joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001ca70
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0x58
mov rax, qword [rsp + 0xa8]
mov qword [r11 - 0x10], rax
mov rax, qword [rsp + 0xa0]
mov qword [r11 - 0x18], rax
mov rax, qword [rsp + 0x98]
mov qword [r11 - 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [r11 - 0x28], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessA]
nop dword [rax + rax]
add rsp, 0x58
ret

Function at 0x18001ce70
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0x58
mov rax, qword [rsp + 0xa8]
mov qword [r11 - 0x10], rax
mov rax, qword [rsp + 0xa0]
mov qword [r11 - 0x18], rax
mov rax, qword [rsp + 0x98]
mov qword [r11 - 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [r11 - 0x28], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
nop dword [rax + rax]
add rsp, 0x58
ret
Function at 0x18001d454
Capabilities:
Map section object

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x47]
sub rsp, 0xc0
xor esi, esi
xor r14d, r14d
xor r15d, r15d
xor edi, edi
xor r9d, r9d
mov r12, rdx
mov r13, rcx
lea ebx, [rsi + 0x48]
test r8b, 6
je 0x18001d4bf
mov eax, r9d
inc esi
add rax, qword [rbp + 0x6f]
add r9d, dword [rax]
add edi, dword [rax + 4]
cmp dword [rax], r14d
jne 0x18001d493
test r8b, 2
je 0x18001d4b5
imul eax, esi, 0x238
add ebx, eax
test r8b, 4
jne 0x18001d5e2
mov edx, 0xffffffff
test r8b, 8
je 0x18001d4eb
mov r15d, dword [rbp + 0x77]
imul rcx, r15, 0x438
cmp rcx, rdx
ja 0x180034374
lea eax, [rcx + rbx]
cmp eax, ebx
jb 0x180034374
mov ebx, eax
test r8b, 1
jne 0x180034356
test r8d, r8d
js 0x18003437e
xor edx, edx
lea r9, [rbp - 0x41]
xor r8d, r8d
lea rcx, [rbp - 0x19]
call qword [sym.imp.KERNELBASE.dll_BaseFormatObjectAttributes]
nop dword [rax + rax]
test eax, eax
js 0x18001d5c0
mov r8, qword [rbp - 0x41]
lea r9, [rbp - 0x51]
mov dword [rbp - 0x51], ebx
mov edx, 0xf0007
xor ebx, ebx
mov rcx, r13
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 4
mov dword [rbp - 0x4d], ebx
call qword [sym.imp.ntdll.dll_NtCreateSection]
nop dword [rax + rax]
test eax, eax
js 0x18001d5c0
mov rcx, qword [r13]
lea rax, [rbp - 0x39]
mov dword [rsp + 0x48], 4
xor r9d, r9d
mov dword [rsp + 0x40], ebx
mov r8, r12
mov dword [rsp + 0x38], 1
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x39], rbx
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
nop dword [rax + rax]
test eax, eax
js 0x18001d5c0
mov rax, qword [r12]
mov dword [rax + 4], esi
mov dword [rax], r14d
mov dword [rax + 8], r15d
mov dword [rax + 0xc], edi
xor eax, eax
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
imul eax, edi, 0x1c
add ebx, eax
jmp 0x18001d4bf
mov r14d, dword [rbp + 0x7f]
mov eax, r14d
shl rax, 5
cmp rax, rdx
ja 0x180034374
lea ecx, [rax + rbx]
cmp ecx, ebx
jb 0x180034374
mov ebx, ecx
jmp 0x18001d4f5
mov eax, 0xc0000173
jmp 0x18001d5c0
and qword [rbp - 0x29], 0
lea rdx, [rbp - 0x31]
mov dword [rbp - 0x31], 0x18
mov dword [rbp - 0x21], 1
jmp 0x18001d500

Function at 0x18001ddd0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [rsp + 0xc0]
mov qword [r11 - 0x18], rax
mov rax, qword [rsp + 0xb8]
mov qword [r11 - 0x20], rax
mov rax, qword [rsp + 0xb0]
mov qword [r11 - 0x28], rax
mov rax, qword [rsp + 0xa8]
mov qword [r11 - 0x30], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [r11 - 0x48], rax
call qword [sym.imp.KERNELBASE.dll_CreateProcessAsUserW]
nop dword [rax + rax]
add rsp, 0x68
ret
Function at 0x18001dee0
Capabilities:
Map section object

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x50
xor edi, edi
mov rbx, rdx
test rdx, rdx
je 0x18003456d
cmp dword [rdx], 0x438
jne 0x18003456d
mov dword [rsp + 0x48], 4
lea rax, [r11 + 0x20]
mov dword [rsp + 0x40], edi
lea r8, [r11 + 0x10]
mov dword [rsp + 0x38], 1
xor r9d, r9d
mov qword [r11 - 0x28], rax
or rdx, 0xffffffffffffffff
lea rax, [r11 + 0x18]
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rdi
mov qword [r11 + 0x20], rdi
mov qword [r11 + 0x10], rdi
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
nop dword [rax + rax]
test eax, eax
js 0x180034540
mov rcx, qword [rsp + 0x68]
cmp dword [rcx + 8], edi
je 0x180034544
mov rax, qword [rcx + 0x20]
lea edx, [rdi + 8]
add rax, rcx
lea r8d, [rdx + 0x78]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rbx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rbx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rbx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rbx + 0x60], xmm0
add rbx, r8
movups xmm1, xmmword [rax + 0x70]
add rax, r8
movups xmmword [rbx - 0x10], xmm1
sub rdx, 1
jne 0x18001df75
movups xmm0, xmmword [rax]
lea edi, [rdx + 1]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rbx + 0x30], rax
mov dword [rcx + 0x38], 1
mov rdx, qword [rsp + 0x68]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
nop dword [rax + rax]
mov eax, edi
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov ecx, eax
jmp 0x180034572
mov r8d, dword [rbx]
lea rcx, [rbx + 4]
sub r8, 4
xor edx, edx
call sub.ntdll.dll_memset
mov ecx, 0x12
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
nop
jmp 0x18001dfe7
mov ecx, 0xc0000004
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x18001dffe
Function at 0x18001e250
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x48
movzx eax, dl
test eax, 0xfffffffc
jne 0x180034642
test dl, 3
je 0x18001e297
mov r9d, 4
mov dword [rsp + 0x58], eax
lea r8, [rsp + 0x58]
mov dword [rsp + 0x20], 0x29
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x180034655
mov eax, 1
add rsp, 0x48
ret
mov ecx, 0x57
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x18003465c
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x18001e29c
Function at 0x18001ecd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
and qword [rsp + 0x40], 0
mov rdi, r8
and dword [rsp + 0x70], 0
mov rbp, rdx
mov rsi, rcx
test rcx, rcx
je 0x18003480b
test r8, r8
je 0x18003480b
call fcn.18001ee98
test eax, eax
je 0x18001ed6a
cmp dword [0x1800b2cd8], 0
je 0x18001ed7a
call fcn.18001ee28
test eax, eax
je 0x18001ed6a
mov rdx, qword [0x1800b2cd0]
lea r9, [rsp + 0x70]
and qword [rsp + 0x20], 0
lea r8, [0x1800207d0]
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntdll.dll_RtlQueryWnfStateData]
nop dword [rax + rax]
test eax, eax
js 0x18001ed81
cmp dword [rsp + 0x70], 1
jne 0x180034777
mov ecx, 0x139f
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x32
jmp 0x18001ed5e
mov ecx, eax
jmp 0x18003476c
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, esi
call sym.KERNEL32.dll_BaseSetLastNTError
nop
jmp 0x18001ed6a
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
lea r8d, [rdx + 0x18]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x1800347a5
mov ecx, 0xc0000017
jmp 0x18003476c
mov rdx, qword [0x1800b2cd0]
lea r9, [0x180067260]
mov dword [rsp + 0x38], 1
lea rcx, [rsp + 0x40]
and dword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov qword [rax], rsi
mov qword [rax + 8], rbp
mov r8d, dword [rsp + 0x88]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntdll.dll_RtlSubscribeWnfStateChangeNotification]
nop dword [rax + rax]
mov esi, eax
test eax, eax
js 0x18003474c
mov rcx, qword [rsp + 0x40]
mov eax, 1
mov qword [rbx + 0x10], rcx
mov qword [rdi], rbx
jmp 0x18001ed6c
mov ecx, 0x57
jmp 0x18001ed5e

Function at 0x18001efd8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea rax, [rsp + 0x38]
mov rdx, rcx
mov qword [rsp + 0x20], rax
mov rdi, r8
mov rcx, 0xffffffff80000002
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x18001f07d
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x68], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x1800348ca
mov ecx, dword [rsp + 0x30]
mov dword [rdi], ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
lea eax, [rbx + 1]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov ecx, eax
jmp 0x1800348dd
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor eax, eax
jmp 0x18001f071
Function at 0x18001f600
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
push rdi
sub rsp, 0x40
mov rbx, rcx
mov rdi, r8
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rdi]
xor edx, edx
mov r8d, 0x214
call sub.ntdll.dll_memset
mov r9, qword [rdi]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov r8d, 1
mov dword [rsp + 0x20], 0x214
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
mov rcx, qword [rdi]
mov r10d, 0xc000014c
mov r8d, eax
cmp dword [rcx + 4], 1
cmovne r8d, r10d
xor r9d, r9d
test r8d, r8d
js 0x18001f6bf
cmp dword [rcx + 4], 1
jne 0x18001f6a7
test byte [rcx + 0xc], 1
jne 0x18001f6ba
cmp dword [rcx + 0xc], 2
jb 0x18001f6ba
mov edx, dword [rcx + 0xc]
mov eax, dword [rcx + 8]
shr rdx, 1
add rcx, rax
cmp word [rcx + rdx*2 - 2], r9w
jne 0x18001f6ba
test r8d, r8d
js 0x18001f6bf
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov r8d, r10d
jmp 0x18001f6a7
mov eax, r8d
jmp 0x18001f6ae

Function at 0x1800217d0
Capabilities:
Map section object

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rdi, rdx
test rdx, rdx
je 0x180034e9a
cmp dword [rdx], 0x1c
jne 0x180034e9a
mov dword [rsp + 0x48], 4
lea rax, [r11 + 0x20]
mov dword [rsp + 0x40], ebx
lea r8, [r11 + 0x10]
mov dword [rsp + 0x38], 1
xor r9d, r9d
mov qword [r11 - 0x28], rax
or rdx, 0xffffffffffffffff
lea rax, [r11 + 0x18]
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rbx
mov qword [r11 + 0x20], rbx
mov qword [r11 + 0x10], rbx
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
nop dword [rax + rax]
test eax, eax
js 0x1800218b4
mov rdx, qword [rsp + 0x68]
mov r8d, dword [rdx + 0x3c]
cmp r8d, dword [rdx + 0xc]
jae 0x1800218a1
lea eax, [r8 + 1]
mov ebx, 1
imul rcx, r8, 0x1c
add rcx, qword [rdx + 0x28]
mov dword [rdx + 0x3c], eax
movups xmm0, xmmword [rcx + rdx]
movups xmmword [rdi], xmm0
movsd xmm1, qword [rcx + rdx + 0x10]
movsd qword [rdi + 0x10], xmm1
mov eax, dword [rcx + rdx + 0x18]
mov dword [rdi + 0x18], eax
mov rdx, qword [rsp + 0x68]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov ecx, 0x12
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x18002187e
mov ecx, eax
jmp 0x180034e9f
mov ecx, 0xc0000004
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x180021895
Function at 0x1800222b0
Capabilities:
Map section object

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x50
xor ebx, ebx
mov rdi, rdx
test rdx, rdx
je 0x180035211
cmp dword [rdx], 0x1c
jne 0x180035211
mov dword [rsp + 0x48], 4
lea rax, [r11 + 0x20]
mov dword [rsp + 0x40], ebx
lea r8, [r11 + 0x10]
mov dword [rsp + 0x38], 1
xor r9d, r9d
mov qword [r11 - 0x28], rax
or rdx, 0xffffffffffffffff
lea rax, [r11 + 0x18]
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rbx
mov qword [r11 + 0x20], rbx
mov qword [r11 + 0x10], rbx
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
nop dword [rax + rax]
test eax, eax
js 0x18002237c
mov rcx, qword [rsp + 0x68]
cmp dword [rcx + 0xc], ebx
je 0x1800351e8
mov rax, qword [rcx + 0x28]
mov ebx, 1
movups xmm0, xmmword [rax + rcx]
movups xmmword [rdi], xmm0
movsd xmm1, qword [rax + rcx + 0x10]
movsd qword [rdi + 0x10], xmm1
mov eax, dword [rax + rcx + 0x18]
mov dword [rdi + 0x18], eax
mov dword [rcx + 0x3c], 1
mov rdx, qword [rsp + 0x68]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov ecx, eax
jmp 0x180035216
mov r8d, dword [rdi]
lea rcx, [rdi + 4]
sub r8, 4
xor edx, edx
call sub.ntdll.dll_memset
mov ecx, 0x12
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
nop
jmp 0x180022359
mov ecx, 0xc0000004
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x180022370
Function at 0x180022740
Capabilities:
Map section object

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x50
xor edi, edi
mov rbx, rdx
test rdx, rdx
je 0x18003536c
cmp dword [rdx], 0x238
jne 0x18003536c
lea rax, [r11 + 0x20]
mov qword [r11 + 0x18], rdi
lea esi, [rdi + 4]
mov qword [r11 + 0x20], rdi
mov dword [rsp + 0x48], esi
lea r8, [r11 + 0x10]
mov dword [rsp + 0x40], edi
xor r9d, r9d
mov dword [rsp + 0x38], 1
or rdx, 0xffffffffffffffff
mov qword [r11 - 0x38], rax
lea rax, [r11 + 0x18]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], rdi
mov qword [r11 + 0x10], rdi
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
nop dword [rax + rax]
test eax, eax
js 0x180035368
mov rdx, qword [rsp + 0x78]
mov r8d, dword [rdx + 0x34]
cmp r8d, dword [rdx + 4]
jae 0x18002286c
imul rcx, r8, 0x238
lea eax, [r8 + 1]
add rcx, qword [rdx + 0x18]
mov dword [rdx + 0x34], eax
add rcx, rdx
lea eax, [rsi + 0x7c]
movups xmm0, xmmword [rcx]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rbx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rbx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rbx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rbx + 0x60], xmm0
add rbx, rax
movups xmm1, xmmword [rcx + 0x70]
add rcx, rax
movups xmmword [rbx - 0x10], xmm1
sub rsi, 1
jne 0x1800227e1
movups xmm0, xmmword [rcx]
lea edi, [rsi + 1]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rbx + 0x20], xmm0
mov rax, qword [rcx + 0x30]
mov qword [rbx + 0x30], rax
mov rdx, qword [rsp + 0x78]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
nop dword [rax + rax]
mov eax, edi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x12
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x18002284c
mov ecx, eax
jmp 0x180035371
mov ecx, 0xc0000004
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x180022863
Function at 0x1800229a0
Capabilities:
Map section object

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x50
xor edi, edi
mov rbx, rdx
test rdx, rdx
je 0x1800353aa
cmp dword [rdx], 0x238
jne 0x1800353aa
lea rax, [r11 + 0x20]
mov qword [r11 + 0x18], rdi
lea esi, [rdi + 4]
mov qword [r11 + 0x20], rdi
mov dword [rsp + 0x48], esi
lea r8, [r11 + 0x10]
mov dword [rsp + 0x40], edi
xor r9d, r9d
mov dword [rsp + 0x38], 1
or rdx, 0xffffffffffffffff
mov qword [r11 - 0x38], rax
lea rax, [r11 + 0x18]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], rdi
mov qword [r11 + 0x10], rdi
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
nop dword [rax + rax]
test eax, eax
js 0x18003537e
mov rcx, qword [rsp + 0x78]
cmp dword [rcx + 4], edi
je 0x180035382
mov rax, qword [rcx + 0x18]
lea edx, [rsi + 0x7c]
add rax, rcx
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rbx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rbx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rbx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rbx + 0x60], xmm0
add rbx, rdx
movups xmm1, xmmword [rax + 0x70]
add rax, rdx
movups xmmword [rbx - 0x10], xmm1
sub rsi, 1
jne 0x180022a2e
movups xmm0, xmmword [rax]
lea edi, [rsi + 1]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rbx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rbx + 0x30], rax
mov dword [rcx + 0x34], 1
mov rdx, qword [rsp + 0x78]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
nop dword [rax + rax]
mov eax, edi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
mov ecx, eax
jmp 0x1800353af
mov r8d, dword [rbx]
lea rcx, [rbx + 4]
sub r8, rsi
xor edx, edx
call sub.ntdll.dll_memset
mov ecx, 0x12
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
nop
jmp 0x180022aa0
mov ecx, 0xc0000004
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x180022ab7

Function at 0x180022b30
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
test rcx, rcx
je 0x1800353bc
xor r9d, r9d
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0x20]
lea ecx, [r9 + 0x5a]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x1800353cf
mov eax, dword [rsp + 0x30]
mov dword [rbx], eax
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180024680
add rsp, 0x50
pop rbx
ret
mov ecx, 0x57
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x1800353d6
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x180022b80

Function at 0x180022ba0
Capabilities:
Move file

Disassembly:
sub rsp, 0x38
xor r9d, r9d
mov dword [rsp + 0x20], 2
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileWithProgressW]
nop dword [rax + rax]
add rsp, 0x38
ret
Function at 0x180023210
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
mov rdi, rcx
mov ebx, dword [rsp + 0x80]
mov r14, rdx
mov r15d, r8d
mov esi, dword [rax + 0x34]
sub esi, r8d
add esi, ebx
mov ecx, esi
cmp rcx, qword [rax + 0x40]
ja 0x18002330a
mov ebp, r14d
sub ebp, dword [rax + 0x38]
mov eax, dword [rdi + 0xc0]
sub eax, r14d
mov r13d, eax
sub r13d, r15d
lea r12d, [rbx + r13]
cmp r15d, ebx
ja 0x1800232ef
test ebx, ebx
je 0x1800232cf
cmp r15d, ebx
jae 0x18003550e
mov rcx, rbx
mov r8d, eax
sub rcx, r15
mov rdx, r14
add rcx, r14
call sym.KERNEL32.dll_RtlMoveMemory
mov rdx, qword [rsp + 0x78]
mov r8, rbx
mov rcx, r14
call sym.KERNEL32.dll_RtlMoveMemory
mov rax, qword [rdi + 0x10]
cmp dword [rax + 0x34], esi
je 0x1800232b7
mov dword [rax + 0x34], esi
mov rax, qword [rdi + 0x10]
cmp ebp, dword [rax + 0x50]
jae 0x1800232c3
mov dword [rax + 0x50], ebp
mov rax, qword [rdi + 0x10]
lea ecx, [r12 + rbp]
cmp ecx, dword [rax + 0x54]
jbe 0x1800232cf
mov dword [rax + 0x54], ecx
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r8, rbx
mov rdx, r9
mov rcx, r14
call sym.KERNEL32.dll_RtlMoveMemory
mov r8d, r13d
lea rdx, [r14 + r15]
lea rcx, [rbx + r14]
jmp 0x1800232a2
cmp rcx, qword [rax + 0x48]
ja 0x180035504
mov qword [rax + 0x40], rcx
xor r8d, r8d
mov rdx, qword [rdi + 0x10]
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
lea r9, [rdx + 0x40]
add rdx, 0x38
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
nop dword [rax + rax]
test eax, eax
js 0x1800232d1
mov rax, qword [rdi + 0x10]
mov r9, qword [rsp + 0x78]
mov dword [rax + 0x34], esi
mov rax, qword [rdi + 0x10]
jmp 0x180023258
mov eax, 0x80000005
jmp 0x1800232d1
mov r12d, ebx
jmp 0x180023297