joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c18f0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x118
mov rax, qword [0x1415b0b50]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r10d, r8d
mov r11d, edx
mov r9d, ecx
test r8d, r8d
jle 0x1400c1a90
mov ecx, 1
mov dword [rsp], 0xedb88320
mov eax, ecx
nop dword [rax]
mov dword [rsp + rax*4], ecx
inc rax
add ecx, ecx
cmp rax, 0x20
jl 0x1400c1930
xor r8d, r8d
mov eax, dword [rsp + r8]
xor edx, edx
lea rcx, [rsp]
test eax, eax
je 0x1400c195e
nop
test al, 1
je 0x1400c1956
xor edx, dword [rcx]
add rcx, 4
shr eax, 1
jne 0x1400c1950
mov dword [rsp + r8 + 0x80], edx
add r8, 4
cmp r8, 0x80
jl 0x1400c1941
xor r8d, r8d
mov eax, dword [rsp + r8 + 0x80]
xor edx, edx
lea rcx, [rsp + 0x80]
test eax, eax
je 0x1400c199e
nop dword [rax]
test al, 1
je 0x1400c1996
xor edx, dword [rcx]
add rcx, 4
shr eax, 1
jne 0x1400c1990
mov dword [rsp + r8], edx
add r8, 4
cmp r8, 0x80
jl 0x1400c1976
nop
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rsp + r8]
xor edx, edx
lea rcx, [rsp]
test eax, eax
je 0x1400c19de
nop
test al, 1
je 0x1400c19d6
xor edx, dword [rcx]
add rcx, 4
shr eax, 1
jne 0x1400c19d0
mov dword [rsp + r8 + 0x80], edx
add r8, 4
cmp r8, 0x80
jl 0x1400c19c0
test r10b, 1
je 0x1400c1a1c
xor ecx, ecx
lea rax, [rsp + 0x80]
test r9d, r9d
je 0x1400c1a19
test r9b, 1
je 0x1400c1a10
xor ecx, dword [rax]
add rax, 4
shr r9d, 1
jne 0x1400c1a08
mov r9d, ecx
sar r10d, 1
je 0x1400c1a8d
xor r8d, r8d
mov eax, dword [rsp + r8 + 0x80]
xor edx, edx
lea rcx, [rsp + 0x80]
test eax, eax
je 0x1400c1a4e
nop word [rax + rax]
test al, 1
je 0x1400c1a46
xor edx, dword [rcx]
add rcx, 4
shr eax, 1
jne 0x1400c1a40
mov dword [rsp + r8], edx
add r8, 4
cmp r8, 0x80
jl 0x1400c1a24
test r10b, 1
je 0x1400c1a84
xor ecx, ecx
lea rax, [rsp]
test r9d, r9d
je 0x1400c1a81
test r9b, 1
je 0x1400c1a78
xor ecx, dword [rax]
add rax, 4
shr r9d, 1
jne 0x1400c1a70
mov r9d, ecx
sar r10d, 1
jne 0x1400c19b0
xor r9d, r11d
mov eax, r9d
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400fb630
add rsp, 0x118
ret
jmp 0x1400c18f0
Function at 0x1400c1dc0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x118
mov rax, qword [0x1415b0b50]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r10d, r8d
mov r11d, edx
mov r9d, ecx
test r8d, r8d
jle 0x1400c1a90
mov ecx, 1
mov dword [rsp], 0xedb88320
mov eax, ecx
nop dword [rax]
mov dword [rsp + rax*4], ecx
inc rax
add ecx, ecx
cmp rax, 0x20
jl 0x1400c1930
xor r8d, r8d
mov eax, dword [rsp + r8]
xor edx, edx
lea rcx, [rsp]
test eax, eax
je 0x1400c195e
nop
test al, 1
je 0x1400c1956
xor edx, dword [rcx]
add rcx, 4
shr eax, 1
jne 0x1400c1950
mov dword [rsp + r8 + 0x80], edx
add r8, 4
cmp r8, 0x80
jl 0x1400c1941
xor r8d, r8d
mov eax, dword [rsp + r8 + 0x80]
xor edx, edx
lea rcx, [rsp + 0x80]
test eax, eax
je 0x1400c199e
nop dword [rax]
test al, 1
je 0x1400c1996
xor edx, dword [rcx]
add rcx, 4
shr eax, 1
jne 0x1400c1990
mov dword [rsp + r8], edx
add r8, 4
cmp r8, 0x80
jl 0x1400c1976
nop
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rsp + r8]
xor edx, edx
lea rcx, [rsp]
test eax, eax
je 0x1400c19de
nop
test al, 1
je 0x1400c19d6
xor edx, dword [rcx]
add rcx, 4
shr eax, 1
jne 0x1400c19d0
mov dword [rsp + r8 + 0x80], edx
add r8, 4
cmp r8, 0x80
jl 0x1400c19c0
test r10b, 1
je 0x1400c1a1c
xor ecx, ecx
lea rax, [rsp + 0x80]
test r9d, r9d
je 0x1400c1a19
test r9b, 1
je 0x1400c1a10
xor ecx, dword [rax]
add rax, 4
shr r9d, 1
jne 0x1400c1a08
mov r9d, ecx
sar r10d, 1
je 0x1400c1a8d
xor r8d, r8d
mov eax, dword [rsp + r8 + 0x80]
xor edx, edx
lea rcx, [rsp + 0x80]
test eax, eax
je 0x1400c1a4e
nop word [rax + rax]
test al, 1
je 0x1400c1a46
xor edx, dword [rcx]
add rcx, 4
shr eax, 1
jne 0x1400c1a40
mov dword [rsp + r8], edx
add r8, 4
cmp r8, 0x80
jl 0x1400c1a24
test r10b, 1
je 0x1400c1a84
xor ecx, ecx
lea rax, [rsp]
test r9d, r9d
je 0x1400c1a81
test r9b, 1
je 0x1400c1a78
xor ecx, dword [rax]
add rax, 4
shr r9d, 1
jne 0x1400c1a70
mov r9d, ecx
sar r10d, 1
jne 0x1400c19b0
xor r9d, r11d
mov eax, r9d
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400fb630
add rsp, 0x118
ret
jmp 0x1400c18f0
Function at 0x1400c6810
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rbp, rdx
mov rdi, rcx
mov ecx, 0x90
call fcn.1400f95e4
mov rbx, rax
mov qword [rsp + 0x70], rax
xor esi, esi
test rax, rax
je 0x1400c6878
mov edx, 0x50300
mov rcx, rax
call fcn.1400517e0
lea rax, vtable.QWinOverlappedIoNotifierPrivate.0
mov qword [rbx], rax
mov qword [rbx + 0x70], 0xffffffffffffffff
lea rax, [0x141468e50]
mov qword [rbx + 0x88], rax
jmp 0x1400c687b
mov rbx, rsi
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.140051610
nop
lea rax, vtable.QWinOverlappedIoNotifier.0
mov qword [rdi], rax
mov rbx, qword [rdi + 8]
or edx, 0xffffffff
mov rcx, qword [0x1415b4870]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp qword [0x1415b4860], 0
jne 0x1400c68d8
mov ecx, 0x48
call fcn.1400f95e4
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400c68d1
mov rcx, rax
call fcn.1400c6710
mov rsi, rax
mov qword [0x1415b4860], rsi
inc dword [0x1415b4868]
mov rcx, qword [0x1415b4870]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xff
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [rbx + 0x78], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 0x80], rax
mov dword [rsp + 0x28], 2
lea rax, [0x1414b9710]
mov qword [rsp + 0x20], rax
mov r9, rdi
lea r8, [0x141559de0]
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.140053980
lea rcx, [rsp + 0x70]
call fcn.1400519e0
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400fc0dc
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400fbf44
Function at 0x140005e50
Capabilities:
Access pe header
Allocate or change rwx memory

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140020270]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0xc0000001
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
test rax, rax
je 0x140005eea
and dword [rsp + 0x40], 0
mov eax, dword [rax + 0x54]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
mov dword [rsp + 0x30], eax
test eax, eax
js 0x140005ef3
mov r8, qword [rsp + 0x48]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.14001af00
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
jmp 0x140005eef
mov eax, 0xc000000d
mov dword [rsp + 0x30], eax
jmp 0x140005ef9
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140018b90
add rsp, 0x68
ret

Function at 0x140006700
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, qword [rsp + 0x30]
mov r11, rcx
test rbx, rbx
je 0x140006762
test rcx, rcx
je 0x140006762
test r9, r9
je 0x140006762
mov r10, qword [rsp + 0x28]
xor edx, edx
add r10, 0xfffffffffffffff1
je 0x14000675b
xor ecx, ecx
mov r8b, byte [rcx + r11]
cmp r8b, 0xcc
je 0x14000673f
lea rax, [rcx + rdx]
cmp r8b, byte [rax + r9]
jne 0x140006753
inc rcx
cmp rcx, 0xf
jb 0x14000672b
lea rax, [rdx + r9]
mov qword [rbx], rax
xor eax, eax
jmp 0x140006767
inc rdx
cmp rdx, r10
jb 0x140006729
mov eax, 0xc0000225
jmp 0x140006767
mov eax, 0xc000000d
mov rbx, qword [rsp + 8]
ret
Function at 0x1400345e8
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r14, rdx
mov r15, rcx
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov ebx, 0x100000
mov ecx, 0x40
mov edx, ebx
mov rbp, rax
call fcn.140006b00
mov rsi, rax
mov rdi, rax
test r14, r14
jne 0x14003463a
mov eax, 0xc000000d
jmp 0x14003475e
test rsi, rsi
jne 0x140034649
mov eax, 0xc0000017
jmp 0x14003475e
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
lea ecx, [r9 + 5]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov ebx, eax
test eax, eax
jns 0x140034675
mov edx, 0x4b555341
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x14003475c
mov ebx, 0xc0000225
cmp qword [rsi + 0x50], rbp
je 0x14003468f
mov eax, dword [rdi]
test eax, eax
je 0x140034691
add rdi, rax
cmp qword [rdi + 0x50], rbp
jne 0x140034680
xor ebx, ebx
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
test rax, rax
setne r12b
test ebx, ebx
js 0x140034742
xor ebp, ebp
mov ebx, 0xc0000225
cmp dword [rdi + 4], ebp
jbe 0x140034742
lea rcx, [rbp*4]
add rcx, rbp
add rcx, rcx
mov r15, qword [rdi + rcx*8 + 0x130]
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentThreadId]
cmp r15, rax
je 0x140034737
mov rdx, r14
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
mov rcx, qword [r14]
mov ebx, eax
test rcx, rcx
je 0x140034742
call qword [sym.imp.ntoskrnl.exe_PsGetThreadTeb]
test rax, rax
je 0x14003472a
cmp qword [rax + 0x78], 0
jne 0x14003472a
test r12b, r12b
je 0x140034719
cmp dword [rax + 0x21a8], 0
je 0x14003472a
cmp dword [rax + 0x202c], 0
jmp 0x140034728
cmp qword [rax + 0x2c8], 0
je 0x14003472a
cmp qword [rax + 0x58], 0
jne 0x140034742
mov rcx, qword [r14]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
and qword [r14], 0
inc ebp
cmp ebp, dword [rdi + 4]
jb 0x1400346b9
mov edx, 0x4b555341
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp qword [r14], 0
mov eax, 0xc0000225
cmove ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140034ee4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140020270]
xor rax, rsp
mov qword [rbp - 8], rax
mov eax, 0x1000
mov dword [rsp + 0x28], 0x40
mov rsi, rdx
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov dword [rsp + 0x20], eax
xor ebx, ebx
mov dword [rbp - 0x40], 0x68
lea rdx, [rbp - 0x18]
mov qword [rbp - 0x18], rbx
or rcx, 0xffffffffffffffff
mov dword [rbp - 0x2c], ebx
lea r9, [rbp - 0x10]
mov dword [rbp - 0x3c], 0x6800
xor r8d, r8d
mov dword [rbp - 0x38], 0x6a0000
mov dword [rbp - 0x34], 0xe8006a
mov dword [rbp - 0x30], 0xba000000
mov dword [rbp - 0x28], 0x1e7e02c7
mov dword [rbp - 0x24], 0xbac037
mov dword [rbp - 0x20], 0x89000000
mov dword [rbp - 0x1c], 0x4c202
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x140035019
movzx eax, word [rsi]
mov rbx, qword [rbp - 0x18]
add rbx, 0x200
mov word [rbx], ax
movzx eax, word [rsi + 2]
mov word [rbx + 2], ax
mov eax, dword [rbp - 0x18]
add eax, 0x210
mov dword [rbx + 4], eax
movzx r8d, word [rsi]
mov rdx, qword [rsi + 8]
mov ecx, eax
call fcn.14001b000
mov rax, qword [rbp - 0x18]
movups xmm0, xmmword [rbp - 0x40]
movups xmm1, xmmword [rbp - 0x30]
movups xmmword [rax], xmm0
movsd xmm0, qword [rbp - 0x20]
movups xmmword [rax + 0x10], xmm1
movsd qword [rax + 0x20], xmm0
mov rcx, qword [rbp - 0x18]
lea eax, [rcx + 0x5e0]
mov dword [rcx + 1], eax
mov rax, qword [rbp - 0x18]
mov dword [rax + 6], ebx
mov rax, qword [rbp - 0x18]
sub edi, eax
sub edi, 0x13
mov dword [rax + 0xf], edi
mov rcx, qword [rbp - 0x18]
lea eax, [rcx + 0x5e8]
mov dword [rcx + 0x14], eax
mov rcx, qword [rbp - 0x18]
lea eax, [rcx + 0x5ec]
mov dword [rcx + 0x1f], eax
mov rax, qword [rbp - 0x18]
jmp 0x14003501b
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140018b90
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140035040
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x140020270]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor r14d, r14d
mov dword [rsp + 0x28], 0x40
mov eax, 0x1000
mov qword [rbp + 0x27], r14
mov rsi, rdx
mov qword [rbp + 0x2f], rax
mov rdi, rcx
mov qword [rbp - 0x1d], r14
lea rdx, [rbp + 0x27]
mov qword [rbp - 9], r14
or rcx, 0xffffffffffffffff
mov qword [rbp + 3], r14
lea r9, [rbp + 0x2f]
mov qword [rbp + 0x13], r14
xor r8d, r8d
mov dword [rsp + 0x20], eax
mov dword [rbp - 0x29], 0x28ec8348
mov dword [rbp - 0x25], 0x48c93148
mov dword [rbp - 0x21], 0xb849d231
mov qword [rbp - 0x15], 0xb949
mov dword [rbp - 0xd], 0xb8480000
mov dword [rbp - 1], 0xba48d0ff
mov dword [rbp + 0xb], 0x1e7e02c7
mov dword [rbp + 0xf], 0xba48c037
mov dword [rbp + 0x1b], 0x83480289
mov word [rbp + 0x1f], 0x28c4
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x1400351a3
mov rbx, qword [rbp + 0x27]
mov rdx, rsi
add rbx, 0x200
mov rcx, rbx
mov dword [rbx], 0x3d00000
mov rax, qword [rbp + 0x27]
add rax, 0x210
mov qword [rbx + 8], rax
call fcn.14000603c
mov rcx, qword [rbp + 0x27]
movaps xmm0, xmmword [rbp - 0x29]
movaps xmm1, xmmword [rbp - 0x19]
movzx eax, word [rbp + 0x1f]
movups xmmword [rcx], xmm0
movaps xmm0, xmmword [rbp - 9]
movups xmmword [rcx + 0x10], xmm1
movaps xmm1, xmmword [rbp + 7]
movups xmmword [rcx + 0x20], xmm0
movsd xmm0, qword [rbp + 0x17]
movups xmmword [rcx + 0x30], xmm1
movsd qword [rcx + 0x40], xmm0
mov word [rcx + 0x48], ax
mov byte [rcx + 0x4a], 0xc3
mov rax, qword [rbp + 0x27]
mov qword [rax + 0xc], rbx
mov rcx, qword [rbp + 0x27]
lea rax, [rcx + 0x5e0]
mov qword [rcx + 0x16], rax
mov rax, qword [rbp + 0x27]
mov qword [rax + 0x20], rdi
mov rcx, qword [rbp + 0x27]
lea rax, [rcx + 0x5e8]
mov qword [rcx + 0x2c], rax
mov rcx, qword [rbp + 0x27]
lea rax, [rcx + 0x5ec]
mov qword [rcx + 0x3c], rax
mov rax, qword [rbp + 0x27]
jmp 0x1400351a5
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140018b90
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140037cbc
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140020270]
xor rax, rsp
mov qword [rsp + 0x38], rax
and dword [rsp + 0x20], 0
mov rdi, rcx
mov rax, qword [0x14002ebc8]
test rax, rax
je 0x140037d04
test rcx, rcx
je 0x140037df7
mov edx, dword [0x14002e97c]
mov dword [rcx], edx
jmp 0x140037df7
lea rdx, [0x1400388b0]
lea rcx, [rsp + 0x28]
call fcn.140005de4
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov rsi, rax
test rax, rax
jne 0x140037d2f
xor eax, eax
jmp 0x140037df7
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov eax, dword [rsp + 0x20]
test eax, eax
je 0x140037d28
mov edx, eax
mov ecx, 0x40
call fcn.140006b00
mov r8d, dword [rsp + 0x20]
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.14001af00
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbx
mov ecx, 0xb
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
js 0x140037ddd
mov r8d, dword [rbx]
xor edx, edx
test r8d, r8d
je 0x140037ddd
lea rcx, [rbx + 0x18]
mov r9, qword [rcx]
cmp rsi, r9
jb 0x140037da7
mov eax, dword [rcx + 8]
add rax, r9
cmp rsi, rax
jb 0x140037db7
inc edx
add rcx, 0x128
cmp edx, r8d
jae 0x140037ddd
jmp 0x140037d94
mov eax, edx
imul rcx, rax, 0x128
mov rax, qword [rcx + rbx + 0x18]
mov qword [0x14002ebc8], rax
mov eax, dword [rcx + rbx + 0x20]
mov dword [0x14002e97c], eax
test rdi, rdi
je 0x140037ddd
mov dword [rdi], eax
test rbx, rbx
je 0x140037df0
mov edx, 0x4b555341
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [0x14002ebc8]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140018b90
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140037e14
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x140020270]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ecx, ecx
call fcn.140037cbc
mov rdi, rax
mov rax, qword [0x14002ebc0]
test rax, rax
jne 0x140037ede
test rdi, rdi
je 0x140037edc
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
lea rbx, [rax + 0x108]
movzx eax, word [rax + 6]
lea rcx, [rax + rax*4]
lea rsi, [rbx + rcx*8]
cmp rbx, rsi
jae 0x140037edc
movups xmm6, xmmword [0x1400388d0]
mov eax, dword [rbx + 0x24]
and eax, 0x2a000000
cmp eax, 0x28000000
jne 0x140037ed3
mov eax, dword [rbx]
cmp eax, 0x54494e49
je 0x140037ed3
cmp eax, 0x45474150
je 0x140037ed3
mov eax, dword [rbx + 8]
lea rcx, [rsp + 0x30]
mov r9d, dword [rbx + 0xc]
and qword [rsp + 0x30], 0
add r9, rdi
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x38]
movups xmmword [rsp + 0x38], xmm6
mov qword [rsp + 0x20], rax
call fcn.140006700
test eax, eax
jns 0x140037f00
add rbx, 0x28
cmp rbx, rsi
jb 0x140037e82
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140018b90
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + 3]
add rax, 7
add rax, rcx
mov qword [0x14002ebc0], rax
jmp 0x140037ede
Function at 0x140037ff0
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140020270]
xor rax, rsp
mov qword [rbp - 0x10], rax
and qword [rbp - 0x18], 0
lea rdx, [rbp - 0x18]
mov rbx, rcx
mov ecx, dword [rcx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x140038139
mov eax, dword [0x14002efd0]
test eax, eax
je 0x140038134
mov edx, dword [0x14002efc0]
mov ecx, eax
add rcx, qword [rbp - 0x18]
cmp edx, 0x611
jg 0x140038072
mov eax, dword [rbx + 4]
cmp eax, 1
jne 0x140038061
bts dword [rcx], 0xb
jmp 0x140038139
test eax, eax
jne 0x140038139
btr dword [rcx], 0xb
jmp 0x140038139
cmp edx, 0x620
jne 0x14003808e
cmp dword [rbx + 4], 2
je 0x140038139
mov al, byte [rbx + 4]
mov byte [rcx], al
jmp 0x140038139
cmp edx, 0x630
jl 0x14003812d
mov eax, dword [rbx + 4]
test eax, eax
jne 0x1400380a5
mov byte [rcx], al
jmp 0x1400380c7
cmp eax, 1
jne 0x1400380cd
xor eax, eax
mov byte [rbp - 0x20], 0
mov word [rbp - 0x1f], ax
mov byte [rbp - 0x1d], al
mov eax, dword [rbp - 0x20]
and eax, 0xffffff6a
or eax, 0x62
mov dword [rbp - 0x20], eax
mov byte [rcx], al
mov edx, dword [0x14002efc0]
mov ecx, dword [rbx + 8]
cmp ecx, 2
je 0x140038105
mov eax, dword [0x14002efd4]
test eax, eax
je 0x140038105
add rax, qword [rbp - 0x18]
cmp edx, 0xa03
jl 0x1400380f8
shl ecx, 8
xor ecx, dword [rax]
and ecx, 0x100
jmp 0x140038103
shl ecx, 0xa
xor ecx, dword [rax]
and ecx, 0x400
xor dword [rax], ecx
mov edx, dword [rbx + 0xc]
cmp edx, 2
je 0x140038139
mov eax, dword [0x14002efd0]
mov rcx, qword [rbp - 0x18]
cmp edx, 1
jne 0x140038125
mov word [rax + rcx - 2], 0x808
jmp 0x140038139
and word [rax + rcx - 2], 0
jmp 0x140038139
mov edi, 0xc00000bb
jmp 0x140038139
mov edi, 0xc0000141
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140038148
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140018b90
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x141670058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1416701df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141670089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14167006f
add dl, dl
jne 0x141670096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416700f6
xor eax, eax
add dl, dl
jne 0x1416700a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416701ad
add dl, dl
jne 0x1416700b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416700c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416700d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416700dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1416700ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14167007e
mov eax, 1
add dl, dl
jne 0x141670106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141670113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1416700fb
sub eax, ebx
mov ebx, 1
jne 0x14167014c
mov ecx, 1
add dl, dl
jne 0x14167012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14167013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141670123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14167007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141670168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141670175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14167015d
cmp eax, 0x7d00
jae 0x14167019b
cmp eax, 0x500
jb 0x141670196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14167007e
cmp eax, 0x7f
ja 0x14167019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14167007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1416701d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14167007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1800299d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18004b008]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x28], 0x64
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x28], 0x6c
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x28], 0x2e
mov eax, 1
imul rax, rax, 0xc
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xd
jae 0x180029a25
jmp 0x180029a2a
call fcn.18002e8ac
mov rax, qword [rsp + 0x20]
mov byte [rsp + rax + 0x28], 0
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x28], 0x65
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x28], 0x6e
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x28], 0x33
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x28], 0x6c
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x28], 0x32
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x28], 0x65
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x28], 0x72
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x28], 0x4b
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x28], 0x6c
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18002e780
add rsp, 0x48
ret

Function at 0x180029ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18004b008]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov eax, 1
imul rax, rax, 0xc
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xd
jae 0x180029afb
jmp 0x180029b00
call fcn.18002e8ac
mov rax, qword [rsp + 0x20]
mov byte [rsp + rax + 0x28], 0
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x28], 0x33
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x28], 0x6c
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x28], 0x2e
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x28], 0x69
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x28], 0x32
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x28], 0x61
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x28], 0x41
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x28], 0x70
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x28], 0x76
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x28], 0x6c
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x28], 0x64
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x28], 0x64
lea rcx, [rsp + 0x28]
call fcn.18002c4c0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18002e780
add rsp, 0x48
ret