joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140105180
Capabilities:
Encode data using xor

Disassembly:
push rbx
nop
add rsp, 0x4ffb513f
sub rsp, 0x4ffb515f
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x78]
mov rdx, qword [rbx + 0x648]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.1401014d0
lea rcx, [rbx + 0x640]
lea rdx, [rsp + 0x30]
call fcn.140104db0
mov rcx, rbx
sub rsp, 0xffffffffffffffe0
pop rbx
jmp 0x140105180
push rbx
nop
sub rsp, 0x42412924
add rsp, 0x42412904
cmp qword [rcx + 0x648], 0
mov rbx, rcx
je 0x1401052c4
lea rdx, [rsp + 0x30]
call fcn.1400ef960
mov r8, qword [rsp + 0x30]
mov r11d, 0x2cbfd131
add r11d, 0x4aa47a4e
sub r11d, 0x98c84c1
sub r11d, 0x6dd7c61e
mov r9d, dword [rsp + 0x34]
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x648]
mov rdx, qword [rbx + 0x648]
cmp eax, r11d
cmovl r11d, eax
xor r10d, r10d
test rdx, rdx
je 0x140105273
mov rax, qword [rbx + 0x640]
mov qword [rsp + 0x38], rdi
lea rdi, [rax + rdx*8]
cmp rax, rdi
je 0x14010526e
mov r8d, r11d
xor r8d, 0x5e914561
xor r9d, 0x5e914561
nop word [rax + rax]
mov rdx, qword [rax]
mov ecx, r10d
xor ecx, 0x5e914561
add r10d, r11d
add rax, 8
mov dword [rdx + 0x30], ecx
mov dword [rdx + 0x34], 0x5a00af9d
xor dword [rdx + 0x34], 0x4d8b4e39
add dword [rdx + 0x34], 0x470563bd
mov dword [rdx + 0x38], r8d
mov dword [rdx + 0x3c], r9d
cmp rax, rdi
jne 0x140105228
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x1401052bc
sub r8d, r9d
mov dword [rax + 0x14], 0x15339948
add dword [rax + 0x14], 0x41f70f15
xor dword [rax + 0x14], 0x3889f4ca
xor dword [rax + 0x14], 0x313219f6
xor r8d, 0x5e914561
xor r9d, 0x5e914561
mov dword [rax + 0x10], r8d
mov dword [rax + 0x18], r9d
mov dword [rax + 0x1c], r9d
mov rcx, rbx
call fcn.1400ef140
nop
add rsp, 0x6daec564
sub rsp, 0x6daec544
pop rbx
ret
Function at 0x140118c24
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rsi, r9
mov qword [rsp + 0x18], r9
xchg r9, rsi
mov qword [rsp + 0x20], rdi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
xchg rsp, rbp
mov rsp, rbp
xchg rsp, rbp
sub rsp, 0x647d5f8
add rsp, 0x647d578
xor esi, esi
mov r10, r10
mov dword [rbp - 0x50], 0x4bd36257
sub dword [rbp - 0x50], 0x310e596e
add dword [rbp - 0x50], 0x177db9db
add dword [rbp - 0x50], 0x3a264522
sub dword [rbp - 0x50], 0x6c450736
mov dword [rbp - 0x4c], 0x2756943
add dword [rbp - 0x4c], 0x6e23c51b
xor dword [rbp - 0x4c], 0x313935d3
sub dword [rbp - 0x4c], 0xb5e2789
xor dword [rbp - 0x4c], 0x3656f4ac
mov dword [rbp - 0x48], 0x619ec1c9
add dword [rbp - 0x48], 0x1ac13266
sub dword [rbp - 0x48], 0x1f70c854
xor dword [rbp - 0x48], 0x5cc12b7e
mov dword [rbp - 0x44], 0x7e961816
add dword [rbp - 0x44], 0xef5169
sub dword [rbp - 0x44], 0x796ac226
sub dword [rbp - 0x44], 0x2764da2
xor dword [rbp - 0x44], 0x3bc5900
mov qword [rbp + 0x10], rsi
lea ebx, [rsi + 1]
xchg rbx, rbx
xchg r15, rax
mov r15, qword [rbp + 0x10]
xchg r15, rax
xchg rcx, rbx
mov rbx, qword [rbp + 0x10]
xchg rcx, rbx
xchg rbx, rax
mov rbx, qword [rbp + 0x10]
xchg rbx, rax
and cl, 3
mov dword [rsp - 0x20], ecx
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x50]
mov eax, 0x9e7e14f
xor eax, 0x30e08f06
add eax, 0x44a90d98
sub eax, 0x192945c4
xor eax, 0x306040fd
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x1c], esp
xchg r15, rax
mov r15, qword [rbp + 0x10]
xchg r15, rax
xor cx, dx
xchg rbx, rbx
mov word [rbp + rax*2 - 0x20], cx
mov rax, qword [rbp + 0x10]
add rax, rbx
mov dword [rsp - 0x34], ebx
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
cmp rax, 8
jb 0x140118cf6
mov dword [rsp - 0x3c], 0x15884203
lea rax, [rbp - 0x20]
mov word [rbp - 0x10], si
xorps xmm0, xmm0
mov dword [rsp - 0x28], ebx
xchg r9, rax
mov qword [rbp - 0x38], r9
xchg r9, rax
lea r9, [rbp - 0x30]
xchg r15, r15
mov dword [rbp - 0x40], 0x583f3e16
sub dword [rbp - 0x40], 0x25319564
add dword [rbp - 0x40], 0x37971f64
sub dword [rbp - 0x40], 0x93f624e
xor dword [rbp - 0x40], 0x617765d8
lea r8, [rbp - 0x40]
mov dword [rsp - 0x10], 0x32ca062
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
mov dword [rsp - 0x44], ecx
movups xmmword [rbp - 0x30], xmm0
call fcn.1401335d0
xchg rdi, rsp
mov rsp, rax
xchg rsp, rdi
test rax, rax
mov dword [rsp - 0x24], 0x29c140e8
je 0x140118e2a
xchg rcx, r15
mov r15, rax
xchg r15, rcx
call fcn.14010f330
test al, al
mov dword [rsp - 0x20], 0x33f37735
je 0x140118e2a
lea rdx, [rbp - 0x40]
mov rcx, rdi
xchg r8, r8
call fcn.14010e2c4
test al, al
jne 0x140118e2d
mov dword [rsp - 0x38], 0x775b23a0
mov bl, sil
xor eax, eax
lea r11, [rsp + 0x80]
mov r14, r14
mov rsi, qword [r11 + 0x20]
lea rdi, [rbp - 0x20]
lea ecx, [rax + 8]
rep stosb byte [rdi], al
xchg r13, r13
xchg rdx, rdi
mov rdx, qword [r11 + 0x28]
xchg rdx, rdi
mov al, bl
mov dword [rsp - 0x1c], 0x79124ad9
mov rbx, qword [r11 + 0x18]
xchg rsp, r11
mov r11, rsp
xchg rsp, r11
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x14011cf60
Capabilities:
Encode data using xor

Disassembly:
push rbx
add rsp, 0xfffffffffffffdd0
mov dword [rsp - 0x10], ecx
mov rax, qword [0x1401412b0]
lea rdx, [rsp + 0x20]
xchg rsp, rbx
mov rsp, rcx
xchg rbx, rsp
xor r9d, r9d
movabs rcx, 0x8700ef53c514337
sub rcx, 0x2ec5e3aa
add rcx, 0x10f10a86
add rcx, 0x7fffffff
xor rcx, 0x352fb0f7
xor rax, rcx
xchg rdi, rdi
movabs rcx, 0x70ad50bc35518119
xor rcx, 0x585eeddb
xor rcx, 0x2fd61eab
add rcx, 0x739d5db1
ror rax, 0x25
ror rax, 3
ror rax, 0x12
ror rax, 1
xor rax, rcx
lea r8d, [r9 + 8]
movabs rcx, 0x1715ef53623ae823
add rcx, 0x5bfe5b4
sub rcx, 0x43214bc7
xor rcx, 0x6852111b
xor rcx, 0x72b056ae
add rax, rcx
xor ecx, ecx
mov r15, r15
ror rax, 5
ror rax, 8
ror rax, 3
ror rax, 1
ror rax, 1
ror rax, 1
call rax
lea rcx, [rbx + 8]
xorps xmm0, xmm0
mov dword [rsp - 0x3c], 0x22032499
mov qword [rbx], rcx
movups xmmword [rcx], xmm0
xchg rcx, rbx
movups xmmword [rbx + 0x10], xmm0
xchg rcx, rbx
xchg r13, rcx
movups xmmword [r13 + 0x20], xmm0
xchg rcx, r13
test eax, eax
xchg r14, r14
je 0x14011d16c
lea rax, [rsp + 0x20]
nop
movabs rdx, 0xffffffff1d6ae884
xor rdx, 0x32d84a78
sub rdx, 0xa221147
add rdx, 0x5412564d
add rdx, 0x7fffffff
xor rdx, 0x65d17fe
nop dword [rax + rax]
inc rdx
mov dword [rsp - 0x2c], ecx
cmp word [rax + rdx*2], 0
jne 0x14011d098
xchg r11, rbx
mov rcx, r11
xchg rbx, r11
mov qword [rbx + 0x38], rdx
mov dword [rsp - 0x10], esp
call fcn.140017814
xor r8d, r8d
xchg rdx, r12
mov r12, rax
xchg rdx, r12
mov ecx, 0x5621b0cd
xor ecx, 0x29f08fe
xor ecx, 0x5c6ecbcc
add ecx, 0x4c1702e1
cmp qword [rbx + 0x38], r8
jbe 0x14011d179
lea r9, [rsp + 0x20]
xchg r13, r13
mov r10d, 0xd5eb24b
add r10d, 0x7241c73
add r10d, 0x6647f78e
sub r10d, 0x7acac54d
sub r9, rax
nop word [rax + rax]
mov rdi, rdi
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r10w
mov r15, r15
ror ecx, 8
xor ax, word [r9 + rdx - 2]
inc r8
mov word [rdx - 2], ax
xchg rcx, rcx
cmp r8, qword [rbx + 0x38]
jb 0x14011d121
xchg r14, rbx
mov rax, r14
xchg r14, rbx
neg rsp
add rsp, 0xfffffffffffffdd0
neg rsp
nop
mov rbx, qword [rsp]
add rsp, 8
ret
xor r8d, r8d
xchg r8, rsp
mov qword [rbx + 0x38], rsp
xchg r8, rsp
mov rax, rbx
mov dword [rsp - 0x34], 0xaeb2b91
sub rsp, 0xfffffffffffffdd0
pop rbx
ret
Function at 0x14011d190
Capabilities:
Encode data using xor

Disassembly:
push rbx
neg rsp
sub rsp, 0xfffffffffffffdd0
neg rsp
mov rax, qword [0x140141450]
xchg rcx, r15
mov rbx, r15
xchg r15, rcx
rol rax, 0x21
rol rax, 2
rol rax, 1
movabs rcx, 0x21bf936149ad7c4f
sub rcx, 0x1670efdd
sub rcx, 0x2032b932
xor rcx, 0x51cdbeca
add rcx, 0x58a8d2
add rax, rcx
mov edx, 0x6bf1f21e
sub edx, 0x5ea16207
sub edx, 0x9f28d0e
xor edx, 0x35e020d
ror rax, 0xf
ror rax, 1
ror rax, 1
movabs rcx, 0x33a406c71e9a933b
add rcx, 0x2ca04041
xor rcx, 0x2ffa4a24
add rcx, 0x15137451
add rcx, 0x7fffffff
sub rcx, 0x4dcfc15c
xor rax, rcx
xchg rsi, rsi
movabs rcx, 0x49b698dc5a5f54e1
sub rcx, 0x2b983d10
sub rcx, 0x14ad78d5
add rcx, 0x2f682d9b
xor rcx, 0x5f310769
add rax, rcx
movabs rcx, 0x51ede3a6726f4b59
sub rcx, 0xf2bfcda
sub rcx, 0x506f3f65
xor rcx, 0x31554895
add rcx, 0x7fffffff
add rcx, 0x473e1f77
xor rax, rcx
movabs rcx, 0x63dc8f75cea8509
xor rcx, 0x131b0f73
add rcx, 0x9fccb6b
xor rcx, 0x62e3df7f
sub rax, rcx
mov dword [rsp - 0x24], ebx
lea rcx, [rsp + 0x20]
call rax
lea rax, [rbx + 8]
mov dword [rsp - 0x28], 0x18310605
xorps xmm0, xmm0
mov qword [rbx], rax
nop
movabs rdx, 0xffffffff7fb7740a
sub rdx, 0x6c94f32f
add rdx, 0x59582bcd
add rdx, 0x7fffffff
add rdx, 0x13855358
xchg rsp, rax
movups xmmword [rsp], xmm0
xchg rsp, rax
xchg r15, rax
movups xmmword [r15 + 0x10], xmm0
xchg r15, rax
xchg r8, rax
movups xmmword [r8 + 0x20], xmm0
xchg r8, rax
lea rax, [rsp + 0x20]
xchg r11, r11
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
xchg r13, r13
jne 0x14011d31f
mov rcx, rbx
xchg r8, rdx
mov qword [rbx + 0x38], r8
xchg rdx, r8
call fcn.140017814
mov r13, r13
xor r8d, r8d
mov ecx, 0x7726c013
sub ecx, 0x605f5928
xor ecx, 0x7c2822b0
xor ecx, 0x35a38e25
sub ecx, 0xa65539e
cmp qword [rbx + 0x38], r8
mov dword [rsp - 0x14], esi
jbe 0x14011d3cd
lea r9, [rsp + 0x20]
mov r10d, 0x132809a3
add r10d, 0x45cbd2ab
xor r10d, 0x575524c2
xor r10d, 0x477256ad
xor r10d, 0x48d4aede
sub r9, rax
xchg rdx, rdx
movzx edx, cx
lea rax, [rax + 2]
and dx, r10w
ror ecx, 6
ror ecx, 1
ror ecx, 1
xor dx, word [r9 + rax - 2]
inc r8
mov word [rax - 2], dx
mov dword [rsp - 0x28], edi
cmp r8, qword [rbx + 0x38]
jb 0x14011d3a0
xchg rbx, r9
mov rax, r9
xchg r9, rbx
sub rsp, 0x6bab2555
add rsp, 0x6bab2785
nop
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x1401335d0
Capabilities:
Execute syscall

Disassembly:
xchg rcx, r10
mov rcx, r10
xchg rcx, r10
mov eax, dword [0x140142004]
mov r11, r11
cmp qword [0x140142018], 0
jne 0x14008d930
syscall
xchg r11, r11
ret
jmp 0x14008e49a
Function at 0x140135de0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov rcx, rcx
xchg rbp, rdi
mov qword [rsp + 0x18], rbp
xchg rbp, rdi
push rbp
mov dword [rsp - 0x2c], 0x2bbf771d
push r12
nop
sub rsp, 8
mov qword [rsp], r14
mov rbp, rsp
nop
add rsp, 0x41c47df9
sub rsp, 0x41c47e69
mov rdi, r8
xchg rdx, rdi
mov r14, rdi
xchg rdi, rdx
mov rsi, rcx
mov dword [rsp - 0x34], 0x3e826632
movabs r12, 0x14b57aa1463355d9
add r12, 0x17ee9c62
xor r12, 0x4f86b3d1
xor r12, 0x562b5750
cmp r9d, 0x60001
jne 0x140135fe9
mov dword [rbp - 0x40], 0x3da2da2b
add dword [rbp - 0x40], 0xa395517
add dword [rbp - 0x40], 0x24e9ff8e
sub dword [rbp - 0x40], 0x150f552c
sub dword [rbp - 0x40], 0x56f66103
xor edx, edx
mov rbx, rbx
mov dword [rbp - 0x3c], 0x18b7d229
xor dword [rbp - 0x3c], 0x14ec62ad
xor dword [rbp - 0x3c], 0x2d3f042a
add dword [rbp - 0x3c], 0x65e94e53
mov dword [rbp - 0x38], 0x303f89fa
add dword [rbp - 0x38], 0x3796df0d
add dword [rbp - 0x38], 0x11002f1d
sub dword [rbp - 0x38], 0x72e91c58
mov ecx, edx
mov rsi, rsi
mov eax, 0x7d61b4c5
xor eax, 0x2bc10128
sub eax, 0x7325f70
xor eax, 0x56d8169d
rol eax, cl
xor al, byte [rbp + rdx - 0x40]
mov dword [rsp - 0x14], ebp
mov byte [rbp + rdx - 0x34], al
inc rdx
cmp rdx, 0xc
mov rdi, rdi
jb 0x140135ec1
mov r9d, 0x2ee6d3a5
sub r9d, 0x6a29e1e
add r9d, 0x8a865a
xor r9d, 0x28ceb41e
mov qword [rsp + 0x20], 0x5246e521
sub qword [rsp + 0x20], 0x336b24b4
xor qword [rsp + 0x20], 0x65d4ad74
sub qword [rsp + 0x20], 0x7b0f6d0d
lea r8, [rbp - 0x34]
mov dword [rsp - 0x10], esi
xchg rdi, rcx
mov rdx, rcx
xchg rcx, rdi
mov rcx, r14
mov r11, r11
call fcn.140133210
xchg rbx, rsi
mov rsi, rax
xchg rbx, rsi
lea rdi, [rbp - 0x34]
xor eax, eax
lea ecx, [rax + 0xc]
mov rcx, rcx
rep stosb byte [rdi], al
test rbx, rbx
je 0x140136023
mov dword [rsp - 0x38], 0x7180ccfd
lea rdx, [rbp - 0x28]
lea rcx, [rbx + 0xc]
call fcn.14008fd04
test dword [rbp - 7], 0x1000
mov dword [rsp - 0x1c], esi
jne 0x140136023
cmp byte [rbp - 0x1d], 0xe8
jne 0x140136023
mov dword [rsp - 0x1c], ebx
lea rdx, [rbx + 0xc]
xchg r12, r14
mov rcx, r12
xchg r12, r14
call fcn.1400854f0
movzx edx, byte [rbp - 0x28]
mov dword [rsp - 0x2c], 0x4c4f6900
add edx, dword [rbp - 0x13]
add edx, eax
xchg r14, rax
mov r14, qword [rsi + 8]
xchg r14, rax
xor rax, r12
add rdx, rax
mov dword [rsp - 0x24], esi
xor rdx, r12
xchg rdx, rbx
mov qword [rsi + 0x20], rbx
xchg rbx, rdx
cmp qword [rsi + 0x20], r12
setne al
mov dword [rsp - 0x2c], 0x21a5dad1
lea r11, [rsp + 0x70]
xchg r8, rbx
mov r8, qword [r11 + 0x20]
xchg r8, rbx
mov rsi, qword [r11 + 0x28]
mov dword [rsp - 0x10], 0x577506ff
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
mov rbp, rbp
pop r12
pop rbp
ret
xor al, al
mov dword [rsp - 0x14], 0x72e61fe2
jmp 0x140135ff8
Function at 0xe059e5
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xe059f2
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xe05a02
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xe059ea
lea eax, [rcx + 1]
jmp 0xe05a10
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xe05a23
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xe05a09
sub eax, 3
jb 0xe05a43
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xe05a92
sar eax, 1
movsxd rbp, eax
jb 0xe05a79
jmp 0xe05a51
add ebx, ebx
jne 0xe05a4f
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xe05a79
inc ecx
add ebx, ebx
jne 0xe05a5f
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xe05a79
call r11
adc ecx, ecx
add ebx, ebx
jne 0xe05a72
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xe05a61
add ecx, 2
jmp 0xe05a7e
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00e059a7
jmp 0xe059f2
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x413800
mov dl, 0x5a
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xe05ae2
cmp rsi, rcx
jae 0xe05aea
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xe05ac9
cmp al, 0x8f
ja 0xe05ac9
cmp byte [rsi - 2], 0xf
je 0xe05acf
sub al, 0xe8
cmp al, 1
ja 0xe05ab3
cmp rsi, rcx
jae 0xe05aea
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xe05ab9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xe05aea
lodsb al, byte [rsi]
jmp 0xe05ac9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xa02000]
mov eax, dword [rdi]
or eax, eax
je 0xe05b47
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xa05000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xe05af7
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xe05b41
mov qword [rbx], rax
add rbx, 8
jmp 0xe05b17
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.00e05bca], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.00e05bca
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xe05bba
sub rsp, 0xffffffffffffff80
jmp 0x4014e0
Function at 0x11000
Capabilities:
Complete processing asynchronous io request

Disassembly:
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
push rbx
sub rsp, 0x20
mov rcx, qword [0x000620f0]
mov rbx, rdx
call fcn.0001398c
and dword [rbx + 0x30], 0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x11008
Capabilities:
Complete processing asynchronous io request

Disassembly:
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
push rbx
sub rsp, 0x20
mov rcx, qword [0x000620f0]
mov rbx, rdx
call fcn.0001398c
and dword [rbx + 0x30], 0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1189c
Capabilities:
Check os version

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x0004b108]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor eax, eax
xor ebx, ebx
lea r8, [r11 - 0x28]
mov byte [rsp + 0x58], bl
mov qword [r11 - 0x1f], rax
lea rdx, [r11 - 0x30]
lea rcx, [r11 - 0x2c]
xor r9d, r9d
mov dword [rsp + 0x61], eax
mov word [rsp + 0x65], ax
mov byte [rsp + 0x67], al
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
cmp dword [rsp + 0x4c], 5
jne 0x118fa
cmp dword [rsp + 0x48], ebx
jne 0x118fa
lea eax, [rbx + 1]
jmp 0x119de
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov r9d, 0x1f03ff
xor r8d, r8d
mov r11, rax
lea rax, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x30], rax
mov rax, qword [0x00042018]
mov byte [rsp + 0x28], bl
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov rcx, r11
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
cmp eax, ebx
jge 0x1193f
xor eax, eax
jmp 0x119de
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
cmp rax, rbx
jne 0x11961
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x11938
lea rax, [rsp + 0x54]
mov r9d, 0x1000
mov r8, rdi
mov edx, 0x1b
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov rcx, qword [rsp + 0x40]
cmp eax, ebx
jge 0x11990
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x119d1
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rdx, [rsp + 0x58]
mov r8d, 0x10
mov rcx, rdi
call fcn.0001e0b0
cmp eax, ebx
je 0x119d1
lea rdx, [0x00061e90]
lea rcx, [rsp + 0x58]
mov r8d, 0x10
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
mov ecx, 1
cmp rax, 0x10
cmove ebx, ecx
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.00040240
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x12aec
Capabilities:
Delete file
Set file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 8], rcx
push rsi
push rdi
push r12
sub rsp, 0xa0
mov rbp, qword [0x00062100]
mov esi, dword [0x000620ec]
xor r12d, r12d
xor eax, eax
mov dword [r11 - 0x40], r12d
mov dword [r11 - 0x48], r12d
mov dword [rsp + 0x7c], eax
mov rdi, r9
mov qword [r11 + 8], r12
mov dword [rsp + 0x74], eax
mov qword [r11 - 0x38], rax
cmp rbp, r12
je 0x12c9f
cmp r9, r12
je 0x12c9f
cmp esi, r12d
je 0x12c9f
mov rax, qword [0x0006a6a8]
mov dword [rsp + 0x68], 0x100
mov qword [r11 - 0x58], r12
mov dword [r11 - 0x60], r12d
mov dword [r11 - 0x68], r12d
mov qword [r11 - 0x70], r12
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0x80
lea r9, [r11 - 0x40]
mov r8, rdi
mov qword [rsp + 0x20], r12
mov edx, 0x40000000
lea rcx, [r11 + 8]
cmp rax, r12
je 0x12bab
call rax
jmp 0x12bb1
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
cmp eax, r12d
mov ebx, eax
jl 0x12c75
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
mov dword [rsp + 0x30], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.00015a50
cmp eax, r12d
mov ebx, eax
jl 0x12c34
mov rax, qword [0x0006a6d0]
mov rcx, qword [rsp + 0xc0]
mov dword [rsp + 0x20], 4
mov r9d, 0x28
lea r8, [0x00062108]
lea rdx, [rsp + 0x78]
cmp rax, r12
je 0x12c2c
call rax
jmp 0x12c32
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov ebx, eax
mov rax, qword [0x00062988]
cmp rax, r12
je 0x12c52
mov rcx, qword [rsp + 0xc0]
lea rdx, [rsp + 0x88]
call rax
mov rax, qword [0x0006a6e0]
mov rcx, qword [rsp + 0xc0]
cmp rax, r12
je 0x12c6a
call rax
jmp 0x12c70
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp ebx, r12d
je 0x12c9b
cmp ebx, 0xc0000043
jne 0x12c82
mov ebx, r12d
jmp 0x12c9b
mov rax, qword [0x0006a6d8]
mov rcx, rdi
cmp rax, r12
je 0x12c95
call rax
jmp 0x12c9b
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov eax, ebx
jmp 0x12ca4
mov eax, 0xc000000d
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x15964
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x90
xor edi, edi
mov rbx, rcx
lea r8, [rax - 0x40]
lea rcx, [rax - 0x48]
lea r9d, [rdi + 1]
mov edx, 0x1f0003
mov dword [rax - 0x40], 0x30
mov qword [rax - 0x38], rdi
mov dword [rax - 0x28], edi
mov qword [rax - 0x30], rdi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x18], rdi
mov byte [rax - 0x78], dil
call qword [sym.imp.ntoskrnl.exe_ZwCreateEvent]
cmp eax, edi
jl 0x15a39
mov rax, qword [rsp + 0xd8]
mov r10, qword [0x0006a6b8]
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xc8]
xor r9d, r9d
xor r8d, r8d
cmp r10, rdi
mov rdi, qword [rsp + 0xc0]
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov qword [rsp + 0x20], rdi
je 0x15a0b
call r10
jmp 0x15a11
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
cmp eax, 0x103
jne 0x15a2c
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
mov ebx, dword [rdi]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret

Function at 0x15a50
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x90
xor edi, edi
mov rbx, rcx
lea r8, [rax - 0x40]
lea rcx, [rax - 0x48]
lea r9d, [rdi + 1]
mov edx, 0x1f0003
mov dword [rax - 0x40], 0x30
mov qword [rax - 0x38], rdi
mov dword [rax - 0x28], edi
mov qword [rax - 0x30], rdi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x18], rdi
mov byte [rax - 0x78], dil
call qword [sym.imp.ntoskrnl.exe_ZwCreateEvent]
cmp eax, edi
jl 0x15b25
mov rax, qword [rsp + 0xd8]
mov r10, qword [0x0006a6c0]
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xc8]
xor r9d, r9d
xor r8d, r8d
cmp r10, rdi
mov rdi, qword [rsp + 0xc0]
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov qword [rsp + 0x20], rdi
je 0x15af7
call r10
jmp 0x15afd
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov ebx, eax
cmp eax, 0x103
jne 0x15b18
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
mov ebx, dword [rdi]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x16170
Capabilities:
Delete file

Disassembly:
mov r11, rsp
sub rsp, 0xc8
and dword [rsp + 0x70], 0
xor eax, eax
and qword [r11 + 8], rax
mov dword [rsp + 0x74], eax
mov qword [r11 - 0x50], rax
test rcx, rcx
jne 0x1619c
mov eax, 0xc000000d
jmp 0x1626f
mov rdx, rcx
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x98], 0
and qword [rsp + 0xb0], 0
and qword [rsp + 0xb8], 0
mov dword [rsp + 0x68], 0x100
and qword [rsp + 0x60], 0
and dword [rsp + 0x58], 0
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], 5
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x90]
lea rcx, [rsp + 0xd0]
mov edx, 0x10000000
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rsp + 0x90], 0x30
mov dword [rsp + 0xa8], 0x240
mov qword [rsp + 0xa0], rax
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
test eax, eax
js 0x1626f
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
add rsp, 0xc8
ret