joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d1c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4039a3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409400
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045b3e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403980
cmp byte [0x00586368], 0
je 0x45d1d5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45a420
jmp 0x403980

Function at 0x45d1e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00586620]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x00586368], 0
je 0x45d215
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005868e0]
aesenc xmm0, xmmword [0x005868f0]
aesenc xmm0, xmmword [0x00586900]
movq rax, xmm0
ret
jmp 0x409620

Function at 0x45d220
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00586620]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x00586368], 0
je 0x45d256
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005868e0]
aesenc xmm0, xmmword [0x005868f0]
aesenc xmm0, xmmword [0x00586900]
movq rax, xmm0
ret
jmp 0x409680

Function at 0x45ef20
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x45ef54
mov rcx, 0x28
jmp 0x45ef5f
shl rcx, 3
add rcx, 0x1480
mov qword [0x00586588], rcx
pop rbp
ret
Function at 0x466360
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46642a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004038e0
xorps xmm15, xmm15
mov r14, qword [0x00586588]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x46640f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0048d9a0]
xor ebx, ebx
mov rcx, rdx
call fcn.00445a20
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004666c0
inc rbx
cmp rcx, rbx
jae 0x4663fe
mov edi, 1
lea rsi, [0x0048d9a0]
call fcn.00445b00
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004c19c8]
lea rsi, [0x004c1390]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045b3e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00466360
Function at 0x140002c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x58]
xor r15d, r15d
mov r11, qword [rsp + 0x70]
mov r13, rdx
mov rax, qword [rsp + 0x60]
mov qword [r14], r8
mov qword [r11], rax
mov rdi, qword [r14]
cmp rdi, r9
je 0x140002db3
mov r12, qword [rsp + 0x68]
lea r8d, [r15 + 1]
mov rsi, qword [r11]
mov r9d, 0x3ff
mov r10d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x140002db3
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rdi]
cmp r8w, dx
jae 0x140002cb9
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x140002dd7
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140002ccf
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x140002ccf
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140002ce2
movzx r9d, al
mov r10d, r15d
mov ebx, r15d
jmp 0x140002d2d
mov r9d, eax
cmp eax, 0x800
jae 0x140002cfc
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x140002d2d
cmp eax, 0x10000
jae 0x140002d16
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov ebx, r10d
jmp 0x140002d2d
shr r9d, 0x12
mov r10d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdx, r12
sub rdx, rsi
mov ecx, r8d
cmp rdx, rcx
jl 0x140002db3
lea rcx, [rdi + 2]
mov qword [r14], rcx
test bpl, bpl
jne 0x140002d51
cmp r10d, 3
jae 0x140002d5d
mov rcx, qword [r11]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jle 0x140002d8e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax + rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jg 0x140002d70
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rdi, qword [r14]
cmp rdi, qword [rsp + 0x50]
jne 0x140002c6e
mov rax, qword [rsp + 0x48]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, 2
jmp 0x140002dc2

Function at 0x1400047f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000483a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000483a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000483a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000483a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000483a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000483c
xor al, al
add rsp, 0x28
ret
Function at 0x140001c38
Capabilities:
Create device object
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
and qword [rbp + 0x10], 0
lea rax, [0x140006eb0]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [0x140006e00]
mov dword [rbp - 0x20], 0x340032
mov qword [rbp - 8], rax
mov r9d, 0x22
lea rax, [rbp + 0x10]
mov dword [rbp - 0x10], 0x3c003a
mov qword [rsp + 0x30], rax
xor edx, edx
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov ebx, eax
test eax, eax
js 0x140001cc6
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov ebx, eax
test eax, eax
jns 0x140001cc6
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
lea rcx, [0x140006ef0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret

Function at 0x1400020ec
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x14000d2b8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, r8d
mov r13b, r9b
and eax, 3
mov r12d, r8d
mov r14, rdx
mov r15, rcx
cmp al, 3
jne 0x14000226c
mov edx, 8
lea ecx, [rdx + 2]
call fcn.140001f70
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000226c
movzx edx, word [r14 + 2]
lea eax, [rbp + 1]
mov ecx, eax
xor r8d, r8d
mov sil, al
call fcn.14000344c
mov rdi, rax
test rax, rax
je 0x14000225c
movzx r8d, word [r14 + 2]
mov rcx, rax
mov rdx, qword [r14 + 8]
call fcn.140006b40
movzx ecx, word [r14]
mov eax, 0xfffe
and cx, ax
movzx edx, bp
cmp bp, cx
jae 0x1400021c7
lea r9d, [rbp + 0x5c]
lea r8d, [rbp + 1]
movzx eax, dx
movzx ecx, word [rdi + rax*2]
cmp cx, 0x2f
jne 0x1400021ac
mov word [rdi + rax*2], r9w
mov sil, bpl
jmp 0x1400021b7
cmp cx, r9w
movzx esi, sil
cmove esi, ebp
movzx eax, word [r14]
add dx, r8w
shr ax, 1
cmp dx, ax
jb 0x140002195
mov rdx, rdi
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
test r13b, r13b
je 0x14000220a
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, r15
je 0x14000220a
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov ebp, 1
test r12b, 2
je 0x140002240
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], r12d
mov r8b, sil
mov rdx, r15
mov rcx, rbx
call fcn.140002554
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], r12d
mov r8b, sil
mov rdx, r15
mov rcx, rbx
call fcn.140002670
test bpl, bpl
je 0x140002250
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
xor edx, edx
mov rcx, rdi
call fcn.140003440
jmp 0x140002267
mov rcx, rbx
call fcn.140001fec
mov rbx, rbp
mov rax, rbx
jmp 0x14000226e
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400067f0
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002298
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, rcx
lea rdx, [rsp + 0x58]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140002337
mov rdx, qword [r14 + 0x20]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r9b, 1
mov r8d, dword [r14 + 0x3c]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
call fcn.1400020ec
mov rsi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140002337
mov rcx, rax
call fcn.1400020e0
shl eax, 3
mov edi, dword [r14 + 0x38]
cmp eax, edi
cmovbe edi, eax
mov dword [rsp + 0x50], edi
test edi, edi
je 0x14000232b
mov rcx, rsi
call fcn.140002020
mov rdx, rax
mov r8d, edi
mov rcx, qword [r14 + 0x30]
call fcn.140006b40
jmp 0x14000232b
mov rcx, rsi
call fcn.140001fec
mov eax, edi
jmp 0x140002339
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x140002348
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [rsp + 0x30]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140002368
xor eax, eax
jmp 0x140002389
mov rdx, qword [rsp + 0x30]
mov r8b, 1
mov rcx, rbx
call fcn.140002390
mov rcx, qword [rsp + 0x30]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140002430
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbx, rcx
xor edi, edi
test rcx, rcx
je 0x140002538
test rdx, rdx
je 0x140002538
mov qword [rax - 0x50], rdi
lea rcx, [rax - 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
nop
mov eax, 0x5a4d
cmp word [rbx], ax
je 0x14000247f
xor eax, eax
jmp 0x14000253a
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
je 0x140002493
xor eax, eax
jmp 0x14000253a
mov ecx, 0x10b
cmp word [rax + rbx + 0x18], cx
jne 0x1400024a5
mov ecx, dword [rax + rbx + 0x78]
jmp 0x1400024ac
mov ecx, dword [rax + rbx + 0x88]
mov r14d, ecx
mov r15d, dword [r14 + rbx + 0x24]
add r15, rbx
mov eax, dword [r14 + rbx + 0x20]
add rax, rbx
mov qword [rsp + 0x80], rax
mov r12d, dword [r14 + rbx + 0x1c]
add r12, rbx
mov esi, edi
mov dword [rsp + 0x20], edi
cmp esi, dword [r14 + rbx + 0x18]
jae 0x14000252c
mov r13d, esi
mov edx, dword [rax + r13*4]
add rdx, rbx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlCompareString]
cmp eax, 1
jne 0x14000251c
movzx eax, word [r15 + r13*2]
mov eax, dword [r12 + rax*4]
add rax, rbx
mov qword [rsp + 0x28], rax
jmp 0x14000253a
inc esi
mov dword [rsp + 0x20], esi
mov rax, qword [rsp + 0x80]
jmp 0x1400024d5
jmp 0x140002533
mov rax, rdi
jmp 0x14000253a
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140002798
Capabilities:
Find process by pid
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov dil, 1
lea rbx, [0x14000deb0]
mov esi, 0x400
mov rcx, qword [rbx]
test rcx, rcx
je 0x140002812
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400027fe
mov rcx, qword [rsp + 0x30]
add rcx, qword [0x14001a7b8]
mov rdx, qword [rbx + 8]
call fcn.140002acc
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
and qword [rbx], 0
and qword [rbx + 8], 0
jmp 0x140002812
mov edx, dword [rbx]
lea rcx, [0x140006fa0]
mov r8d, eax
call sub.ntoskrnl.exe_DbgPrint
xor dil, dil
add rbx, 0x10
sub rsi, 1
jne 0x1400027b6
mov rbx, qword [rsp + 0x38]
mov al, dil
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14000290c
Capabilities:
Find process by pid
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
lea rbp, [0x14000deb0]
mov rbx, rcx
mov rax, rbp
xor edi, edi
cmp qword [rax], rbx
je 0x140002943
inc edi
lea rcx, [0x140011eb0]
add rax, 0x10
cmp rax, rcx
jl 0x14000292a
jmp 0x1400029a3
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140002992
mov rcx, qword [0x14001a7b8]
add rcx, qword [rsp + 0x38]
movsxd rbx, edi
add rbx, rbx
mov rdx, qword [rbp + rbx*8 + 8]
call fcn.140002acc
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
and qword [rbp + rbx*8], 0
mov al, 1
and qword [rbp + rbx*8 + 8], 0
jmp 0x1400029b3
mov r8d, eax
lea rcx, [0x140006fa0]
mov edx, ebx
call sub.ntoskrnl.exe_DbgPrint
mov edx, ebx
lea rcx, [0x140006fe0]
call sub.ntoskrnl.exe_DbgPrint
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400029fc
Capabilities:
Find process by pid
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
lea r8, [0x14000deb0]
mov rsi, rcx
mov rax, r8
mov ecx, ebx
mov rbp, rdx
cmp qword [rax], rbx
je 0x140002a3d
inc ecx
lea rdx, [0x140011eb0]
add rax, 0x10
cmp rax, rdx
jl 0x140002a24
jmp 0x140002a49
movsxd rdi, ecx
shl rdi, 4
add rdi, r8
jne 0x140002a5e
mov r8d, ebp
lea rcx, [0x140006f50]
mov edx, esi
call sub.ntoskrnl.exe_DbgPrint
xor al, al
jmp 0x140002ab6
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov qword [rdi], rsi
cmp qword [rdi + 8], rbx
jne 0x140002a95
mov rsi, qword [0x14001a7b8]
add rsi, qword [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002a91
mov rbx, qword [rsi]
mov qword [rdi + 8], rbx
mov rcx, qword [0x14001a7b8]
mov rdx, rbp
add rcx, qword [rsp + 0x40]
call fcn.140002acc
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140002f94
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x14000d2b8]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rdi, rcx
mov dword [rsp + 0x20], 0x1c001a
lea rax, [0x1400070c0]
mov dword [rsp + 0x30], 0x11c
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor edx, edx
mov r8d, 0x118
call fcn.140006a40
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
xor ebx, ebx
test rax, rax
je 0x140003009
lea rcx, [rsp + 0x30]
call qword [0x140008370]
jmp 0x140003021
xor r9d, r9d
lea r8, [rsp + 0x3c]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x34]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
movzx ecx, byte [rbp + 0x4a]
mov edx, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x34]
test rdi, rdi
je 0x140003043
mov eax, dword [rsp + 0x3c]
mov dword [rdi + 8], eax
mov dword [rdi], r8d
mov dword [rdi + 4], edx
mov dword [rdi + 0xc], ecx
mov r9d, 5
cmp r8d, r9d
jne 0x14000309f
test edx, edx
jne 0x14000305a
lea eax, [rdx + 0x14]
jmp 0x140003100
cmp edx, 1
jne 0x140003067
lea eax, [rdx + 0x12]
jmp 0x140003100
cmp edx, 2
jne 0x1400030fe
cmp cl, 1
jne 0x14000307d
lea eax, [rdx + 0x10]
jmp 0x140003100
mov eax, 0x8000
cmp word [rbp + 0x48], ax
jne 0x14000308f
mov eax, 0xf
jmp 0x140003100
movzx eax, word [rbp + 0x44]
neg ax
sbb eax, eax
neg eax
add eax, 0x10
jmp 0x140003100
cmp r8d, 6
jne 0x1400030e8
test edx, edx
jne 0x1400030b4
dec cl
neg cl
sbb eax, eax
add eax, 0xd
jmp 0x140003100
cmp edx, 1
jne 0x1400030c4
dec cl
neg cl
sbb eax, eax
add eax, 0xb
jmp 0x140003100
cmp edx, 2
jne 0x1400030d4
dec cl
neg cl
sbb eax, eax
add eax, 9
jmp 0x140003100
mov eax, 3
cmp edx, eax
jne 0x1400030fe
cmp cl, 1
setne bl
lea eax, [rbx + 6]
jmp 0x140003100
cmp r8d, 0xa
jne 0x1400030fe
test edx, edx
jne 0x1400030fe
cmp cl, 1
lea eax, [rdx + 3]
cmove eax, r9d
jmp 0x140003100
xor eax, eax
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400067f0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x1400031d0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [0x14001a7c8], rcx
mov qword [0x14001a7c0], rcx
mov rbx, rdx
lea rcx, [0x14001a7e0]
call fcn.140002f94
lea rdx, [0x140007020]
mov dword [0x14001a7d0], eax
lea rcx, [0x14001a7a0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x28], 0
lea rax, [0x14001a7b0]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8, rdi
lea rdx, [0x14001a7a0]
lea rcx, [0x140003350]
call qword [sym.imp.ntoskrnl.exe_CmRegisterCallbackEx]
test eax, eax
lea rdx, [0x140007050]
lea rcx, [0x140007030]
cmovns rcx, rdx
call sub.ntoskrnl.exe_DbgPrint
mov rdx, rbx
mov rcx, rdi
call fcn.14000370c
mov rdx, rbx
mov rcx, rdi
call fcn.140002830
lea rcx, [0x140003320]
call fcn.140001e10
mov rdx, rbx
mov rcx, rdi
call fcn.140002794
mov rdx, rbx
mov rcx, rdi
call fcn.140001000
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x140005580
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rbx, r9
mov r14, rdx
mov rdi, rcx
test rcx, rcx
jne 0x1400055af
xor eax, eax
jmp 0x140005688
and dword [rbp - 0x1c], 0
and dword [rbp - 0xc], 0
mov dword [rbp - 0x40], 0x40
test rbx, rbx
je 0x140005603
mov eax, dword [r9 + 0x18]
mov qword [rbp - 0x38], rax
mov eax, dword [r9 + 0x20]
mov dword [rbp - 0x3c], eax
mov eax, dword [r9 + 0x1c]
mov qword [rbp - 0x30], rax
mov rax, qword [r9 + 0x80]
mov qword [rbp - 0x28], rax
movzx eax, word [r9 + 0x26]
mov dword [rbp - 0x10], eax
mov eax, dword [r9 + 0x28]
mov qword [rbp - 8], rax
movzx eax, word [r9 + 0x2e]
mov dword [rbp - 0x20], eax
mov eax, dword [r9 + 0x30]
jmp 0x140005642
mov rcx, qword [rbp + 0x40]
mov rax, qword [rcx + 0x30]
mov qword [rbp - 0x38], rax
mov eax, dword [rcx + 0x40]
mov dword [rbp - 0x3c], eax
mov rax, qword [rcx + 0x38]
mov qword [rbp - 0x30], rax
mov rax, qword [rcx + 0xe8]
mov qword [rbp - 0x28], rax
movzx eax, word [rcx + 0x4a]
mov dword [rbp - 0x10], eax
mov rax, qword [rcx + 0x50]
mov qword [rbp - 8], rax
movzx eax, word [rcx + 0x5a]
mov dword [rbp - 0x20], eax
mov rax, qword [rcx + 0x60]
lea r9, [rbp - 0x40]
mov qword [rbp - 0x18], rax
mov rcx, rdi
call fcn.1400056d4
test al, al
jne 0x140005685
lea rdx, [rbp + 0x30]
mov rcx, rdi
call fcn.14000550c
mov r8d, dword [rbp + 0x30]
mov rsi, rax
test rax, rax
jne 0x14000569d
neg rbx
lea rcx, [0x140007300]
sbb edx, edx
and edx, 0x16
add edx, 0x40
call sub.ntoskrnl.exe_DbgPrint
mov rax, rdi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
lea r9, [rbp - 0x40]
mov rdx, r14
mov rcx, rsi
mov rdi, rsi
call fcn.1400056d4
test al, al
jne 0x140005685
mov r8d, dword [rbp + 0x30]
lea rcx, [0x140007350]
neg rbx
sbb edx, edx
and edx, 0x16
add edx, 0x40
call sub.ntoskrnl.exe_DbgPrint
mov rax, rsi
jmp 0x140005688
Function at 0x140005b8c
Capabilities:
Get system information on windows
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov edi, 0x20018
mov edx, edi
xor ecx, ecx
mov r8d, 0x53595351
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x140005c92
lea rdx, [rax + 0x18]
mov r8d, edi
lea r9, [rsp + 0x48]
mov ecx, 0xb
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140005bf2
mov edx, 0x53595351
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
add edi, edi
jmp 0x140005ba6
test eax, eax
js 0x140005c84
mov edi, dword [rbx + 0x18]
xor esi, esi
mov dword [rbx], 0x18
mov eax, dword [rsp + 0x48]
and dword [rbx + 8], 0
add eax, 0x18
and dword [rbx + 0xc], 0
and dword [rbx + 0x14], 0
mov dword [rbx + 0x10], eax
mov dword [rbx + 4], edi
test edi, edi
je 0x140005c68
lea rbp, [rbx + 0x46]
movabs rax, 0x8000000000000000
cmp qword [rbp - 0x16], rax
jbe 0x140005c5b
movzx edx, word [rbp]
lea rcx, [0x1400073d0]
mov eax, esi
imul r8, rax, 0x128
add r8, 0x48
add r8, rbx
add r8, rdx
mov edx, esi
call sub.ntoskrnl.exe_DbgPrint
inc esi
add rbp, 0x128
cmp esi, edi
jb 0x140005c26
test r14, r14
je 0x140005c72
mov qword [r14], rbx
jmp 0x140005c80
mov edx, 0x53595351
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
jmp 0x140005c94
mov edx, 0x53595351
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140005eb4
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140005f09
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x30]
cmp qword [rcx + rax], 0
jne 0x140005f05
mov rax, qword [rbx + 0x28]
mov rcx, qword [rcx + rax]
cmp rcx, qword [rbx + 0x30]
je 0x140005f09
cmp rcx, qword [rbx + 0x38]
je 0x140005f09
mov al, 1
jmp 0x140005f0b
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140006080
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
and qword [rsp + 0x30], 0
mov dil, dl
mov rbx, rcx
lea rdx, [rsp + 0x30]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400060f1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov r8, qword [rbx + 0x30]
mov al, 1
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rbx + 0x28]
test r8, r8
je 0x1400060f3
cmp dil, al
jne 0x1400060df
test rdx, rdx
je 0x1400060f3
mov dword [r8 + rcx], 4
mov eax, dword [rbx + 0x38]
jmp 0x1400060ee
test rdx, rdx
je 0x1400060f3
mov eax, dword [rbx + 0x38]
mov dword [r8 + rcx], eax
mov eax, dword [rbx + 0x18]
mov dword [rdx + rcx], eax
xor al, al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret