joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021d40
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rdi, rcx
cmp qword [rcx + 0x48], rbx
jne 0x140021d61
mov al, 1
jmp 0x140021e39
mov eax, dword [0x140052048]
cmp eax, 5
ja 0x140021d73
mov esi, 0x90
jmp 0x140021d83
add eax, 0xfffffffa
mov esi, ebx
cmp eax, 2
mov ecx, 0x98
cmovbe esi, ecx
mov rcx, qword [rdi]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov r8d, eax
test eax, eax
jns 0x140021dc1
lfence
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
mov eax, dword [rcx + 0x54]
lea edx, [r9 + 0x37]
mov ecx, 0xc10204c6
mov dword [rsp + 0x20], eax
call fcn.140014bd4
jmp 0x140021e37
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsReferencePrimaryToken]
mov rdx, rax
test rax, rax
jne 0x140021e00
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
mov rax, qword [rdi]
mov r8d, 0xc000007c
mov qword [rsp + 0x28], rax
mov eax, dword [rcx + 0x54]
lea edx, [r9 + 0x31]
mov ecx, 0xc10204c6
mov dword [rsp + 0x20], eax
call fcn.140014bd4
jmp 0x140021e2c
test esi, esi
je 0x140021e21
mov ecx, esi
mov r8, qword [rcx + rax]
mov rax, qword [rdi + 0x50]
cmp qword [r8], rax
jne 0x140021e21
mov rax, qword [rdi + 0x48]
mov rcx, qword [rcx + rax]
mov rax, qword [rcx]
mov qword [r8], rax
mov rcx, rdx
call qword [sym.imp.ntoskrnl.exe_PsDereferencePrimaryToken]
mov bl, 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140022648
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0xa0
mov rsi, rdx
mov rbx, r8
xor edx, edx
mov ebp, ecx
lea rcx, [rax - 0x78]
mov rdi, r9
lea r8d, [rdx + 0x70]
call fcn.140027ec0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x38], 0x13c
mov rdx, rsi
mov qword [rsp + 0x40], rbx
mov ecx, ebp
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], 0x1000000
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp eax, 0xc0000024
jne 0x1400226d4
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x50], 0x2000000
mov rdx, rsi
mov ecx, ebp
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140022a48
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
or rbp, 0xffffffffffffffff
mov r14, rcx
mov rdi, rbp
xor r15d, r15d
inc rdi
cmp word [rcx + rdi*2], r15w
jne 0x140022a6d
mov edx, 0x10000
add di, di
mov dword [rsp + 0x48], edx
mov ebx, r15d
jmp 0x140022ad0
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov rdx, rsi
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140022aec
mov eax, ebx
inc ebx
cmp eax, 0x64
jae 0x140022b18
mov edx, dword [str.sboxS]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [rsp + 0x48]
mov eax, ebx
shl eax, 0xc
add ecx, eax
mov dword [rsp + 0x48], ecx
mov edx, ecx
mov r8d, dword [str.sboxS]
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
jne 0x140022a88
jmp 0x140022b27
test eax, eax
js 0x140022b18
mov rbx, rsi
cmp word [rbx + 0x38], di
jne 0x140022b09
mov rdx, qword [rbx + 0x40]
mov rcx, r14
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x140022b14
mov eax, dword [rbx]
test eax, eax
je 0x140022b18
add rbx, rax
jmp 0x140022af3
mov rbp, qword [rbx + 0x50]
mov edx, dword [str.sboxS]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, qword [rsp + 0x40]
mov rax, rbp
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140024628
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
cmp qword [0x140052318], 0
je 0x140024646
mov al, 1
jmp 0x140024802
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x48]
call fcn.140027ec0
xor r8d, r8d
mov dword [rsp + 0x50], 1
lea rax, [0x140052318]
xor ecx, ecx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor dil, dil
xor bl, bl
lea edx, [r8 + 0xa]
call sub.fwpkclnt.sys_FwpmEngineOpen0
mov edx, 0x10
test eax, eax
js 0x140024793
mov rcx, qword [0x140052318]
xor edx, edx
call sub.fwpkclnt.sys_FwpmTransactionBegin0
mov edx, 0x20
test eax, eax
js 0x140024793
mov dil, 1
call fcn.140024b14
mov edx, 0x30
test eax, eax
js 0x140024793
lea r9, [0x140052330]
lea r8, [0x140052320]
lea rdx, [0x1400307a8]
lea rcx, [0x140030468]
call fcn.1400249ac
mov edx, 0x41
test eax, eax
js 0x140024793
lea r9, [0x140052338]
mov bl, dil
lea r8, [0x140052324]
lea rdx, [0x1400307c8]
lea rcx, [0x140030478]
call fcn.1400249ac
mov edx, 0x42
test eax, eax
js 0x140024793
lea r9, [0x140052340]
lea r8, [0x140052328]
lea rdx, [0x140030768]
lea rcx, [0x140030488]
call fcn.1400249ac
mov edx, 0x43
test eax, eax
js 0x140024793
lea r9, [0x140052348]
lea r8, [0x14005232c]
lea rdx, [0x140030788]
lea rcx, [0x140030498]
call fcn.1400249ac
mov edx, 0x44
test eax, eax
js 0x140024793
mov rcx, qword [0x140052318]
call sub.fwpkclnt.sys_FwpmTransactionCommit0
mov edx, 0x50
test eax, eax
js 0x140024793
lea rcx, [0x14002e150]
call sub.ntoskrnl.exe_DbgPrint
mov al, bl
jmp 0x140024802
lfence
mov r8d, eax
lea rcx, [0x14002e110]
call sub.ntoskrnl.exe_DbgPrint
cmp dil, 1
jne 0x1400247b7
mov rcx, qword [0x140052318]
call sub.fwpkclnt.sys_FwpmTransactionAbort0
test bl, bl
je 0x1400247e7
mov ecx, dword [0x140052320]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140052324]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140052328]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x14005232c]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov rcx, qword [0x140052318]
test rcx, rcx
je 0x140024800
call sub.fwpkclnt.sys_FwpmEngineClose0
and qword [0x140052318], 0
xor al, al
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x140024814
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp byte [0x140052300], 0
jne 0x1400248db
mov edx, 0x80
mov byte [0x140052300], 1
lea rcx, [0x140052350]
call fcn.140010150
lea rcx, [0x14002e090]
call sub.ntoskrnl.exe_DbgPrint
mov dl, 1
lea rcx, [0x140052308]
call fcn.140014d28
test al, al
jne 0x14002485f
xor al, al
jmp 0x1400248dd
mov rcx, qword [0x140051f28]
lea r9, [0x140052310]
xor r8d, r8d
lea rdx, [0x1400251f0]
call sub.fwpkclnt.sys_FwpmBfeStateSubscribeChanges0
test eax, eax
jns 0x1400248a2
lea rcx, [0x14002e0b0]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [0x140052308]
call fcn.140014cdc
and qword [0x140052308], 0
jmp 0x14002485b
call sub.fwpkclnt.sys_FwpmBfeStateGet0
cmp eax, 3
jne 0x1400248cf
mov rcx, qword [0x140052308]
mov dl, 1
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceSharedLite]
call fcn.140024628
mov rcx, qword [0x140052308]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
jmp 0x1400248db
lea rcx, [0x14002e0f0]
call sub.ntoskrnl.exe_DbgPrint
mov al, 1
add rsp, 0x28
ret

Function at 0x1400249ac
Capabilities:
Register network filter via wfp api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
cmp qword [0x140052318], 0
mov rsi, r9
mov rdi, rdx
mov rbx, rcx
jne 0x1400249e5
mov eax, 0xc0000008
jmp 0x140024af9
movups xmm0, xmmword [rcx]
mov rcx, qword [0x140051f28]
lea rax, [0x140024e50]
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
lea rax, [0x1400251e0]
mov qword [rsp + 0x40], rax
lea rax, [0x1400251d0]
mov qword [rsp + 0x48], rax
movdqu xmmword [rsp + 0x20], xmm0
call sub.fwpkclnt.sys_FwpsCalloutRegister1
test eax, eax
js 0x140024af9
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x58]
call fcn.140027ec0
movups xmm0, xmmword [rbx]
mov rcx, qword [0x140052318]
lea rax, [0x14002e240]
movups xmm1, xmmword [rdi]
and dword [rsp + 0x70], 0
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [0x14002e260]
xor r8d, r8d
mov qword [rsp + 0x68], rax
movdqu xmmword [rsp + 0x50], xmm0
movdqu xmmword [rbp - 0x70], xmm1
call sub.fwpkclnt.sys_FwpmCalloutAdd0
test eax, eax
js 0x140024af9
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0xc8
call fcn.140027ec0
movups xmm0, xmmword [0x140030458]
and dword [rbp + 0x20], 0
lea rax, [0x14002e2e0]
movups xmm1, xmmword [rbx]
mov rcx, qword [0x140052318]
lea rdx, [rbp - 0x50]
movdqu xmmword [rbp], xmm0
mov qword [rbp - 0x40], rax
lea rax, [0x14002e300]
movups xmm0, xmmword [rdi]
mov r9, rsi
mov qword [rbp - 0x38], rax
xor r8d, r8d
mov dword [rbp + 0x30], 0x5003
movdqu xmmword [rbp - 0x10], xmm0
mov dword [rbp + 0x10], 1
mov byte [rbp + 0x18], 0xf
movdqu xmmword [rbp + 0x34], xmm1
call sub.fwpkclnt.sys_FwpmFilterAdd0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140024b78
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp qword [0x140052318], 0
je 0x140024bd7
mov ecx, dword [0x140052320]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140052324]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x140052328]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov ecx, dword [0x14005232c]
call sub.fwpkclnt.sys_FwpsCalloutUnregisterById0
mov rcx, qword [0x140052318]
test rcx, rcx
je 0x140024bcb
call sub.fwpkclnt.sys_FwpmEngineClose0
and qword [0x140052318], 0
lea rcx, [0x14002e180]
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x28
ret

Function at 0x140056000
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov ecx, 0x10000
call fcn.14001b08c
mov dl, 1
mov qword [0x140051f58], rax
lea rcx, [0x140051f48]
call fcn.140014d28
xor ebx, ebx
test al, al
je 0x140056072
mov r8d, dword [str.sboxS]
mov edx, 0xe0
mov ecx, dword [0x140051f60]
mov byte [0x140051f50], 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor edx, edx
mov qword [0x140051f38], rax
mov rdi, rax
test rax, rax
jne 0x14005607f
xor r9d, r9d
mov r8d, 0xc000009a
mov ecx, 0xc101045f
call fcn.140014bb8
xor al, al
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov r8d, 0xe0
mov rcx, rdi
call fcn.140027ec0
mov dword [rdi], 0xe0
lea rax, [0x140001ca0]
mov qword [rdi + 0x50], rax
lea rcx, [0x140002400]
mov rax, qword [0x140052488]
lea rdx, [0x140059060]
mov qword [rax + 0x50], rdi
mov rax, qword [0x140052488]
mov qword [rax + 0x70], rcx
lea rcx, [0x1400023a0]
mov rax, qword [0x140052488]
mov qword [rax + 0x100], rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [0x140052488]
lea rax, [0x140051f28]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
mov byte [rsp + 0x28], bl
mov r9d, 0x22
xor edx, edx
mov dword [rsp + 0x20], pe_nt_image_headers64
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jns 0x14005612f
lfence
xor r9d, r9d
mov qword [0x140051f28], rbx
xor edx, edx
mov r8d, eax
jmp 0x140056068
mov rax, qword [0x140051f28]
lea rdx, [0x140002310]
mov ecx, 0x12340001
btr dword [rax + 0x30], 7
call fcn.140056208
lea rdx, [0x140002480]
mov ecx, 0x12340003
call fcn.140056208
lea rdx, [0x140001f70]
mov ecx, 0x1234003f
call fcn.140056208
lea rdx, [0x140001ec0]
mov ecx, 0x12340025
call fcn.140056208
lea rdx, [0x140002b10]
mov ecx, 0x12340032
call fcn.140056208
lea rdx, [0x140007250]
mov ecx, 0x12340016
call fcn.140056208
lea rdx, [0x140002690]
mov ecx, 0x12340040
call fcn.140056208
lea rdx, [0x1400027b0]
mov ecx, 0x12340043
call fcn.140056208
lea rdx, [0x1400029e0]
mov ecx, 0x12340045
call fcn.140056208
lea rdx, [0x1400021c0]
mov ecx, 0x12340046
call fcn.140056208
mov rcx, qword [0x140051f30]
dec rcx
cmp rcx, 0xfffffffffffffffd
ja 0x140056072
xchg dword [0x140035028], ebx
mov al, 1
jmp 0x140056074
Function at 0x14005665c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov r8, qword [rcx + 0x78]
xor r10d, r10d
mov rbx, rcx
movzx eax, word [r8 + 0x14]
lea r9, [r8 + 0x18]
movzx r11d, word [r8 + 6]
add r9, rax
test r11d, r11d
je 0x1400566a1
mov r8d, dword [r9 + 0xc]
cmp edx, r8d
jb 0x140056695
mov ecx, dword [r9 + 0x10]
add ecx, r8d
cmp edx, ecx
jb 0x1400566a9
add r9, 0x28
inc r10d
cmp r10d, r11d
jb 0x140056681
xor eax, eax
mov rbx, qword [rsp + 8]
ret
lfence
mov ecx, dword [r9 + 0xc]
mov eax, dword [r9 + 0x14]
sub rax, rcx
mov ecx, edx
add rax, qword [rbx + 0x70]
add rax, rcx
jmp 0x1400566a3

Function at 0x1400566d0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
mov rbx, rcx
mov dword [rsp + 0x20], 0x114
lea rcx, [rsp + 0x20]
mov rdi, rdx
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
js 0x14005671e
cmp dword [rsp + 0x24], 6
ja 0x14005670a
jne 0x14005671e
cmp dword [rsp + 0x28], 2
jb 0x14005671e
mov dword [0x140051f60], 0x200
mov dword [0x140051f64], 0x40000000
mov qword [0x140052488], rbx
lea rcx, [0x140052470]
and qword [rbx + 0x68], 0
mov rdx, qword [str.86900]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
call fcn.1400568f4
mov bl, al
test al, al
je 0x1400567ae
call fcn.14000e0a4
mov qword [0x140052050], rax
test rax, rax
jne 0x14005676b
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1010450
call fcn.1400149e8
jmp 0x140056795
call fcn.140007428
mov bl, al
test al, al
je 0x1400567ae
mov rdx, qword [rdi + 8]
mov r8b, 1
mov rcx, qword [0x140052050]
call fcn.140014c78
mov qword [0x140052480], rax
test rax, rax
jne 0x1400567a4
call fcn.140022878
call fcn.1400071e4
jmp 0x14005689c
mov rcx, rdi
call fcn.140056a60
mov bl, al
call fcn.140022878
test bl, bl
je 0x140056893
call fcn.1400577dc
mov bl, al
test al, al
je 0x140056893
call fcn.140056290
mov bl, al
test al, al
je 0x140056893
call fcn.140056624
mov bl, al
test al, al
je 0x140056893
call fcn.140058038
mov bl, al
test al, al
je 0x140056893
call fcn.14001c1f4
mov bl, al
test al, al
je 0x140056893
mov edx, 0xd
lea rcx, [0x140059110]
call fcn.14000733c
cmp dword [0x140052048], 6
mov qword [0x140052038], rax
jb 0x14005683f
mov edx, 0x11
lea rcx, [0x140059120]
call fcn.14000733c
mov qword [0x140052040], rax
call main
mov bl, al
test al, al
je 0x140056893
call fcn.140057964
mov bl, al
test al, al
je 0x140056893
call fcn.140058bcc
mov bl, al
test al, al
je 0x140056893
call fcn.140056da0
mov bl, al
test al, al
je 0x140056893
call fcn.140057584
mov bl, al
test al, al
je 0x140056893
call fcn.140057158
mov bl, al
test al, al
je 0x140056893
call fcn.140056efc
mov bl, al
test al, al
je 0x140056893
call fcn.140056000
mov bl, al
call fcn.1400071e4
test bl, bl
jne 0x1400568c3
mov rdx, qword [str.5.62.2]
xor r8d, r8d
mov ecx, 0xc101044f
call fcn.1400149e8
mov rcx, qword [0x140052488]
call fcn.140007690
mov eax, 0xc0000001
jmp 0x1400568e0
mov rdx, qword [str.5.62.2]
xor r8d, r8d
mov ecx, 0x4101044d
mov byte [0x140035198], 0
call fcn.1400149e8
xor eax, eax
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret
Function at 0x1400568f4
Capabilities:
Check os version

Disassembly:
mov rax, rsp
sub rsp, 0xb8
xor r9d, r9d
lea r8, [0x14005204c]
lea rdx, [rax + 8]
lea rcx, [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov r9d, dword [rsp + 0xc8]
mov edx, 6
mov ecx, dword [rsp + 0xc0]
cmp r9d, edx
ja 0x14005693e
jne 0x140056a1d
cmp ecx, 1
jb 0x140056a1d
cmp r9d, 0xa
jne 0x14005695d
mov dword [0x140052048], 8
mov dword [0x140052094], 0x90
jmp 0x140056a19
xor eax, eax
cmp r9d, edx
jne 0x1400569eb
cmp ecx, 3
jne 0x140056989
cmp dword [0x14005204c], 0x2580
jb 0x140056a11
mov dword [0x140052048], 7
jmp 0x14005694e
cmp ecx, 2
jne 0x1400569a2
cmp dword [0x14005204c], 0x23f0
jb 0x140056a11
mov dword [0x140052048], edx
jmp 0x14005694e
cmp ecx, 1
jne 0x1400569c9
cmp dword [0x14005204c], 0x1db0
jb 0x140056a11
mov dword [0x140052048], 5
mov dword [0x140052094], 0x1d8
jmp 0x140056a19
test ecx, ecx
jne 0x140056a11
cmp dword [0x14005204c], 0x1770
jb 0x140056a11
mov dword [0x140052048], 4
mov dword [0x140052094], eax
jmp 0x140056a11
mov dword [0x140052094], eax
cmp ecx, 2
jne 0x140056a02
mov dword [0x140052048], 3
jmp 0x140056a19
cmp ecx, 1
jne 0x140056a11
mov dword [0x140052048], 2
cmp dword [0x140052048], eax
je 0x140056a1d
mov al, 1
jmp 0x140056a55
mov eax, dword [0x14005204c]
lea r8, [0x1400590a0]
mov dword [rsp + 0x28], eax
mov edx, 0x80
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x30]
call fcn.1400038d4
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov ecx, 0xc1010451
call fcn.1400149e8
xor al, al
add rsp, 0xb8
ret
Function at 0x140056e40
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x140052488]
lea r8, [0x1400520a0]
lea rdx, section.INITDATA
call sub.FLTMGR.SYS_FltRegisterFilter
test eax, eax
jns 0x140056e85
mov edx, 0x81
lfence
mov r9, qword [0x140035218]
mov r8d, eax
mov ecx, 0xc1010456
call fcn.140014bb8
xor al, al
add rsp, 0x28
ret
mov rcx, qword [0x1400520a0]
call sub.FLTMGR.SYS_FltStartFiltering
test eax, eax
jns 0x140056e9c
mov edx, 0x82
jmp 0x140056e67
lea rdx, [0x140008cc0]
lea rcx, [0x140059150]
call fcn.140058ba0
test al, al
je 0x140056e7e
lea rdx, [0x140008cc0]
lea rcx, [0x140059160]
call fcn.140058ba0
test al, al
je 0x140056e7e
lea rdx, [0x140008cc0]
lea rcx, [0x140059180]
call fcn.140058ba0
test al, al
je 0x140056e7e
lea rdx, [0x140008cc0]
lea rcx, [0x1400591a0]
call fcn.140058ba0
test al, al
je 0x140056e7e
mov al, 1
jmp 0x140056e80
Function at 0x140058d48
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push rbx
push rdi
sub rsp, 0x48
lea rcx, [0x1400599e0]
call fcn.14001d984
mov rbx, rax
test rax, rax
je 0x140058de2
mov rcx, qword gs:[0x188]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_PsReferenceImpersonationToken]
mov rdi, rax
mov rcx, 0xfffffffffffffffe
mov rax, qword [rbx + 0x18]
call qword [0x14002f658]
test eax, eax
js 0x140058dbe
mov rcx, qword gs:[0x188]
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsReferenceImpersonationToken]
mov qword [0x1400522b0], rax
mov rcx, qword gs:[0x188]
mov rdx, rdi
mov eax, dword [rsp + 0x30]
mov r9b, byte [rsp + 0x60]
mov r8b, byte [rsp + 0x68]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_PsImpersonateClient]
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x140006948
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006992
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006992
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006992
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006992
cmp dword [rcx + 0x84], 0xe
jbe 0x140006992
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006994
xor al, al
add rsp, 0x28
ret
Function at 0x1800023e0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180002411
xor eax, eax
lea r8, [0x180001e20]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180003e60
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
lea rdi, [rsp + 0x20]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x90]
mov rax, qword [0x18000d3c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x18000403b
mov dword [rsp + 0x38], 0x1c
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x180004030
mov eax, dword [rsp + 0x38]
cmp rax, 0x10
jb 0x180004011
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x44], eax
jne 0x180004011
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x40], eax
je 0x180004011
mov rax, qword [rsp + 0x90]
cmp qword [rax], 0
jne 0x180003f5d
mov rax, qword [rsp + 0x90]
mov dword [rax + 8], 0x80
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x18000d4f8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x90]
mov qword [rcx], rax
mov rax, qword [rsp + 0x90]
cmp qword [rax], 0
jne 0x180003f5b
jmp 0x180004030
jmp 0x180003fdc
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x90]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x180003fdc
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 8]
shl eax, 1
mov eax, eax
shl rax, 2
mov r9, rax
mov rax, qword [rsp + 0x90]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x18000d4f8]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x180003fb4
jmp 0x180004030
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rsp + 0x90]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x68]
mov qword [rax], rcx
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx]
mov edx, dword [rsp + 0x40]
mov dword [rcx + rax*4], edx
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rsp + 0x90]
mov dword [rcx + 0xc], eax
mov dword [rsp + 0x38], 0x1c
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x180003ed1
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsp
lea rdx, [0x180009530]
call fcn.180007398
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180006c40
add rsp, 0x80
pop rdi
ret
Function at 0x180004070
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xc], 0
mov rcx, qword [rsp + 0x40]
call fcn.180003e60
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x180004133
mov dword [rsp + 0x20], 0
jmp 0x1800040d0
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x180004133
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180004131
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.180003c40
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800040c6
add rsp, 0x30
pop rdi
ret

Function at 0x180004140
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x1800041d0
mov dword [rsp + 0x20], 0
jmp 0x180004169
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x1800041b9
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800041b7
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000415f
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x18000d4f8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x30
pop rdi
ret