joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400026c0
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rdx, [0x140004cd0]
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp + 0xf], 0
lea rax, [rbp - 9]
xorps xmm0, xmm0
mov qword [rbp + 0x17], rax
movdqu xmmword [rbp + 0x27], xmm0
mov dword [rbp + 7], 0x30
mov dword [rbp + 0x1f], 0x240
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
test al, al
je 0x140002728
mov eax, 0xc0000001
jmp 0x140002860
and dword [rsp + 0x50], 0
lea r9, [rbp - 0x19]
and qword [rsp + 0x48], 0
lea r8, [rbp + 7]
mov dword [rsp + 0x40], 0x20
lea rcx, [rbp - 0x29]
mov dword [rsp + 0x38], 1
mov edx, 0x80000000
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x140002850
mov rcx, qword [rbp - 0x29]
lea r8, [rbp + 0x37]
xor eax, eax
mov dword [rsp + 0x20], 5
xorps xmm0, xmm0
mov qword [rbp + 0x47], rax
lea rdx, [rbp - 0x19]
movups xmmword [rbp + 0x37], xmm0
lea r9d, [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x140002836
mov edx, dword [rbp + 0x3f]
lea rcx, [0x140004d10]
mov dword [0x1400870f0], edx
call fcn.1400023b4
mov edx, dword [0x1400870f0]
mov cl, 1
call fcn.140003eec
and qword [rsp + 0x40], 0
lea rcx, [rbp - 0x21]
and dword [rbp - 0x1d], 0
xor r9d, r9d
and dword [rbp - 0x21], 0
xor r8d, r8d
mov qword [rsp + 0x38], rcx
xor edx, edx
mov ecx, dword [0x1400870f0]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov qword [0x1400870e8], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
jns 0x140002844
mov rcx, qword [0x1400870e8]
call fcn.140003f40
mov edx, ebx
lea rcx, [0x140004d40]
jmp 0x14000283f
mov edx, eax
lea rcx, [0x140004d80]
call fcn.1400023b4
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x14000285e
mov edx, eax
lea rcx, [0x140004dc0]
call fcn.1400023b4
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140004130
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rbp
ret
Function at 0x140002880
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov eax, 0x5a4d
mov r14d, edx
mov rsi, rcx
cmp word [rcx], ax
je 0x1400028bd
lea rcx, [0x140004e30]
call fcn.1400023b4
or eax, 0xffffffff
jmp 0x140002a40
movsxd rdi, dword [rcx + 0x3c]
add rdi, rsi
cmp dword [rdi], 0x4550
je 0x1400028d5
lea rcx, [0x140004e60]
jmp 0x1400028b0
mov edx, 0x20b
mov eax, 0x88
cmp word [rdi + 0x18], dx
mov r8d, r14d
lea ecx, [rax - 0x10]
cmovne eax, ecx
mov ecx, dword [rax + rdi]
mov edx, ecx
mov eax, dword [rax + rdi + 4]
mov dword [rsp + 0x88], ecx
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.140002b00
or ebx, 0xffffffff
cmp eax, ebx
jne 0x14000291b
lea rcx, [0x140004e90]
jmp 0x140002a39
mov r13d, eax
mov r8d, r14d
add r13, rsi
mov rcx, rdi
mov edx, dword [r13 + 0x1c]
call fcn.140002b00
mov edx, dword [r13 + 0x24]
mov r8d, r14d
mov rcx, rdi
mov r15d, eax
call fcn.140002b00
mov edx, dword [r13 + 0x20]
mov r8d, r14d
mov rcx, rdi
mov ebp, eax
call fcn.140002b00
cmp r15d, ebx
je 0x140002a32
cmp ebp, ebx
je 0x140002a32
cmp eax, ebx
je 0x140002a32
and dword [rsp + 0x70], 0
lea rcx, [rsi + r15]
mov r12d, eax
lea r15, [rsi + rbp]
mov eax, dword [r13 + 0x18]
add r12, rsi
mov r13, qword [rsp + 0x80]
mov ebp, ebx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x24], eax
test eax, eax
je 0x140002a1f
mov edx, dword [r12]
mov r8d, r14d
mov rcx, rdi
call fcn.140002b00
cmp eax, ebx
je 0x1400029f4
mov rdx, qword [rsp + 0x28]
mov ecx, eax
movzx eax, word [r15]
add rcx, rsi
mov edx, dword [rdx + rax*4]
mov eax, dword [rsp + 0x88]
cmp edx, eax
jb 0x1400029d5
add eax, dword [rsp + 0x20]
cmp edx, eax
jb 0x1400029f4
mov r9, r13
sub r9, rcx
movzx eax, byte [rcx]
movzx r8d, byte [rcx + r9]
sub eax, r8d
jne 0x1400029f0
inc rcx
test r8d, r8d
jne 0x1400029db
test eax, eax
je 0x140002a0e
mov eax, dword [rsp + 0x70]
add r12, 4
inc eax
add r15, 2
mov dword [rsp + 0x70], eax
cmp eax, dword [rsp + 0x24]
jae 0x140002a1f
jmp 0x14000299e
mov r8d, r14d
mov rcx, rdi
call fcn.140002b00
mov ebp, eax
cmp eax, ebx
jne 0x140002a2e
mov rdx, r13
lea rcx, [0x140004f00]
call fcn.1400023b4
mov eax, ebp
jmp 0x140002a40
lea rcx, [0x140004ec0]
call fcn.1400023b4
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002a58
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rdi, rdx
mov r9, rcx
cmp r8, rcx
jb 0x140002ac6
sub r8d, r9d
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140002ac6
movsxd rcx, dword [rcx + 0x3c]
add rcx, r9
cmp dword [rcx], 0x4550
jne 0x140002ac6
movzx r11d, word [rcx + 0x14]
xor edx, edx
movzx esi, word [rcx + 6]
add r11, rcx
test rsi, rsi
je 0x140002ac6
xor ebx, ebx
lea r10, [r11 + 0x20]
mov ecx, dword [r10 + 4]
cmp ecx, r8d
ja 0x140002ab8
add ecx, dword [r10]
cmp ecx, r8d
ja 0x140002ad8
inc edx
inc rbx
add r10, 0x28
cmp rbx, rsi
jl 0x140002aa7
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
cmp edx, 0xffffffff
je 0x140002ac6
movsxd rdx, edx
test rdi, rdi
je 0x140002af0
lea rax, [rdx + rdx*4]
mov ecx, dword [r11 + rax*8 + 0x28]
mov dword [rdi], ecx
lea rax, [rdx + rdx*4]
mov eax, dword [r11 + rax*8 + 0x24]
add rax, r9
jmp 0x140002ac8

Function at 0x140002b00
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movzx eax, word [rcx + 0x14]
lea r9, [rcx + 0x18]
movzx r11d, word [rcx + 6]
add r9, rax
xor r10d, r10d
mov ebx, r8d
test r11d, r11d
je 0x140002b40
mov r8d, dword [r9 + 0xc]
cmp r8d, edx
ja 0x140002b34
mov ecx, dword [r9 + 8]
add ecx, r8d
cmp ecx, edx
ja 0x140002b49
add r9, 0x28
inc r10d
cmp r10d, r11d
jl 0x140002b20
or eax, 0xffffffff
mov rbx, qword [rsp + 8]
ret
mov eax, dword [r9 + 0x14]
sub eax, r8d
add edx, eax
or eax, 0xffffffff
cmp edx, ebx
cmovb eax, edx
jmp 0x140002b43
Function at 0x140002bd8
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbp, rdx
mov r13, rcx
call fcn.140002e28
mov rsi, rax
test rax, rax
jne 0x140002c13
lea rcx, [0x140004f50]
jmp 0x140002d74
mov rdi, qword [rax]
test rdi, rdi
jne 0x140002c27
lea rcx, [0x140004f70]
jmp 0x140002d74
mov rcx, r13
call fcn.140002620
movsxd r14, eax
cmp r14d, 0xffffffff
je 0x140002d79
cmp r14, qword [rsi + 0x10]
jb 0x140002c4e
lea rcx, [0x140004fd0]
jmp 0x140002d74
mov rax, qword [rsi]
mov r12d, dword [rax + r14*4]
mov rax, qword [0x140087108]
test rax, rax
jne 0x140002d2f
lea r8, [rdi + 0xfffffff]
mov rdx, rdi
lea rcx, [0x140005000]
call fcn.1400023b4
and dword [0x140087100], 0
mov eax, r12d
sar eax, 4
xor ecx, ecx
movsxd rbx, eax
add rbx, rdi
call fcn.140003854
mov rcx, rax
lea rdx, [0x140087100]
mov r8, rbx
call fcn.140002a58
mov qword [0x140087108], rax
test rax, rax
je 0x140002d56
mov r8d, dword [0x140087100]
test r8d, r8d
je 0x140002d56
mov rdx, rax
lea rcx, [0x140005050]
call fcn.1400023b4
mov rdx, qword [0x140087108]
cmp rdx, rdi
jae 0x140002d12
mov r8d, dword [0x140087100]
lea rcx, [0x140005050]
sub edx, edi
mov qword [0x140087108], rdi
add r8d, edx
mov rdx, rdi
mov dword [0x140087100], r8d
call fcn.1400023b4
mov rdx, qword [0x140087108]
mov r8d, dword [0x140087100]
lea rcx, [0x140005000]
add r8, rdx
call fcn.1400023b4
mov rax, qword [0x140087108]
mov r10d, dword [0x140087100]
xor ecx, ecx
xor edx, edx
test r10d, r10d
je 0x140002d6d
mov r9b, byte [rcx + rax]
mov r8d, ecx
cmp r9b, 0x90
je 0x140002d5f
cmp r9b, 0xcc
je 0x140002d5f
xor edx, edx
jmp 0x140002d66
lea rcx, [0x140005020]
jmp 0x140002d74
inc edx
cmp edx, 0xc
je 0x140002d98
inc ecx
cmp ecx, r10d
jb 0x140002d3f
lea rcx, [0x140005080]
call fcn.1400023b4
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rbx, [rax - 0xb]
add rbx, r8
je 0x140002d6d
mov rdx, rbx
lea rcx, [0x1400050b0]
call fcn.1400023b4
mov rdx, rbp
mov rcx, rbx
call fcn.14000121c
mov rbp, rax
test rax, rax
je 0x140002d79
mov ecx, r12d
lea rdx, [rsp + 0x60]
and ecx, 0xf
sub ebx, edi
shl ebx, 4
mov r8d, 4
or ebx, ecx
mov dword [rsp + 0x60], ebx
mov dword [rax + 0x24], r12d
mov dword [rax + 0x20], r14d
mov eax, dword [rsp + 0x60]
mov dword [rbp + 0x28], eax
sar r12d, 4
movsxd rax, r12d
add rax, rdi
mov qword [rbp + 0x30], rax
mov rax, qword [rsi]
lea rcx, [rax + r14*4]
call fcn.140003fa8
mov r9d, dword [rbp + 0x28]
lea rcx, [0x1400050d0]
mov r8d, dword [rbp + 0x24]
mov rdx, r13
call fcn.1400023b4
mov rax, rbp
jmp 0x140002d7b
Function at 0x140002e28
Capabilities:
Access pe header
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [0x1400870f8]
xor r15d, r15d
test rax, rax
jne 0x140002ecf
lea rcx, [rbp - 0x30]
call fcn.140003854
mov rsi, rax
test rax, rax
je 0x140002ecd
cmp dword [rbp - 0x30], r15d
je 0x140002ecd
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov rdi, rax
mov r14d, r15d
movzx eax, word [rax + 0x14]
lea rbx, [rdi + 0x18]
add rbx, rax
cmp r15w, word [rdi + 6]
jae 0x140002ecd
mov rax, qword [rbx]
lea rdx, [0x140004f40]
mov r8d, 5
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x18]
mov byte [rbp - 0x10], r15b
call sub.ntoskrnl.exe_strncmp
test eax, eax
je 0x140002ef5
movzx eax, word [rdi + 6]
add rbx, 0x28
inc r14d
cmp r14d, eax
jb 0x140002e98
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140004130
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov r14d, 0xd
mov dword [rbp - 0x28], 0xefc1f88b
mov dword [rbp - 0x24], 0x20e78307
mov edi, r15d
mov dword [rbp - 0x20], 0xfff25
mov byte [rbp - 0x1c], r15b
cmp dword [rbx + 8], r14d
je 0x140002ecd
mov eax, dword [rbx + 0xc]
lea rdx, [rbp - 0x28]
add rax, rsi
mov ecx, edi
add rcx, rax
mov r8, r14
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rax, r14
je 0x140002f48
mov eax, dword [rbx + 8]
inc edi
sub eax, r14d
cmp edi, eax
jb 0x140002f1d
jmp 0x140002ecd
mov edx, dword [rbx + 0xc]
add rdx, r14
mov ecx, edi
add rdx, rsi
add rdx, rcx
cmp byte [rdx], 0x4c
jne 0x140002ecd
cmp byte [rdx + 1], 0x8d
jne 0x140002ecd
cmp byte [rdx + 2], 0x15
jne 0x140002ecd
movsxd rax, dword [rdx + 3]
test eax, eax
je 0x140002ecd
add rax, 7
add rax, rdx
mov qword [0x1400870f8], rax
jmp 0x140002ecf
Function at 0x140003004
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14, rdx
lea r9, [rsp + 0x50]
xor edx, edx
mov rbp, rcx
xor r8d, r8d
lea ebx, [rdx + 5]
mov ecx, ebx
call fcn.140003a74
cmp eax, 0xc0000004
je 0x140003041
mov eax, 0xc0000001
jmp 0x1400030e0
mov eax, dword [rsp + 0x50]
xor ecx, ecx
mov r8d, 0x63726f50
lea edx, [rax + rax]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
jne 0x140003065
mov eax, 0xc0000017
jmp 0x1400030e0
mov r8d, dword [rsp + 0x50]
xor r9d, r9d
add r8d, r8d
mov rdx, rdi
mov ecx, ebx
call fcn.140003a74
mov ebx, eax
test eax, eax
jns 0x14000308f
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x1400030e0
mov rbx, rdi
mov esi, 0xc0000225
cmp qword [rbx + 0x40], 0
je 0x1400030c5
lea rcx, [rbx + 0x38]
mov r8b, 1
mov rdx, r14
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
jne 0x1400030c5
mov rcx, qword [rbx + 0x50]
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov esi, eax
test eax, eax
jns 0x1400030d0
mov eax, dword [rbx]
test eax, eax
je 0x1400030d0
add rbx, rax
jmp 0x140003097
mov edx, 0x63726f50
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400033c4
Capabilities:
Find process by pid

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor sil, sil
mov edi, ecx
xor r15d, r15d
cmp dword [0x140087110], r15d
jne 0x1400033ee
mov eax, 0xc0000225
jmp 0x140003558
lea rdx, [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140003558
xor r8d, r8d
lea r9, [rsp + 0x68]
xor edx, edx
lea r12d, [r8 + 5]
mov ecx, r12d
call fcn.140003a74
mov ebx, eax
cmp eax, 0xc0000004
jne 0x14000354b
mov eax, dword [rsp + 0x68]
xor ecx, ecx
mov r8d, 0x63726f50
lea edx, [rax + rax]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r14, rax
test rax, rax
jne 0x14000344e
mov ebx, 0xc0000017
jmp 0x14000354b
mov r8d, dword [rsp + 0x68]
xor r9d, r9d
add r8d, r8d
mov rdx, r14
mov ecx, r12d
call fcn.140003a74
mov ebx, eax
test eax, eax
js 0x140003540
mov rbx, r14
cmp qword [r14 + 0x50], rdi
je 0x14000348a
mov eax, dword [rbx]
test eax, eax
je 0x140003518
add rbx, rax
cmp qword [rbx + 0x50], rdi
jne 0x140003477
xor ebp, ebp
lea esi, [rbp + 1]
cmp dword [rbx + 4], ebp
jbe 0x140003503
lea r12, [rbp*4]
add r12, rbp
lea rdx, [rsp + 0x70]
add r12, r12
mov rcx, qword [rbx + r12*8 + 0x130]
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
test eax, eax
js 0x1400034fc
mov edx, dword [0x140087110]
add rdx, qword [rsp + 0x70]
prefetchw byte [rdx]
mov eax, dword [rdx]
mov ecx, eax
and ecx, 0xfffffffb
lock cmpxchg dword [rdx], ecx
jne 0x1400034c9
test al, 4
je 0x1400034f1
mov r8d, dword [rbx + r12*8 + 0x130]
lea rcx, [0x140005260]
add r15d, esi
mov edx, edi
call fcn.1400023b4
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add ebp, esi
cmp ebp, dword [rbx + 4]
jb 0x140003494
test r15d, r15d
jne 0x140003521
lea rcx, [0x1400052f0]
mov edx, edi
call fcn.1400023b4
jmp 0x140003533
lea rcx, [0x1400052b0]
jmp 0x14000350f
mov r8d, edi
lea rcx, [0x140005350]
mov edx, r15d
call fcn.1400023b4
neg sil
sbb ebx, ebx
not ebx
and ebx, 0xc0000225
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000366c
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
and qword [rsp + 0x50], 0
lea rdi, [rcx + 0x70]
mov rbx, rcx
lea rax, [0x1400035c0]
mov qword [rcx + 0x68], rax
lea rax, [0x140003590]
mov ecx, 0x1c
rep stosq qword [rdi], rax
lea rax, [0x140003570]
mov qword [rbx + 0x70], rax
mov qword [rbx + 0x80], rax
lea rax, [0x1400035f0]
mov qword [rbx + 0x90], rax
call fcn.1400026c0
test eax, eax
jns 0x1400036dc
lea rcx, [0x140005430]
call fcn.1400023b4
mov eax, 0xc0000001
jmp 0x140003846
call fcn.140003af0
test al, al
jne 0x1400036ee
lea rcx, [0x140005460]
jmp 0x1400036cd
lea rcx, [0x140005490]
call fcn.1400023b4
lea rcx, [0x140087110]
call fcn.1400030f4
mov edi, eax
test eax, eax
jns 0x140003721
mov edx, eax
lea rcx, [0x1400054d0]
call fcn.1400023b4
mov eax, edi
jmp 0x140003846
lea rdx, [0x140005510]
lea rcx, [0x140087118]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x140005540]
lea rcx, [0x140087128]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x50]
mov r9d, 0x22
mov qword [rsp + 0x30], rax
lea r8, [0x140087118]
mov byte [rsp + 0x28], 0
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov edi, eax
test eax, eax
jns 0x14000378c
lea rcx, [0x140005570]
call fcn.1400023b4
jmp 0x14000371a
cmp qword [rsp + 0x50], 0
jne 0x1400037aa
lea rcx, [0x1400055a0]
call fcn.1400023b4
mov eax, 0xc00000e9
jmp 0x140003846
movzx edx, word [0x140087118]
lea rcx, [0x1400055d0]
mov r8, qword [0x140087120]
shr rdx, 1
call fcn.1400023b4
mov rax, qword [rsp + 0x50]
lea rdx, [0x140087118]
lea rcx, [0x140087128]
or dword [rax + 0x30], 4
mov rax, qword [rsp + 0x50]
btr dword [rax + 0x30], 7
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov edi, eax
test eax, eax
jns 0x1400037fd
lea rcx, [0x140005610]
jmp 0x140003785
movzx r9d, word [0x140087118]
lea rcx, [0x140005640]
movzx edx, word [0x140087128]
mov rax, qword [0x140087120]
mov r8, qword [0x140087130]
shr r9, 1
shr rdx, 1
mov qword [rsp + 0x20], rax
call fcn.1400023b4
call fcn.14000220c
mov edx, eax
lea rcx, [0x140005680]
call fcn.1400023b4
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140003e1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov edx, 0x14
mov dword [rbp - 0x60], 0x20707249
xor ecx, ecx
mov dword [rbp - 0x5c], 0x2b707249
mov dword [rbp - 0x58], 0x656c6946
mov dword [rbp - 0x54], 0x6174754d
mov dword [rbp - 0x50], 0x7346744e
mov dword [rbp - 0x4c], 0x616d6553
mov dword [rbp - 0x48], 0x52777445
mov dword [rbp - 0x44], 0x6e657645
mov dword [rbp - 0x40], 0x20646156
mov dword [rbp - 0x3c], 0x73646156
mov dword [rbp - 0x38], 0x61436d4d
mov dword [rbp - 0x34], 0x20206f49
mov dword [rbp - 0x30], 0x74696157
mov dword [rbp - 0x2c], 0x65536d4d
mov dword [rbp - 0x28], 0x43504c41
mov dword [rbp - 0x24], 0x47777445
mov dword [rbp - 0x20], 0x206c644d
mov dword [rbp - 0x1c], 0x65726854
mov dword [rbp - 0x18], 0x63536343
mov dword [rbp - 0x14], 0x4b677844
call fcn.140003f4c
mov eax, eax
mov eax, dword [rbp + rax*4 - 0x60]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140004130
add rsp, 0x80
pop rbp
ret
Function at 0x4187a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418946
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00437180
xorps xmm15, xmm15
mov r14, qword [0x0062d908]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x41880b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x418827
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00452480
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
test rbx, rbx
jbe 0x41884b
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x41885f
cmp rbx, 0x1000
jae 0x418815
jmp 0x4188c9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x418871
xor edx, edx
jmp 0x4188c0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00437180
xorps xmm15, xmm15
mov r14, qword [0x0062d908]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x418855
jmp 0x418840
call fcn.00468460
xorps xmm15, xmm15
mov r14, qword [0x0062d908]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043b220
lea rax, [0x004f4c07]
mov ebx, 0x18
call fcn.0043bac0
mov rax, qword [rsp + 0x38]
call fcn.0043b800
lea rax, [0x004f4cc7]
mov ebx, 0x19
call fcn.0043bac0
mov rax, qword [rsp + 0x30]
nop
call fcn.0043b800
call fcn.0043b460
call fcn.0043b2a0
lea rax, [0x004f78fc]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00439a60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464a20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004187a0
Function at 0x418980
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418baa
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00437220
xorps xmm15, xmm15
mov r14, qword [0x0062d908]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4189f9
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x418a20
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rcx
call fcn.00452480
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x418a45
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x418a59
cmp rbx, 0x1000
jae 0x418a03
nop dword [rax]
jmp 0x418ad4
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x418a6d
xor esi, esi
jmp 0x418aca
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00437220
xorps xmm15, xmm15
mov r14, qword [0x0062d908]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x418a4f
jmp 0x418a34
call fcn.00468460
xorps xmm15, xmm15
mov r14, qword [0x0062d908]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x418b4c
call fcn.0043b220
lea rax, [0x004f52a3]
mov ebx, 0x19
call fcn.0043bac0
mov rax, qword [rsp + 0x68]
call fcn.0043b800
lea rax, [0x004f4cc7]
mov ebx, 0x19
call fcn.0043bac0
mov eax, dword [rsp + 0x34]
call fcn.0043b800
call fcn.0043b460
call fcn.0043b2a0
lea rax, [0x004f0df9]
mov ebx, 0xd
call fcn.00439a60
cmp eax, 0x5af
je 0x418af7
call fcn.0043b220
lea rax, [0x004f52a3]
mov ebx, 0x19
call fcn.0043bac0
mov rax, qword [rsp + 0x38]
call fcn.0043b800
lea rax, [0x004f4cc7]
mov ebx, 0x19
nop
call fcn.0043bac0
mov eax, dword [rsp + 0x34]
call fcn.0043b800
call fcn.0043b460
call fcn.0043b2a0
lea rax, [0x004f7149]
mov ebx, 0x1f
call fcn.00439a60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464a20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00418980
Function at 0x14000e100
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x14000e121
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000e14e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000e150
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000e1a9
test ecx, ecx
jle 0x14000e189
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000e1a9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000e1a9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add byte [rax], al
invalid