joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7fff25db24c0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, edx
lea rcx, [0x7fff25fd0fc0]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
nop dword [rax + rax]
test rbx, rbx
je 0x7fff25db252c
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlEncodePointer]
nop dword [rax + rax]
mov rcx, rax
test edi, edi
je 0x7fff25db2525
call fcn.7fff25db2568
mov ebx, eax
lea rcx, [0x7fff25fd0fc0]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.7fff25db2670
jmp 0x7fff25db2502
mov rax, qword gs:[0x60]
mov ebx, 1
mov rax, qword [rax + 0x20]
test edi, edi
jne 0x7fff25df8a5a
mov r8d, dword [rax + 0x18]
mov rax, qword gs:[0x60]
and r8d, 0xfffffffe
mov rdx, qword [rax + 0x20]
mov dword [rdx + 0x18], r8d
jmp 0x7fff25db2504
mov edx, dword [rax + 0x18]
mov rax, qword gs:[0x60]
or edx, ebx
mov rcx, qword [rax + 0x20]
mov dword [rcx + 0x18], edx
jmp 0x7fff25db2504

Function at 0x7fff25db2710
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, r9
mov rdi, r8
mov rsi, rcx
test rdx, rdx
je 0x7fff25db2783
test dword [rdx], 0xfffffffc
jne 0x7fff25df8ab2
movzx eax, byte [rdx]
lea r8, [rsp + 0x40]
shr eax, 1
mov r9d, 8
and eax, 1
mov dword [rsp + 0x20], 0x17
mov dword [rsp + 0x40], eax
movzx eax, byte [rdx]
lea rdx, [rsp + 0x30]
and eax, 1
mov dword [rsp + 0x44], eax
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25df8ac5
test rdi, rdi
jne 0x7fff25df8ad3
test rbx, rbx
jne 0x7fff25df8ad8
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x57
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x7fff25df8acc
mov ecx, eax
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25db279a
test rbx, rbx
jne 0x7fff25df8b03
mov r9d, 0x10
mov dword [rsp + 0x20], 0x19
lea r8, [rsp + 0x40]
mov rcx, rsi
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25df8ac5
test rdi, rdi
je 0x7fff25df8b0e
mov eax, dword [rdi]
mov dword [rsp + 0x48], eax
test rbx, rbx
je 0x7fff25df8b21
mov eax, dword [rbx]
imul rdx, rax, 0xffffffffffffd8f0
mov qword [rsp + 0x40], rdx
mov r9d, 0x10
mov dword [rsp + 0x20], 0x19
lea r8, [rsp + 0x40]
mov rcx, rsi
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25df8ac5
jmp 0x7fff25db2795
Function at 0x7fff25db37d0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x50
and qword [rax - 0x28], 0
xorps xmm0, xmm0
mov qword [rax - 0x30], 0x10
mov r9d, 1
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
xor r8d, r8d
xor edx, edx
mov ecx, r9d
movups xmmword [rax - 0x18], xmm0
lea rax, [rax - 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_RtlQueryInformationActivationContext]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25df9044
test byte [rsp + 0x48], 1
mov rcx, 0xffffffffffffffff
mov rax, qword [rsp + 0x40]
mov r9, rdi
mov rdx, qword [sym.imp.ntdll.dll_Ordinal_8]
cmovne rax, rcx
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov r8, rbp
call qword [sym.imp.ntdll.dll_NtQueueApcThread]
nop dword [rax + rax]
test eax, eax
js 0x7fff25df905e
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov r8d, ebx
lea rdx, [0x7fff25fa5458]
lea rcx, str.SXS:__s_failing_because_RtlQueryInformationActivationContext___returned_status__08lx_n
call sub.ntdll.dll_DbgPrint
mov ecx, ebx
jmp 0x7fff25df9060
mov ecx, eax
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25db3871
Function at 0x7fff25db3ea0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
movzx eax, word [rcx]
mov sil, r8b
add ax, 2
mov rbp, rdx
mov rdi, rcx
cmp ax, word [rcx]
jb 0x7fff25df9211
test byte [rcx], 1
jne 0x7fff25df9211
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
lea r8d, [rdx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x7fff25df9200
movzx eax, word [rdi]
lea r14, [rbx + 0x10]
add ax, 2
xor edx, edx
movzx r8d, ax
mov word [r14], r8w
mov word [rbx + 0x12], r8w
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x7fff25df91e2
movzx r8d, word [rdi]
mov rcx, rax
mov rdx, qword [rdi + 8]
call sub.ntdll.dll_memcpy
movzx edx, word [r14]
lea rdi, [0x7fff25fd2540]
mov rax, qword [rbx + 0x18]
mov ecx, 0x5c
shr rdx, 1
mov word [rax + rdx*2 - 2], cx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlAcquireSRWLockExclusive]
nop dword [rax + rax]
mov rcx, r14
call fcn.7fff25db4054
test rax, rax
jne 0x7fff25db3ff2
mov qword [rbx + 0x20], rbp
lea rcx, [0x7fff25fcf1f8]
mov byte [rbx + 0x28], sil
mov rax, qword [0x7fff25fcf200]
cmp qword [rax], rcx
jne 0x7fff25df920a
mov qword [rbx], rcx
mov rcx, rdi
mov qword [rbx + 8], rax
mov qword [rax], rbx
mov qword [0x7fff25fcf200], rbx
mov byte [0x7fff25fd2320], 1
call qword [sym.imp.ntdll.dll_RtlReleaseSRWLockExclusive]
nop dword [rax + rax]
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlReleaseSRWLockExclusive]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbx + 0x18]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, 0xc00000bd
call fcn.7fff25d6b370
xor al, al
jmp 0x7fff25db3fd6
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, 0xc000009a
jmp 0x7fff25db4043
mov ecx, 3
int 0x29
mov ecx, 0xc000000d
jmp 0x7fff25db4043
Function at 0x7fff25db41c0
Capabilities:
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, r9
mov dword [rsp + 0x20], 4
mov rdi, r8
mov rsi, rdx
mov r9d, 0x28
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25df9386
test rsi, rsi
je 0x7fff25db4219
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
test rdi, rdi
je 0x7fff25db4226
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
test rbx, rbx
je 0x7fff25db4233
mov rax, qword [rsp + 0x50]
mov qword [rbx], rax
mov eax, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
mov ecx, eax
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25db4238

Function at 0x7fff25db49b0
Capabilities:
Get system information on windows

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
test r8, r8
je 0x7fff25df950a
mov eax, dword [r8]
mov r9, rdx
mov qword [rsp + 0x28], r8
lea rdx, [rsp + 0x40]
mov r8d, 4
mov dword [rsp + 0x20], eax
lea ecx, [r8 + 0x67]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
nop dword [rax + rax]
cmp eax, 0xc0000004
mov ecx, 0xc0000023
cmove eax, ecx
test eax, eax
js 0x7fff25db4a07
mov eax, 1
add rsp, 0x38
ret
mov ecx, eax
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25db4a01
mov ecx, 0x57
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
nop
jmp 0x7fff25db4a0e

Function at 0x7fff25db4cc0
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x48
mov r11, rcx
mov r10d, edx
test edx, edx
jne 0x7fff25db4d08
lea ecx, [rdx + 4]
lea eax, [rdx + 0x28]
cmp eax, r9d
ja 0x7fff25df959a
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x30]
mov rcx, r11
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25df95ad
mov eax, 1
add rsp, 0x48
ret
sub r10d, 3
je 0x7fff25db4d32
sub r10d, 1
je 0x7fff25db4d5b
sub r10d, 1
je 0x7fff25db4d2b
sub r10d, 1
jne 0x7fff25db4d39
lea ecx, [r10 + 0x14]
mov eax, 8
jmp 0x7fff25db4cd4
mov ecx, 0x13
jmp 0x7fff25db4d24
call fcn.7fff25db4d70
jmp 0x7fff25db4d02
sub r10d, 6
je 0x7fff25df9581
sub r10d, 9
jne 0x7fff25df9568
lea ecx, [r10 + 0x40]
mov eax, 4
jmp 0x7fff25db4cd4
mov ecx, 0xd
lea eax, [rcx - 0xc]
jmp 0x7fff25db4cd4
sub r10d, 1
je 0x7fff25db4d32
cmp r10d, 1
jne 0x7fff25df9593
lea ecx, [r10 + 0x46]
jmp 0x7fff25db4d51
cmp dword [r8], 3
mov ecx, 0x2b
lea eax, [rcx - 0x27]
jl 0x7fff25db4cd4
mov ecx, 0x57
jmp 0x7fff25df959f
mov ecx, 0x18
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x7fff25df95b4
mov ecx, eax
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25db4d02
Function at 0x7fff25db4d70
Capabilities:
Access peb ldr_data
Get kernel32 base address
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov eax, 0x41
cmp edx, 3
xorps xmm0, xmm0
mov rdi, r8
mov r12, rcx
movups xmmword [rbp - 0x20], xmm0
lea r15d, [rax - 0x37]
cmovne r15d, eax
cmp r9d, 0x18
jb 0x7fff25df95bc
cmp dword [r8 + 0x10], 2
lea rbx, [r8 + 0x14]
jb 0x7fff25db4dcb
cmp word [rbx], 0x3a
je 0x7fff25df95ff
xor r9d, r9d
lea rdx, [rbp - 0x20]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
nop dword [rax + rax]
test eax, eax
js 0x7fff25df9615
movzx eax, word [rbp - 0x20]
mov rcx, qword gs:[0x60]
xor edx, edx
movzx r14d, ax
add r14d, 0x18
mov r8d, r14d
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x7fff25df95cf
movzx r8d, word [rbp - 0x20]
lea rcx, [rax + 0x14]
mov rdx, qword [rbp - 0x18]
call sub.ntdll.dll_memcpy
mov eax, dword [rdi]
lea rdx, [rbp - 0x10]
mov dword [rsi], eax
mov r9d, r14d
mov rax, qword [rdi + 8]
mov r8, rsi
mov qword [rsi + 8], rax
mov rcx, r12
movzx eax, word [rbp - 0x20]
mov dword [rsi + 0x10], eax
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov edi, eax
cmp qword [rbp - 0x18], rbx
je 0x7fff25db4e8c
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x18]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test edi, edi
js 0x7fff25df9619
mov eax, 1
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 0x18
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x7fff25df95f8
mov ecx, 0xc0000017
call fcn.7fff25d6b370
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x18]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor eax, eax
jmp 0x7fff25db4eb7
movzx eax, word [r8 + 0x10]
mov word [rbp - 0x1e], ax
mov word [rbp - 0x20], ax
mov qword [rbp - 0x18], rbx
jmp 0x7fff25db4df0
mov ecx, eax
jmp 0x7fff25df961b
mov ecx, edi
call fcn.7fff25d6b370
jmp 0x7fff25df95f8
Function at 0x7fff25db595c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rbp + 0x10], rax
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x50]
mov r9d, 0x28
mov rbx, rdx
mov rdi, rcx
lea edx, [r9 + 0x1d]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
nop dword [rax + rax]
mov ecx, 0x80000000
mov r8d, 0xc00001ae
lea edx, [rax + rcx]
test ecx, edx
je 0x7fff25db5ab6
cmp eax, r8d
jne 0x7fff25db5a75
and qword [rsp + 0x20], 0
lea r8, [rbp - 0x60]
mov r9d, 0x70
mov rcx, rdi
lea edx, [r9 - 0x6d]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
nop dword [rax + rax]
test eax, eax
js 0x7fff25db5a53
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x38], rcx
add rcx, qword [rbp + 8]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea rdx, [rsp + 0x78]
lea r8d, [r9 + 0x20]
lea ecx, [r9 + 0x7b]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x7fff25db5a53
mov rcx, qword [rbp - 0x78]
sub rcx, qword [rbp - 0x80]
mov eax, dword [0x7fff25fd0de8]
imul rcx, rax
mov qword [rsp + 0x30], rcx
movups xmm0, xmmword [rsp + 0x30]
xor eax, eax
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.7fff25dce640
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
add rdx, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x48], rdx
test rax, rax
jne 0x7fff25db5ac1
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x7fff25db5a09
sub rax, rcx
jmp 0x7fff25df9c82
cmp eax, r8d
je 0x7fff25db59be
jmp 0x7fff25db5a53
sub rax, rdx
jmp 0x7fff25df9c82
mov qword [rsp + 0x30], rax
jmp 0x7fff25db5a40
Function at 0x7fff25db6260
Capabilities:
Access peb ldr_data
Enumerate processes via ntquerysysteminformation
Get ntdll base address
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14d, edx
mov r12, rcx
and dword [rax + 0x20], 0
mov edi, 0x10000
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x30]
mov qword [rsp + 0x28], rsi
mov r8d, edi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x7fff25df9e00
lea r9, [rsp + 0x68]
mov r8d, edi
mov rdx, rax
mov ecx, 5
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov edi, eax
cmp eax, 0xc0000004
je 0x7fff25db63ce
test eax, eax
js 0x7fff25df9dda
xor r9d, r9d
shr r14d, 2
xor edx, edx
mov r8d, r9d
cmp edx, r14d
jae 0x7fff25db634b
mov ecx, dword [r9 + rbx + 0x50]
mov dword [r12 + rdx*4], ecx
jmp 0x7fff25db6349
inc edx
add r9d, dword [r9 + rbx]
cmp dword [r8 + rbx], 0
jne 0x7fff25db62fc
mov eax, edx
shl eax, 2
mov dword [r15], eax
jmp 0x7fff25db639a
mov r8, rbx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
mov r8, rbx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov edi, dword [rsp + 0x68]
jmp 0x7fff25db629d
mov r8, rbx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
jmp 0x7fff25df9e05
mov ecx, 8
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor eax, eax
jmp 0x7fff25db63b3
Function at 0x7fff25db6930
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0xb0
mov rsi, r9
mov r14, rdx
mov r12, rcx
lea r15d, [r8 + 0x10]
mov r8d, r15d
mov rcx, qword gs:[0x60]
mov edx, dword [0x7fff25fd0c80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
mov qword [rsp + 0x60], rax
xor ebx, ebx
test rax, rax
je 0x7fff25dfa09e
mov dword [rsp + 0x78], 0x30
mov qword [rsp + 0x80], rbx
mov dword [rsp + 0x90], ebx
mov qword [rsp + 0x88], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
mov byte [rsp + 0x20], bl
xor r9d, r9d
lea r8, [rsp + 0x78]
mov edx, 0x1f0003
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtCreateEvent]
nop dword [rax + rax]
mov dword [rsp + 0x50], eax
test eax, eax
js 0x7fff25dfa0a8
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x11400c
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, r12
call qword [sym.imp.ntdll.dll_NtFsControlFile]
nop dword [rax + rax]
mov dword [rsp + 0x50], eax
cmp eax, 0x103
jne 0x7fff25db6a56
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
nop dword [rax + rax]
mov dword [rsp + 0x50], eax
test eax, eax
cmovns eax, dword [rsp + 0x68]
mov dword [rsp + 0x50], eax
cmp eax, 0x80000005
cmove eax, ebx
mov dword [rsp + 0x50], eax
test eax, eax
js 0x7fff25db6abf
mov eax, dword [rsp + 0x70]
lea ecx, [rax - 0x10]
mov rdx, qword [rsp + 0xf0]
test rdx, rdx
je 0x7fff25db6a7f
mov eax, dword [rdi + 4]
mov dword [rdx], eax
test rsi, rsi
jne 0x7fff25db6ab0
mov rdx, qword [rsp + 0xf8]
test rdx, rdx
jne 0x7fff25db6aa7
test r14, r14
je 0x7fff25db6ab4
mov r8d, ecx
lea rdx, [rdi + 0x10]
mov rcx, r14
call sub.ntdll.dll_memcpy
jmp 0x7fff25db6ab4
mov eax, dword [rdi + 0xc]
sub eax, ecx
mov dword [rdx], eax
jmp 0x7fff25db6a91
mov dword [rsi], ecx
jmp 0x7fff25db6a84
jmp 0x7fff25db6abf
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x50]
test ecx, ecx
js 0x7fff25db6b1a
mov eax, 1
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25db6afb
mov ecx, 0xc000009a
jmp 0x7fff25db6b1a
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x50]
jmp 0x7fff25db6b1a
Function at 0x7fff25db7880
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov esi, edx
lea r9, [rbp - 0x51]
lea rdx, [rbp - 0x61]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U_WithStatus]
nop dword [rax + rax]
xor r14d, r14d
test eax, eax
js 0x7fff25dfaa76
mov rbx, qword [rbp - 0x59]
cmp word [rbp - 0x51], r14w
jne 0x7fff25dfaaa2
mov eax, r14d
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x19], rax
lea r9, [rbp - 0x31]
lea rax, [rbp - 0x61]
mov dword [rsp + 0x28], 0x204020
xorps xmm0, xmm0
mov qword [rbp - 0x11], rax
lea r8, [rbp - 0x21]
mov dword [rbp - 0x21], 0x30
mov edx, 0x100100
mov dword [rbp - 9], 0x40
lea rcx, [rbp - 0x69]
mov dword [rsp + 0x20], 7
movdqu xmmword [rbp - 1], xmm0
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x7fff25db79eb
lea rcx, [rbp - 0x51]
call qword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x69]
lea r8, [rbp + 0xf]
xor eax, eax
mov dword [rsp + 0x20], 4
xorps xmm0, xmm0
mov qword [rbp + 0x2f], rax
and esi, 0x1a3127
lea rdx, [rbp - 0x31]
bts esi, 7
lea r9d, [rax + 0x28]
mov dword [rbp + 0x2f], esi
movups xmmword [rbp + 0xf], xmm0
movups xmmword [rbp + 0x1f], xmm0
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x69]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test ebx, ebx
js 0x7fff25db7a30
mov eax, 1
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.7fff25dce640
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
cmp edi, 0xc000000d
je 0x7fff25dfaab4
lea rcx, [rbp - 0x51]
call qword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, edi
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25db79c6
mov ecx, ebx
jmp 0x7fff25db7a27
cmp eax, 0xc0000017
je 0x7fff25dfaa9b
cmp eax, 0xc000009a
je 0x7fff25dfaa9b
mov ecx, 3
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
nop
jmp 0x7fff25db7a2c
mov ecx, eax
jmp 0x7fff25db7a27
movups xmm0, xmmword [rbp - 0x51]
mov rax, qword [rbp - 0x41]
movdqu xmmword [rbp - 0x61], xmm0
jmp 0x7fff25db78e2
mov dword [rsp + 0x28], 0x4020
lea r9, [rbp - 0x31]
lea r8, [rbp - 0x21]
mov dword [rsp + 0x20], 7
mov edx, 0x100100
lea rcx, [rbp - 0x69]
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jns 0x7fff25db793b
jmp 0x7fff25db79f7
Function at 0x7fff25db7bb0
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x28
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_NtResumeThread]
nop dword [rax + rax]
test eax, eax
js 0x7fff25dfac60
mov eax, dword [rsp + 0x38]
add rsp, 0x28
ret
mov ecx, eax
call fcn.7fff25d6b370
or eax, 0xffffffff
jmp 0x7fff25db7bd1

Function at 0x7fff25db93a0
Capabilities:
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x50
mov qword [rax + 0x10], rdx
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
jne 0x7fff25db93e2
xor r8d, r8d
lea rcx, [rax + 0x10]
mov edx, 0x1f0003
call qword [sym.imp.ntdll.dll_NtCreateIoCompletion]
nop dword [rax + rax]
test eax, eax
js 0x7fff25dfbb52
cmp rdi, 0xffffffffffffffff
je 0x7fff25db943c
mov rax, qword [rsp + 0x68]
lea r8, [rsp + 0x30]
mov r9d, 0x10
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x38], rsi
mov rcx, rdi
mov dword [rsp + 0x20], 0x1e
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25dfbb73
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
test rbx, rbx
je 0x7fff25db9426
jmp 0x7fff25dfbb81
mov ecx, eax
call fcn.7fff25d6b370
jmp 0x7fff25dfbb6c
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor eax, eax
jmp 0x7fff25db942b
mov ecx, eax
call fcn.7fff25d6b370
test rbx, rbx
jne 0x7fff25dfbb6c
jmp 0x7fff25dfbb5b
and qword [rsp + 0x68], 0
mov ecx, 0xc000000d
call fcn.7fff25d6b370
nop
jmp 0x7fff25db9426