joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400789e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push r15
sub rsp, 0x38
mov rax, qword gs:[0x30]
mov qword [rsp + 0x28], r13
mov r13, rdx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
cmp dword [0x140155b08], 0x3e
jb 0x140078aae
nop dword [rax + rax]
test r13, r13
je 0x140078aae
mov rax, qword [r13]
xor ebx, ebx
mov r8d, ebx
test rax, rax
je 0x140078a74
mov r9, qword [r13 + 8]
shr rax, 1
lea r10, [r9 + rax*2]
cmp r9, r10
je 0x140078a74
nop word [rax + rax]
movzx edx, word [r9]
lea eax, [rdx - 0x61]
cmp ax, 0x19
lea ecx, [rdx - 0x20]
cmova ecx, edx
imul r8d, r8d, 0x1003f
add r9, 2
add r8d, ecx
cmp r9, r10
jne 0x140078a50
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
add rax, 0x10
mov r15, qword [rax]
cmp r15, rax
je 0x140078aa6
cmp dword [r15 + 0x108], r8d
je 0x140078bc4
mov r15, qword [r15]
cmp r15, rax
jne 0x140078a91
mov r15, rbx
jmp 0x140078bc4
mov rax, qword gs:[0x30]
xor ebx, ebx
mov qword [rsp + 0x30], r12
mov r15d, ebx
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
add rax, 0x10
mov qword [rsp + 0x50], rax
mov r12, qword [rax]
cmp r12, rax
je 0x140078bbf
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x20], r14
movzx eax, word ds:[r12 + 0x58]
mov rbx, qword [r12 + 0x60]
test r13, r13
je 0x140078ba6
mov rsi, qword [r13]
cmp rax, rsi
jb 0x140078c09
mov r14, qword [r13 + 8]
mov rcx, rsi
shr rcx, 4
test rcx, rcx
je 0x140078b5a
nop word [rax + rax]
movdqu xmm1, xmmword [r14]
movdqu xmm0, xmmword [rbx]
pcmpeqd xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x140078bf7
add rbx, 0x10
add r14, 0x10
sub rcx, 1
jne 0x140078b30
shr rsi, 1
and esi, 7
test rsi, rsi
je 0x140078ba6
sub r14, rbx
nop dword [rax + rax]
movzx ecx, word [rbx]
movzx ebp, word [r14 + rbx]
cmp cx, bp
je 0x140078b97
nop dword [rax]
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
movzx ecx, bp
movzx edi, ax
call qword [sym.imp.ntdll.dll_RtlUpcaseUnicodeChar]
cmp di, ax
jne 0x140078c09
add rbx, 2
sub rsi, 1
jne 0x140078b70
mov r15, r12
mov rbp, qword [rsp + 0x58]
xor ebx, ebx
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x30]
mov r13, qword [rsp + 0x28]
test r15, r15
je 0x140078bd2
mov rbx, qword [r15 + 0x30]
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x110]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov rax, rbx
add rsp, 0x38
pop r15
pop rbx
ret
and esi, 0xf
shl rcx, 4
add rsi, rcx
shr rsi, 1
jmp 0x140078b60
mov r12, qword [r12]
cmp r12, qword [rsp + 0x50]
jne 0x140078af2
jmp 0x140078ba9
Function at 0x140078c20
Capabilities:
Parse pe header

Disassembly:
push rbx
push rdi
sub rsp, 0xa8
mov rax, qword [0x140155040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov eax, 0x5a4d
movzx r10d, r8w
mov r9, rdx
mov rdi, rcx
cmp word [rcx], ax
jne 0x140078f12
mov ecx, dword ds:[rcx + 0x3c]
lea eax, [rcx - 1]
cmp eax, 0x7ffffffd
ja 0x140078f12
cmp dword [rdi + rcx], 0x4550
lea rbx, [rdi + rcx]
jne 0x140078f12
lea rdx, [rbx + 0x88]
mov eax, dword [rdx]
test eax, eax
je 0x140078f12
cmp dword [rdx + 4], 0
je 0x140078f12
lea r8, [rdi + rax]
mov qword [rsp + 0xd8], rsi
mov rcx, rdi
mov word [rsp + 0x20], r10w
call fcn.140078f40
cmp dword [0x140155b08], 0x64
mov rsi, rax
jb 0x140078f05
call fcn.140077c40
test rax, rax
je 0x140078f05
call fcn.140077c40
call qword [case.0x140071b98.0]
nop
test al, al
je 0x140078f05
mov eax, dword [rbx + 0xd8]
test eax, eax
je 0x140078f05
cmp dword ds:[rbx + 0xdc], 0
je 0x140078f05
mov ecx, dword ds:[rdi + rax]
lea rdx, [rdi + rax]
add rcx, rdx
lea rax, [rdx + 0x94]
cmp rax, rcx
ja 0x140078f05
mov eax, dword [rdx + 0x90]
shr eax, 0xe
test al, 1
je 0x140078f05
xor edi, edi
mov qword [rsp + 0xa0], r14
cmp byte [0x140159412], dil
jne 0x140078e03
mov rdx, qword [0x140159170]
mov ecx, 0x48
mov byte [0x140159412], 1
call fcn.1400601a0
mov rcx, qword [0x140159238]
mov r14, rax
mov edx, 4
mov r8d, 0x40
mov dword [rax], 0x10
lea rax, [0x1400580c0]
mov qword [r14 + 8], rax
lea rax, [0x1400580d0]
mov qword [r14 + 0x10], rax
mov dword [r14 + 0x18], 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword ds:[r14 + 0x18]
mov edx, 0xff
shl r8, 2
mov rcx, rax
mov qword [r14 + 0x20], rax
call fcn.1400e6910
mov r8d, dword ds:[r14 + 0x18]
mov edx, 4
mov rcx, qword [0x140159238]
mov dword [r14 + 0x28], r8d
shl r8, 5
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [r14 + 0x30], rax
mov dword [r14 + 0x38], edi
mov dword [r14 + 0x3c], 0xffffffff
mov dword [r14 + 0x40], edi
mov qword [0x140159a50], r14
jmp 0x140078e0a
mov r14, qword [0x140159a50]
test r14, r14
mov r14, qword [rsp + 0xa0]
je 0x140078f05
lfence
mov rcx, qword [0x140159a50]
mov rdx, rsi
call fcn.140062de0
test rax, rax
jne 0x140078f05
mov dword [rsp + 0x30], edi
call fcn.140077ac0
nop
test rax, rax
je 0x140078f05
xorps xmm0, xmm0
mov qword [rsp + 0x40], 0x1000
mov rax, rsi
mov qword [rsp + 0x88], 1
and rax, 0xfffffffffffff000
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x38], rax
mov rax, rsi
and eax, 0xfff
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x68], rax
movdqu xmmword [rsp + 0x70], xmm0
call fcn.140077ac0
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x28], 0x28
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
mov edx, 2
mov r8d, 1
call rax
cmp eax, 0xc0000045
cmovne edi, eax
test edi, edi
js 0x140078f05
mov rcx, qword [0x140159a50]
lea rdx, ds:[rsp + 0x48]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 1
call fcn.140062ae0
mov rax, rsi
mov rsi, qword [rsp + 0xd8]
jmp 0x140078f14
xor eax, eax
mov rcx, qword ds:[rsp + 0x90]
xor rcx, rsp
call fcn.1400c6a20
add rsp, 0xa8
pop rdi
pop rbx
ret
Function at 0x140079320
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rdx
mov qword [rsp + 0x28], 0
mov rdx, rcx
mov qword [rsp + 0x20], 0x30
mov rcx, 0xffffffffffffffff
lea r9, [rsp + 0x30]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
test eax, eax
js 0x1400793ad
mov rdx, qword [rsp + 0x38]
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1400793ad
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x1400793ad
mov r8, qword [rax + rdx + 0xe8]
mov rcx, r8
shr rcx, 0x20
test r8d, r8d
je 0x1400793ad
test ecx, ecx
je 0x1400793ad
mov eax, r8d
add rax, rdx
cmp rbx, rax
jb 0x1400793ad
add ecx, r8d
add rcx, rdx
cmp rbx, rcx
jae 0x1400793ad
mov al, 1
add rsp, 0x60
pop rbx
ret
xor al, al
add rsp, 0x60
pop rbx
ret

Function at 0x140079620
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [0x140159a68]
test rbx, rbx
je 0x14007969d
mov qword [rsp + 0x58], rdi
xor edi, edi
nop dword [rax]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], edi
mov r9d, 0x20
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x48]
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x48], 0x10000
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov r8d, 0x10000
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtFlushInstructionCache]
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x140079640
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbx
ret

Function at 0x1400796c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x60
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x1400796e2
sub rbx, rax
add rbx, 0x10000
mov qword [rsp + 0x80], rsi
cmp rbx, rdi
jae 0x1400797e9
xor esi, esi
nop word [rax + rax]
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x14007971b
add rbx, 0x8000000
jmp 0x1400797da
xorps xmm0, xmm0
mov qword [rsp + 0x28], rsi
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0x30
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffffffffffff
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
test eax, eax
js 0x1400797e9
cmp dword [rsp + 0x50], 0x10000
mov rcx, qword [rsp + 0x48]
jne 0x1400797bf
cmp rcx, 0x10000
jb 0x1400797bf
mov dword [rsp + 0x28], 0x40
lea r9, [rsp + 0x78]
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], 0x10000
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x70], rbx
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jns 0x140079801
cmp eax, 0xc0000604
je 0x1400797e9
add rbx, 0x10000
jmp 0x1400797da
mov rbx, qword [rsp + 0x30]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x1400797da
mov eax, 0x10000
sub rax, rcx
add rbx, rax
nop word [rax + rax]
cmp rbx, rdi
jb 0x140079700
xor eax, eax
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
mov rax, qword [rsp + 0x70]
jmp 0x1400797eb
Function at 0x140079820
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x140079949
xor esi, esi
nop dword [rax]
nop dword [rax + rax]
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x14007987b
sub rbx, 0x8000000
jmp 0x140079938
xorps xmm0, xmm0
mov qword [rsp + 0x28], rsi
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0x30
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffffffffffff
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
test eax, eax
js 0x140079949
cmp dword [rsp + 0x50], 0x10000
jne 0x14007991c
cmp qword [rsp + 0x48], 0x10000
jb 0x14007991c
mov dword [rsp + 0x28], 0x40
lea r9, [rsp + 0x78]
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], 0x10000
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x70], rbx
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jns 0x14007995d
cmp eax, 0xc0000604
je 0x140079949
sub rbx, 0x10000
jmp 0x140079938
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
nop dword [rax + rax]
cmp rbx, rdi
ja 0x140079860
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rax, qword [rsp + 0x70]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140083080
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r12
push r14
push r15
mov eax, 0x1080
call fcn.1400e64d0
sub rsp, rax
mov rax, qword [0x140155040]
xor rax, rsp
mov qword [rsp + 0x1060], rax
mov rbp, qword [r8]
xor r14d, r14d
mov r12, rdx
mov rsi, rcx
mov r15d, 0xc0000001
test rbp, rbp
je 0x1400831a1
mov qword [rsp + 0x10c0], rbx
mov qword [rsp + 0x1078], rdi
mov qword [rsp + 0x1070], r13
movabs r13, 0x3000000000
nop dword [rax + rax]
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov dword [rsp + 0x30], 0x1000
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rsp + 0x50]
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
mov r15d, eax
test eax, eax
js 0x140083189
mov rbx, qword [rsp + 0x58]
lea rdi, [rsp + 0x60]
cmp rbx, r13
ja 0x14008314f
mov rdx, qword [rsi]
mov rcx, r13
sub rcx, rbx
lea rax, [rdx + rbx]
cmp rcx, rdx
jae 0x140083159
movabs rax, 0x3000000001
mov rcx, rsi
mov qword [rcx], rax
test rbx, rbx
je 0x14008317f
movzx edx, byte [rdi]
mov rcx, rsi
call fcn.1400826a0
lea rdi, [rdi + 1]
sub rbx, 1
jne 0x140083165
mov rbx, qword [rsp + 0x58]
nop
sub rbp, rbx
jne 0x1400830f0
mov rdi, qword [rsp + 0x1078]
mov rbx, qword [rsp + 0x10c0]
mov r13, qword [rsp + 0x1070]
cmp r15d, 0xc0000011
cmovne r14d, r15d
mov eax, r14d
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.1400c6a20
add rsp, 0x1080
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
Function at 0x1400831e0
Capabilities:
Get file attributes

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x110
mov rax, qword [0x140155040]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r14, rdx
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x30]
mov r9d, 0x18
lea r8, [rsp + 0x48]
mov rdi, rcx
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov esi, eax
test eax, eax
js 0x1400833d8
movups xmm0, xmmword ds:[rsp + 0x48]
mov qword [rsp + 0x140], rbx
movsd xmm1, qword [rsp + 0x58]
movups xmmword [rsp + 0x30], xmm0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
movsd qword [rsp + 0x40], xmm1
lfence
call fcn.140082590
mov rbx, rax
test rax, rax
jne 0x140083295
mov rcx, qword [0x140159238]
mov r8, rbx
xor edx, edx
mov esi, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x140]
mov eax, esi
jmp 0x1400833db
mov rdx, qword ds:[rsp + 0x30]
mov rcx, rbx
call fcn.140082600
test eax, eax
js 0x14008326d
lfence
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rbx
call fcn.140083080
nop dword [rax]
test eax, eax
js 0x14008326d
lfence
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140082ca0
mov rcx, qword [0x140159238]
xor edx, edx
mov r8, rbx
test eax, eax
jns 0x1400832fe
mov esi, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x140]
mov eax, esi
jmp 0x1400833db
nop
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea rax, [rsp + 0x60]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x140083312
mov rdx, qword [0x140159180]
lea rbx, [rdi + rdi]
lea rcx, [rbx + 0x12]
call fcn.1400601a0
mov r9, rax
lea r8, [rsp + 0x60]
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rbx], ax
mov rcx, rdi
mov rdx, qword [r9 + 8]
and rcx, 0xfffffffffffffffc
je 0x140083390
nop word [rax + rax]
movzx eax, byte [r8]
mov word [rdx], ax
movzx eax, byte [r8 + 1]
mov word [rdx + 2], ax
movzx eax, byte [r8 + 2]
mov word [rdx + 4], ax
movzx eax, byte [r8 + 3]
add r8, 4
mov word [rdx + 6], ax
add rdx, 8
sub rcx, 4
jne 0x140083360
and edi, 3
sub rdi, 1
je 0x1400833c2
sub rdi, 1
je 0x1400833b4
nop
cmp rdi, 1
jne 0x1400833c9
movzx eax, byte [r8]
mov word [rdx], ax
add rdx, 2
inc r8
movzx ecx, byte [r8]
mov word [rdx], cx
add rdx, 2
inc r8
movzx ecx, byte [r8]
mov word [rdx], cx
mov rbx, qword [rsp + 0x140]
mov eax, esi
mov qword [r14], r9
jmp 0x1400833db
lfence
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400c6a20
add rsp, 0x110
pop r14
pop rdi
pop rsi
ret
Function at 0x14008ab40
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x140155040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rdx
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetUpdateRect]
test eax, eax
je 0x14008ad7b
mov eax, dword [rsp + 0x5c]
or eax, dword [rsp + 0x54]
or eax, dword [rsp + 0x58]
or eax, dword [rsp + 0x50]
je 0x14008ad7b
cmp dword [rbx + 0x24c], 0
mov qword [rsp + 0xe0], rsi
jg 0x14008ac14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgn]
xor r8d, r8d
mov rcx, rdi
mov rdx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetUpdateRgn]
mov rcx, qword [rbx + 0x250]
test rcx, rcx
jne 0x14008abdb
mov qword [rbx + 0x250], rsi
jmp 0x14008abf6
mov r9d, 2
mov r8, rsi
mov rdx, rcx
call qword [sym.imp.GDI32.dll_CombineRgn]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
lea rdx, ds:[rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_BeginPaint]
test rax, rax
je 0x14008ad73
jmp 0x14008ad65
test dword ds:[rbx + 0x40], 0x200000
je 0x14008acd3
cmp qword [rbx + 0x200], 0
jne 0x14008acd3
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetDC]
mov rsi, rax
test rax, rax
je 0x14008acd3
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov qword [rbx + 0x200], rax
test rax, rax
je 0x14008acd3
movups xmm0, xmmword ds:[rbx + 0x60]
mov rcx, rsi
movups xmmword [rbx + 0x218], xmm0
mov edx, dword [rbx + 0x220]
mov r8d, dword [rbx + 0x224]
inc edx
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rbx + 0x210], rax
test rax, rax
jne 0x14008acac
mov rcx, qword [rbx + 0x200]
call qword [sym.imp.GDI32.dll_DeleteDC]
mov qword [rbx + 0x200], 0
jmp 0x14008acd3
mov rcx, qword [rbx]
mov rdx, rsi
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rdx, qword [rbx + 0x210]
mov rcx, qword [rbx + 0x200]
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rbx + 0x208], rax
lea rdx, ds:[rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_BeginPaint]
mov rsi, rax
test rax, rax
je 0x14008ad73
movups xmm0, xmmword [rsp + 0x6c]
mov r8, qword [rbx + 0x200]
lea r9, [rsp + 0x50]
mov rdx, rbx
mov rcx, rdi
movups xmmword [rsp + 0x50], xmm0
test r8, r8
je 0x14008ad5c
call fcn.140090fc0
mov ecx, dword [rsp + 0x5c]
mov r8d, dword [rsp + 0x54]
sub ecx, r8d
mov edx, dword [rsp + 0x50]
mov rax, qword [rbx + 0x200]
mov r9d, dword [rsp + 0x58]
mov dword [rsp + 0x40], 0xcc0020
sub r9d, edx
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call qword [sym.imp.GDI32.dll_BitBlt]
jmp 0x14008ad65
mov r8, rsi
call fcn.140090fc0
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_EndPaint]
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400c6a20
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret
Function at 0x140096780
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov r11, rsp
sub rsp, 0x178
mov rax, qword [0x140155040]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp dword [0x140155b08], 0x64
jb 0x140096847
mov qword [r11 + 8], rbx
mov qword [r11 - 8], rdi
mov rdi, qword [0x1401570b8]
test rdi, rdi
jne 0x1400967ca
nop dword [rax]
call fcn.140061980
mov rbx, rax
jmp 0x14009681c
mov rdx, qword [0x140159180]
lea rcx, [rdi + 0x12]
mov qword [rsp + 0x188], rsi
mov rsi, qword [str.SystemRootSystem32_ntoskrnl.exe]
call fcn.1400601a0
mov rbx, rax
xor ecx, ecx
mov qword [rax], rdi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rdi], cx
test rsi, rsi
je 0x140096814
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.1400e6ce0
mov rsi, qword [rsp + 0x188]
mov rdi, qword [rsp + 0x170]
mov rax, rbx
mov rbx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400c6a20
add rsp, 0x178
ret
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x130
call fcn.1400e6910
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov r8d, 0x130
lea rdx, [rsp + 0x30]
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax]
test eax, eax
je 0x1400968b8
cmp eax, 0xc0000004
jne 0x1400968b8
cmp dword [rsp + 0x30], 1
jb 0x1400968b8
lea rax, [rsp + 0x60]
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400968a0
lea rcx, [rsp + 0x60]
call fcn.1400622e0
mov rcx, rax
jmp 0x1400968ba
xor ecx, ecx
mov rax, rcx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400c6a20
add rsp, 0x178
ret
Function at 0x1400b24e0
Capabilities:
Get file attributes

Disassembly:
push rsi
sub rsp, 0x80
mov rax, qword [0x140155040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rdx
mov dword [rsp + 0x30], 0x60
mov rdx, rcx
mov dword [rsp + 0x28], 1
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x20], 5
mov r8d, 0x120089
call fcn.140076fe0
test eax, eax
jns 0x1400b2532
lfence
jmp 0x1400b25dc
mov qword ss:[rsp + 0xa8], rdi
lea r8, [rsp + 0x60]
mov rdi, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov rcx, rdi
mov dword [rsp + 0x20], 5
mov r9d, 0x18
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x1400b258d
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsp + 0x48], xmm0
cmp qword [rsp + 0x50], 0
jne 0x1400b258d
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, 0xc0000011
jmp 0x1400b25d4
mov rdx, rdi
mov qword [rsp + 0xa0], rbx
call fcn.1400c0de0
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtClose]
test rbx, rbx
je 0x1400b25c7
cmp dword [rbx], 0
jne 0x1400b25bf
test rsi, rsi
je 0x1400b25bb
mov qword [rsi], rbx
xor eax, eax
jmp 0x1400b25cc
mov rcx, rbx
call fcn.1400c3880
mov eax, 0xc0000102
mov rbx, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400c6a20
add rsp, 0x80
pop rsi
ret
Function at 0x1400b2600
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov r12, rdx
lea rax, [0x1401577f0]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x59]
lea rax, [fcn.1400c2da0]
mov r13, rcx
xorps xmm0, xmm0
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rcx, r12
mov r14, r8
xor edi, edi
movdqu xmmword [rbp - 0x59], xmm0
call fcn.1400c2f40
mov esi, 0xffffffff
test eax, eax
jns 0x1400b266b
mov ebx, esi
jmp 0x1400b269a
mov rbx, qword [rbp - 0x59]
jle 0x1400b2685
cmp rbx, qword [rbp - 0x51]
jae 0x1400b267e
mov byte [rbx], 0xa
mov rbx, qword [rbp - 0x59]
inc rbx
mov qword [rbp - 0x59], rbx
cmp rbx, qword [rbp - 0x51]
jae 0x1400b2692
mov byte [rbx], dil
mov rbx, qword [rbp - 0x59]
test ebx, ebx
je 0x1400b282d
mov rcx, qword [0x140159238]
xor edx, edx
movsxd r8, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r15, rax
test rax, rax
je 0x1400b282d
mov r9, r14
mov r8d, ebx
mov rdx, rax
mov rcx, r12
call fcn.1400c0e60
movsxd r12, eax
test eax, eax
jne 0x1400b26da
mov ebx, 0xc0000001
jmp 0x1400b2817
mov rcx, r13
mov qword [rbp - 0x49], r12
call fcn.140077920
mov ebx, eax
test eax, eax
js 0x1400b2817
lfence
mov rcx, r13
call fcn.140070780
mov r14, rax
movzx ecx, word [rax]
mov word [rbp - 0x41], cx
add cx, 2
cmp qword [rax], 0xfffe
mov word [rbp - 0x3f], cx
mov rcx, qword [rax + 8]
mov qword [rbp - 0x39], rcx
jbe 0x1400b2725
mov ebx, 0xc0000106
jmp 0x1400b2797
xor ecx, ecx
mov dword [rbp - 0x31], 0x30
mov dword [rsp + 0x50], ecx
lea rax, [rbp - 0x41]
mov qword [rsp + 0x48], rcx
lea r9, [rbp - 1]
mov dword [rsp + 0x40], 0x60
lea r8, [rbp - 0x31]
mov dword [rsp + 0x38], 5
xorps xmm0, xmm0
mov dword [rsp + 0x30], ecx
mov edx, 0x130116
mov qword [rbp - 0x21], rax
lea rax, [rbp - 0x49]
mov qword [rbp - 0x29], rcx
lea rcx, [rbp - 0x59]
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x19], 0x40
movdqu xmmword [rbp - 0x11], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
mov ebx, eax
cmovns rdi, qword [rbp - 0x59]
lea rcx, [r14 - 0x10]
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x1400b27ad
lfence
call fcn.1400602c0
test ebx, ebx
js 0x1400b2809
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor edx, edx
mov dword [rsp + 0x30], r12d
lea rax, [rbp + 0xf]
mov qword [rsp + 0x28], r15
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov ebx, eax
test eax, eax
js 0x1400b2809
lfence
lea rdx, [rbp + 0x1f]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtFlushBuffersFile]
mov r9, r13
mov rcx, rdi
call fcn.140074600
mov ebx, eax
test rdi, rdi
je 0x1400b2817
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [0x140159238]
mov r8, r15
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
jmp 0x1400b2832
mov eax, 0xc0000001
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret