
nop
jmp 0x180080ba6

Function at 0x180082f30
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword gs:[0x60]
mov rdi, rcx
test dword [rax + 0xbc], 0x100
jne 0x1800c63ac
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea rcx, [0x18015b560]
xor esi, esi
call sym.ntdll.dll_RtlEnterCriticalSection
mov rcx, qword [rdi + 0x30]
call fcn.1800d500c
test al, al
jne 0x1800c640b
mov rcx, rdi
call fcn.1800d4b24
mov esi, eax
test eax, eax
js 0x1800c640b
mov rbx, qword [0x18015b590]
lea rbp, [0x18015b590]
jmp 0x1800c6406
mov rax, qword [rbx + 0x30]
mov rbx, qword [rbx]
test rax, rax
je 0x1800c6406
mov r8d, dword [rdi + 0x40]
mov r9, rdi
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rdi + 0x60]
call qword [section..00cfg]
cmp rbx, rbp
jne 0x1800c63e5
lea rcx, [0x18015b560]
call sym.ntdll.dll_RtlLeaveCriticalSection
mov eax, esi
jmp 0x180082f62
Function at 0x180085dcc
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movzx r12d, word [rdx]
lea rsi, [rcx + 0x1e0]
mov rbx, qword [rsi]
xor edi, edi
mov r15, r8
mov r13, rdx
mov rbp, rcx
cmp rbx, rsi
je 0x180085ecc
lea rcx, [r12 + 2]
mov eax, dword [rbx + 0x28]
cmp rax, rcx
jne 0x1800c6ac1
mov rdx, qword [r13 + 8]
lea rcx, [rbx + 0x2c]
mov r8, r12
call sym.ntdll.dll_RtlCompareMemory
cmp rax, r12
jne 0x1800c6abc
lea rsi, [rbx + 0x18]
mov rax, qword [rsi]
cmp rax, rsi
je 0x180085e5b
mov rcx, qword [r15]
sub rcx, qword [rax + 0x10]
jne 0x180085e51
mov rcx, qword [r15 + 8]
sub rcx, qword [rax + 0x18]
test rcx, rcx
je 0x180085ead
mov rax, qword [rax]
jmp 0x180085e3b
mov rcx, qword gs:[0x60]
mov edx, 8
mov rcx, qword [rcx + 0x30]
lea r8d, [rdx + 0x18]
call sym.ntdll.dll_RtlAllocateHeap
test rax, rax
je 0x1800c6ad2
movups xmm0, xmmword [r15]
movdqu xmmword [rax + 0x10], xmm0
mov rcx, qword [rsi]
cmp qword [rcx + 8], rsi
jne 0x1800c6adc
mov qword [rax], rcx
mov qword [rax + 8], rsi
mov qword [rcx + 8], rax
mov qword [rsi], rax
inc dword [rbx + 0x10]
or dword [rbp + 0x14c], 0x10
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rcx, qword gs:[0x60]
lea r8d, [r12 + 0x2e]
mov edx, 8
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
mov rbx, rax
test rax, rax
je 0x1800c6ad2
lea eax, [r12 + 2]
mov r8, r12
mov dword [rbx + 0x28], eax
lea rcx, [rbx + 0x2c]
mov rdx, qword [r13 + 8]
call sym.ntdll.dll_RtlCopyMemory
xor eax, eax
lea r14, [rbx + 0x18]
mov word [r12 + rbx + 0x2c], ax
mov qword [r14 + 8], r14
mov qword [r14], r14
mov dword [rbx + 0x10], edi
lea edx, [rax + 8]
mov rcx, qword gs:[0x60]
lea r8d, [rax + 0x20]
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
test rax, rax
je 0x1800c6ad2
movups xmm0, xmmword [r15]
movdqu xmmword [rax + 0x10], xmm0
mov rcx, qword [r14]
cmp qword [rcx + 8], r14
jne 0x1800c6ae3
mov qword [rax], rcx
mov qword [rax + 8], r14
mov qword [rcx + 8], rax
mov qword [r14], rax
mov dword [rbx + 0x10], 1
or dword [rbp + 0x14c], 0x10
mov rax, qword [rsi]
cmp qword [rax + 8], rsi
jne 0x1800c6aea
mov qword [rbx], rax
mov qword [rbx + 8], rsi
mov qword [rax + 8], rbx
mov qword [rsi], rbx
jmp 0x180085ea6
lea rcx, [r12 + 2]
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x180085e0f
jmp 0x180085ecc
mov edi, 0xe
jmp 0x180085ead
mov ecx, 3
int 0x29
mov ecx, 3
int 0x29
mov ecx, 3
int 0x29
int3
Function at 0x180086800
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rbx, rcx
lea rdx, str.System_Volume_Information
lea rcx, [rbp - 0x19]
call sym.ntdll.dll_RtlInitUnicodeString
movzx edx, word [rbx]
add dx, word [rbp - 0x19]
mov word [rbp - 0x29], dx
cmp dx, word [rbx]
jb 0x1800c6d0c
cmp dx, word [rbp - 0x19]
jb 0x1800c6d0c
movzx ecx, word [rbx]
mov r14d, 0x5c
mov rax, qword [rbx + 8]
shr rcx, 1
movzx edi, word [rax + rcx*2 - 2]
cmp di, r14w
jne 0x1800c6cb4
add dx, 2
movzx r8d, dx
xor edx, edx
mov word [rbp - 0x27], r8w
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
xor esi, esi
mov qword [rbp - 0x21], rax
test rax, rax
je 0x1800c6cc1
movzx r8d, word [rbx]
mov rcx, rax
mov rdx, qword [rbx + 8]
call sym.ntdll.dll_RtlCopyMemory
movzx eax, word [rbx]
mov word [rbp - 0x29], ax
cmp di, r14w
jne 0x1800c6ccb
movzx r8d, word [rbp - 0x19]
mov rdx, qword [rbp - 0x11]
movzx ecx, ax
add rcx, qword [rbp - 0x21]
call sym.ntdll.dll_RtlCopyMemory
movzx eax, word [rbp - 0x29]
lea rdx, [rbp + 0x77]
add ax, word [rbp - 0x19]
movzx ecx, ax
mov word [rbp - 0x29], ax
mov rax, qword [rbp - 0x21]
shr rcx, 1
mov word [rax + rcx*2], si
lea rcx, [rbp + 0x6f]
call fcn.180086c70
mov ebx, eax
test eax, eax
js 0x1800c6ceb
mov dword [rsp + 0x50], esi
lea rax, [rbp - 0x29]
mov qword [rsp + 0x48], rsi
lea r9, [rbp - 9]
mov dword [rsp + 0x40], 0x201060
lea r8, [rbp + 7]
mov dword [rsp + 0x38], 1
lea rcx, [rbp + 0x67]
mov qword [rbp + 0x17], rax
mov edi, 7
mov rax, qword [rbp + 0x6f]
mov edx, 0x10000
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov dword [rbp + 7], 0x30
mov qword [rbp + 0xf], rsi
mov dword [rbp + 0x1f], 0x240
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], rsi
call sym.ntdll.dll_NtCreateFile
test eax, eax
jns 0x1800c6cfd
mov dword [rsp + 0x50], esi
lea r9, [rbp - 9]
mov qword [rsp + 0x48], rsi
lea r8, [rbp + 7]
mov r14d, 0x21
lea rcx, [rbp + 0x67]
mov dword [rsp + 0x40], r14d
mov edx, 0x1e0000
mov dword [rsp + 0x38], 3
add dx, 2
mov word [rbp - 0x29], dx
jmp 0x180086863
mov eax, 0xc000009a
jmp 0x180086a48
movzx ecx, ax
mov rax, qword [rbp - 0x21]
shr rcx, 1
mov word [rax + rcx*2], r14w
movzx eax, word [rbp - 0x29]
add ax, 2
mov word [rbp - 0x29], ax
jmp 0x1800868b4
mov rcx, qword gs:[0x60]
mov r8, qword [rbp - 0x21]
jmp 0x180086a3b
mov rcx, qword [rbp + 0x67]
call sym.ntdll.dll_NtClose
nop
jmp 0x180086969
mov eax, 0xc000000d
jmp 0x180086a48