joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180075a90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov eax, 1
movzx ecx, byte [rdx + 0xb]
mov rbx, rdx
shl eax, cl
mov rcx, rdx
cdqe
lea r8, [rax + rax*2]
mov rax, qword [rdx + 0x18]
lea rbp, [rax + r8*8]
call fcn.180077310
xor esi, esi
test eax, eax
je 0x180075b08
mov r10d, esi
mov r11d, eax
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
test byte [r10 + rax + 8], 0x40
je 0x180075afe
mov rdx, qword [r10 + rax]
test byte [rdx + 9], 0x18
je 0x180075afe
mov rcx, rdi
call fcn.180074850
add r10, 0x10
sub r11, 1
jne 0x180075ae0
mov r10, qword [rbx + 0x18]
cmp r10, rbp
jae 0x180075b64
movzx eax, byte [r10 + 8]
test al, 0xf
jne 0x180075b28
test byte [r10 + 9], 0x40
je 0x180075b5b
mov byte [r10 + 9], 0xb
jmp 0x180075b5b
test byte [r10 + 9], 0x40
je 0x180075b46
mov rdx, qword [r10 + 0x10]
test byte [rdx + 9], 0x18
je 0x180075b46
mov rcx, rdi
call fcn.180074850
movzx eax, byte [r10 + 8]
test al, 0x40
je 0x180075b5b
mov rdx, qword [r10]
test byte [rdx + 9], 0x18
je 0x180075b5b
mov rcx, rdi
call fcn.180074850
add r10, 0x18
cmp r10, rbp
jb 0x180075b11
movzx eax, byte [rbx + 9]
movzx ecx, al
and cl, 7
cmp cl, 5
jne 0x180075bcf
movzx eax, byte [rbx + 8]
add eax, 0xfffffffb
cmp eax, 0x21
ja case.0x180075b9a.9
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x75c08]
mov ecx, dword [rdx + rax*4 + 0x75bf0]
add rcx, rdx
jmp rcx
lea rsi, [rbx + 0x30]
jmp case.0x180075b9a.9
lea rsi, [rbx + 0x10]
jmp case.0x180075b9a.9
lea rsi, [rbx + 0x40]
jmp case.0x180075b9a.9
lea rsi, [rbx + 0x78]
jmp case.0x180075b9a.9
lea rsi, [rbx + 0x20]
mov rax, qword [rdi + 0x90]
mov qword [rsi], rax
mov qword [rdi + 0x90], rbx
and byte [rbx + 9], 0xc7
jmp 0x180075bd9
cmp cl, 6
jne 0x180075bd9
xor al, 2
mov byte [rbx + 9], al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800760f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
mov r9, rcx
xor eax, r8d
test rdx, rdx
je 0x18007611f
nop dword [rax]
movzx r8d, byte [r9 + rdx - 1]
mov ecx, eax
shl ecx, 5
add r8d, ecx
mov ecx, eax
shr ecx, 2
add r8d, ecx
xor eax, r8d
sub rdx, 1
jne 0x180076100
ret

Function at 0x180076370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
cmp r8, 0x28
ja 0x180076395
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp fcn.180075e40
movabs rax, 0x7fffffffffffffdf
cmp rsi, rax
jae 0x1800763fd
mov rax, qword [rcx + 0x18]
add r8, 0x19
mov qword [rsp + 0x30], rbx
mov edx, 0x14
mov qword [rsp + 0x38], rdi
mov ebx, dword [rax + 0x60]
call fcn.1800739f0
mov r8, rsi
mov rdx, rbp
mov rdi, rax
mov dword [rax + 0xc], ebx
lea rcx, [rax + 0x18]
mov byte [rax + 0xa], 0
mov byte [rax + rsi + 0x18], 0
mov qword [rax + 0x10], rsi
call sub.VCRUNTIME140.dll_memcpy
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
call fcn.18008a480
int3
Function at 0x180095858
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800958dc
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x18009e9d0]
cmp byte [rcx + rax], 0
je 0x1800958dc
dec r8
sub rdx, 1
jne 0x1800958c2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14002001e
Capabilities:
Delete file

Disassembly:
jmp 0x140050ab0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x6a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x10e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x6c8]
lea rcx, [0x140097c3a]
call fcn.140021040
mov edx, 0x410
lea rcx, [rbp + 0x10]
call fcn.140020b7c
mov rax, qword [rbp + 0x6a8]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x6a0]
lea r8, [0x1400706d0]
mov edx, 0x208
lea rcx, [rbp + 0x10]
call fcn.140020aa5
cmp dword [rbp + 0x6b0], 0
je 0x140050b41
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140050b62
cmp qword [rbp + 0x690], 0
je 0x140050b62
mov r8d, dword [rbp + 0x698]
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x690]
call fcn.14002051e
lea rcx, [rbp - 0x30]
lea rdx, [0x14007cb60]
call fcn.140020d66
lea rsp, [rbp + 0x678]
pop rdi
pop rbp
ret
Function at 0x140020168
Capabilities:
Set registry value

Disassembly:
jmp 0x140056170
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1e8]
lea rcx, [0x140097c3a]
call fcn.140021040
mov dword [rbp + 4], 0xc0000001
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x90], 0
xor eax, eax
mov word [rbp + 0x88], ax
xor eax, eax
mov word [rbp + 0x8a], ax
cmp qword [rbp + 0x190], 0
je 0x14005620e
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x88]
mov rcx, qword [rbp + 0x190]
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
movzx eax, al
test eax, eax
jne 0x14005620e
mov eax, 0xc00000f0
jmp 0x1400563bc
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x198]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140056268
mov dword [rbp + 4], 0xc0000022
jmp 0x140056398
mov dword [rbp + 0x44], 0
mov dword [rbp + 0x24], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x1400562af
jmp 0x140056378
mov dword [rbp + 0x24], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x1400562ef
jmp 0x140056378
mov dword [rbp + 0x24], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x24]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x14005632c
jmp 0x140056378
cmp qword [rbp + 0x190], 0
je 0x14005636e
movzx eax, word [rbp + 0x88]
add rax, 2
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x44], eax
xor eax, eax
test eax, eax
jne 0x14005626f
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp + 0x44], 0
je 0x140056391
mov dword [rbp + 4], 0xc0000022
jmp 0x140056398
mov dword [rbp + 4], 0
cmp qword [rbp + 0x190], 0
je 0x1400563b9
cmp qword [rbp + 0x90], 0
je 0x1400563b9
lea rcx, [rbp + 0x88]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14007da20]
call fcn.140020d66
mov rax, rdi
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400201b8
Capabilities:
Map section object

Disassembly:
jmp 0x140052c00
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1d8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1f8]
lea rcx, [0x140097c3a]
call fcn.140021040
mov qword [rbp + 8], 0
cmp dword [rbp + 0x1b8], 0
je 0x140052c61
mov dword [rbp + 0x24], 4
jmp 0x140052c68
mov dword [rbp + 0x24], 2
mov rax, qword [rbp + 0x1a8]
and rax, 0xfffffffffffff000
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x1a8]
sub rcx, rax
mov rax, rcx
mov ecx, dword [rbp + 0x1b0]
add rax, rcx
mov qword [rbp + 0x68], rax
mov eax, dword [rbp + 0x24]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
lea rax, [rbp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 8]
mov rdx, 0xffffffffffffffff
mov rcx, qword [rbp + 0x1a0]
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0
jge 0x140052d1a
mov ecx, dword [rbp + 0xa4]
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140052d20
mov rax, qword [rbp + 8]
jmp 0x140052d22
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14007afd0]
call fcn.140020d66
mov rax, rdi
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret

Function at 0x1400201f4
Capabilities:
Get system information on windows

Disassembly:
jmp 0x140028e70
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x140095341]
call fcn.140021040
mov qword [rbp + 0x28], 0
mov dword [rbp + 0x44], 0
lea r9, [rbp + 0x44]
mov r8d, 8
lea rdx, [rbp + 0x28]
mov ecx, 0x32
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x140028ede
mov ecx, dword [rbp + 4]
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
mov rax, qword [rbp + 0x28]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400657a0]
call fcn.140020d66
mov rax, rdi
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x140020253
Capabilities:
Terminate thread

Disassembly:
jmp 0x140045e90
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1400975f5]
call fcn.140021040
mov rax, qword [rbp + 0x100]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140045ed0
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140045f16
mov edx, 0x7d0
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140045efa
xor edx, edx
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rax, qword [rbp + 8]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call fcn.140020aaa
mov eax, 1
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140020271
Capabilities:
Delete file

Disassembly:
jmp 0x140050370
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x140097c3a]
call fcn.140021040
mov eax, dword [rbp + 0x108]
mov dword [rbp + 4], eax
mov ecx, dword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400503c4
mov eax, 1
jmp 0x1400503d4
mov eax, dword [rbp + 4]
dec eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x1400503a0
xor eax, eax
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140020410
Capabilities:
Access pe header

Disassembly:
jmp 0x140054c50
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1a8]
lea rcx, [0x140097c3a]
call fcn.140021040
mov dword [rbp + 4], 0
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x140054d67
mov dword [rbp + 0x44], 0
lea rdx, [rbp + 0x44]
mov rcx, qword [rbp + 0x180]
call fcn.140020627
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
je 0x140054d67
mov rdx, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x68]
call fcn.1400209ab
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
je 0x140054d55
mov rax, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x88]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 0x28], eax
cmp dword [rbp + 0x198], 0
je 0x140054d35
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 0x16]
btr eax, 0xd
mov rcx, qword [rbp + 0x28]
mov word [rcx + 0x16], ax
mov edx, dword [rbp + 0x188]
mov rcx, qword [rbp + 0x180]
call fcn.140020e7e
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 0x58], eax
mov dword [rbp + 4], 1
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14007c0a0]
call fcn.140020d66
mov eax, edi
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x140020460
Capabilities:
Get uefi variable

Disassembly:
jmp 0x1400543f0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x148]
lea rcx, [0x140097c3a]
call fcn.140021040
mov byte [rbp + 4], 0
mov byte [rbp + 0x24], 0
cmp qword [rbp + 0x120], 0
je 0x140054444
mov rax, qword [rbp + 0x120]
mov byte [rax], 0
mov dl, 1
mov ecx, 0x16
call fcn.140020d2a
movzx eax, al
test eax, eax
jl 0x1400544a0
mov byte [rbp + 0x24], 0
mov r9d, 1
lea r8, [rbp + 0x24]
lea rdx, str.8be4df61_93ca_11d2_aa0d_00e098032b8c
lea rcx, str.SecureBoot
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
xor edx, edx
mov ecx, 0x16
call fcn.140020d2a
cmp qword [rbp + 0x120], 0
je 0x14005449c
mov rax, qword [rbp + 0x120]
movzx ecx, byte [rbp + 0x24]
mov byte [rax], cl
mov byte [rbp + 4], 1
movzx eax, byte [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14007be00]
call fcn.140020d66
mov eax, edi
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400204c4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140030310
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rcx, [0x14009546b]
call fcn.140021040
cmp qword [rbp + 0x140], 0
je 0x14003034b
cmp dword [rbp + 0x148], 0
jne 0x14003034d
jmp 0x14003039b
mov eax, dword [rbp + 0x150]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 0x148]
mov dword [rbp + 0x24], eax
mov rax, qword [rbp + 0x140]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
movzx eax, byte [rax]
xor eax, dword [rbp + 4]
mov rcx, qword [rbp + 0x48]
mov byte [rcx], al
mov eax, dword [rbp + 4]
rol eax, 1
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
mov eax, dword [rbp + 0x24]
dec eax
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jne 0x14003036a
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x1400204e2
Capabilities:
Get common file path

Disassembly:
jmp 0x140033a70
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x798
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x14e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x7b8]
lea rcx, [0x140095675]
call fcn.140021040
mov dword [rbp + 0x24], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0xa8], 0
cmp dword [rbp + 0x790], 0x23f0
jae 0x140033ae4
lea rax, str.ntoskrnl.exe
mov qword [rbp + 0xc8], rax
jmp 0x140033af2
lea rax, str.CI.dll
mov qword [rbp + 0xc8], rax
lea rdx, [rbp + 0x24]
mov rcx, qword [rbp + 0xc8]
call fcn.14002046a
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x140033b32
mov r8, qword [rbp + 0xc8]
lea rdx, str.____Abort__could_not_query___ws__image_base_r_n
mov ecx, 1
call fcn.1400204b0
xor eax, eax
jmp 0x140033cca
mov eax, 2
imul rax, rax, 0
xor ecx, ecx
mov word [rbp + rax + 0x110], cx
mov edx, 0x104
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140033b62
xor eax, eax
jmp 0x140033cca
lea rdx, [0x14006ede8]
lea rcx, [rbp + 0x110]
call fcn.140020f96
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x110]
call fcn.140020f96
mov r8d, 1
xor edx, edx
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0
je 0x140033ca5
mov rdx, qword [rbp + 0xc8]
lea rcx, str.___Module___ws__loaded_for_pattern_search_r_n
call fcn.140020f41
cmp dword [rbp + 0x790], 0x23f0
jae 0x140033c0d
lea rdx, [rbp + 0x48]
mov rcx, qword [rbp + 0xe8]
call fcn.140020d8e
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jl 0x140033c0b
mov r9, qword [rbp + 0x48]
lea r8, [rbp + 0xa8]
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0xe8]
call fcn.140020686
mov dword [rbp + 4], eax
jmp 0x140033c31
mov r9d, dword [rbp + 0x790]
lea r8, [rbp + 0xa8]
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0xe8]
call fcn.140020500
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jl 0x140033c87
mov rax, qword [rbp + 0x88]
cmp qword [rbp + 0xa8], rax
jb 0x140033c6d
mov eax, dword [rbp + 0x24]
mov rcx, qword [rbp + 0x88]
add rcx, rax
mov rax, rcx
cmp qword [rbp + 0xa8], rax
ja 0x140033c6d
mov rax, qword [rbp + 0xa8]
mov qword [rbp + 0x68], rax
jmp 0x140033c85
mov r8, qword [rbp + 0xa8]
lea rdx, str.____Resolved_address_0x_llX_does_not_belong_required_module._r_n
mov ecx, 1
call fcn.1400204b0
jmp 0x140033c96
mov edx, dword [rbp + 4]
lea rcx, str.____Failed_to_locate_kernel_variable_address
call fcn.140020249
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140033cc6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, qword [rbp + 0xc8]
lea rdx, str.____Could_not_load___ws___GetLastError__lu_r_n
mov ecx, 1
call fcn.1400204b0
mov rax, qword [rbp + 0x68]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14006e920]
call fcn.140020d66
mov rax, rdi
lea rsp, [rbp + 0x778]
pop rdi
pop rbp
ret
Function at 0x140020550
Capabilities:
Unload driver

Disassembly:
jmp 0x140055bd0
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x458
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x478]
lea rcx, [0x140097c3a]
call fcn.140021040
mov edx, 0x20a
lea rcx, [rbp + 0x80]
call fcn.140020b7c
mov rax, qword [rbp + 0x440]
mov qword [rsp + 0x20], rax
lea r9, str.RegistryMachine
lea r8, str._wSSystemCurrentControlSetServices_wS
mov edx, 0x104
lea rcx, [rbp + 0x80]
call fcn.140020aa5
test eax, eax
jge 0x140055c53
mov eax, 0xc00000ef
jmp 0x140055ccc
mov qword [rbp + 0x28], 0x12
mov rax, qword [rbp + 0x28]
lea rax, [rbp + rax*2 + 0x80]
mov rdx, rax
xor ecx, ecx
call fcn.140020168
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jge 0x140055c7f
mov eax, dword [rbp + 4]
jmp 0x140055ccc
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x48]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rbp + 0x48]
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jl 0x140055cc9
movzx eax, byte [rbp + 0x448]
test eax, eax
je 0x140055cc9
mov rax, qword [rbp + 0x28]
lea rax, [rbp + rax*2 + 0x80]
mov rdx, rax
mov rcx, 0xffffffff80000002
call fcn.140020e60
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14007b820]
call fcn.140020d66
mov rax, rdi
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x140020712
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
jmp 0x14004afe0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x218
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x238]
lea rcx, [0x140097a2f]
call fcn.140021040
mov dword [rbp + 4], 0
mov dword [rbp + 0x24], 0
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x50]
call fcn.140020c53
mov dword [rbp + 0x50], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0xd8]
call fcn.140020c53
mov rdx, qword [rbp + 0x1e8]
lea rcx, str.___Creating_Process__s_r_n
call fcn.140020681
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x1e8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x14004b0db
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_create_process
call fcn.140020c49
mov eax, dword [rbp + 4]
jmp 0x14004b191
mov edx, dword [rbp + 0xe8]
lea rcx, str.___Created_Process_with_PID__lu_r_n
call fcn.140020f41
mov eax, dword [rbp + 0xe8]
mov r9d, 1
mov r8d, 3
mov edx, eax
mov rcx, qword [rbp + 0x1e0]
call fcn.140020d20
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
jne 0x14004b12f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_set_process_as_PPL
call fcn.140020c49
mov eax, dword [rbp + 4]
jmp 0x14004b191
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 1
je 0x14004b162
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov edx, dword [rbp + 0x24]
lea rcx, str.____Failed_to_resume_process:__lu__0x_lX_n
call fcn.140020f41
mov eax, dword [rbp + 4]
jmp 0x14004b191
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x140078de0]
call fcn.140020d66
mov rax, rdi
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x14002079e
Capabilities:
Get system information on windows

Disassembly:
jmp 0x140026f70
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x188]
lea rcx, [0x140095341]
call fcn.140021040
mov qword [rbp + 8], 0
mov dword [rbp + 0x24], 0x1000
mov dword [rbp + 0x64], 0
cmp qword [rbp + 0x168], 0
je 0x140026fe2
mov rax, qword [rbp + 0x168]
mov dword [rax], 0
mov eax, dword [rbp + 0x24]
mov ecx, eax
call qword [rbp + 0x170]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140026fff
xor eax, eax
jmp 0x140027088
lea r9, [rbp + 0x64]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 8]
mov ecx, dword [rbp + 0x160]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0xc0000004
jne 0x140027053
mov rcx, qword [rbp + 8]
call qword [rbp + 0x178]
mov eax, dword [rbp + 0x24]
shl eax, 1
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0x20000000
jbe 0x140027042
xor eax, eax
jmp 0x140027088
mov eax, dword [rbp + 0x24]
mov ecx, eax
call qword [rbp + 0x170]
mov qword [rbp + 8], rax
jmp 0x140026fff
cmp qword [rbp + 0x168], 0
je 0x140027069
mov rax, qword [rbp + 0x168]
mov ecx, dword [rbp + 0x64]
mov dword [rax], ecx
cmp dword [rbp + 0x44], 0
jl 0x140027075
mov rax, qword [rbp + 8]
jmp 0x140027088
cmp qword [rbp + 8], 0
je 0x140027086
mov rcx, qword [rbp + 8]
call qword [rbp + 0x178]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140065a70]
call fcn.140020d66
mov rax, rdi
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret