joyce8/EMBER2024-capa huggingface dataset:
Function at 0x15f98
Capabilities:
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x50
and dword [rax + 0x18], 0
mov r13, rdx
mov rdi, rcx
lea r8, [rax + 0x18]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov r9d, dword [rsp + 0x80]
lea r8d, [r9 - 0xa28]
mov r11b, al
cmp r8d, 0x112f
ja 0x15fed
mov ebx, 0x78
jmp 0x16037
lea eax, [r9 - 0x1db0]
cmp eax, 0x18f
ja 0x1600b
neg r11b
sbb ebx, ebx
and ebx, 0x10
add ebx, 0x168
jmp 0x16037
lea eax, [r9 - 0x2328]
cmp eax, 0x258
ja 0x16020
mov ebx, 0x180
jmp 0x16037
lea eax, [r9 - 0x2800]
cmp eax, 0xfb1
ja 0x1614e
mov ebx, 0x188
mov rcx, rdi
call fcn.00015f38
mov rdi, rax
test rax, rax
jne 0x1607b
mov rcx, qword gs:[0x188]
call fcn.00015f38
mov rdi, rax
test rax, rax
jne 0x1607b
lea r9, [0x0001e140]
lea ecx, [rax + 0x10]
xor r8d, r8d
xor edx, edx
call fcn.0001b50c
mov eax, 0xc0000001
jmp 0x16169
cmp byte [0x00046a23], 0
jne 0x16111
call fcn.00019f70
mov rsi, rax
test rax, rax
jne 0x1609d
lea ecx, [rax + 3]
jmp 0x16153
xor ebp, ebp
lea r12d, [rbp + 0x14]
mov ecx, ebp
lea rdx, [rsp + 0x20]
dec r12d
add rcx, rsi
call fcn.0001cc88
mov ecx, dword [rsp + 0x45]
bt ecx, 0xc
jb 0x16103
test eax, eax
je 0x16103
add ebp, eax
test cl, 1
je 0x160fe
test cl, 2
jne 0x160fe
mov al, byte [rsp + 0x2d]
and al, 7
cmp al, 5
je 0x160fe
bt ecx, 8
jae 0x160e5
mov eax, dword [rsp + 0x3d]
jmp 0x160fa
test cl, cl
jns 0x160f0
movzx eax, word [rsp + 0x3d]
jmp 0x160fa
test cl, 0x40
je 0x160fe
movzx eax, byte [rsp + 0x3d]
cmp eax, ebx
je 0x1610a
test r12d, r12d
jg 0x160a3
mov ecx, 4
jmp 0x16153
mov byte [0x00046a23], 1
mov rax, qword [rbx + rdi]
test rax, rax
jne 0x1613e
mov rcx, qword gs:[0x188]
call fcn.00015f38
test rax, rax
je 0x16071
mov rax, qword [rbx + rax]
test rax, rax
je 0x16071
mov rax, qword [rax + 0x30]
mov rcx, qword [rax + 0x20]
xor eax, eax
mov qword [r13], rcx
jmp 0x16169
mov ecx, 2
lea r9, [0x0001e140]
xor r8d, r8d
xor edx, edx
call fcn.0001b50c
mov eax, 0xc00000bb
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x16390
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x1e0
mov rax, qword [0x00020100]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
and dword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
mov eax, 0x80
mov word [rsp + 0x50], ax
mov eax, 0x82
mov rdi, rdx
mov word [rsp + 0x52], ax
lea rax, [0x0001e5f0]
mov rdx, rcx
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x58], rax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and qword [rsp + 0x68], 0
and qword [rsp + 0x80], 0
and qword [rsp + 0x88], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x48]
lea edx, [r9 + 1]
mov dword [rsp + 0x60], 0x30
mov dword [rsp + 0x78], 0x240
mov qword [rsp + 0x70], rax
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
js 0x164b6
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x90]
mov r8d, 2
mov dword [rsp + 0x20], 0x12c
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
test eax, eax
js 0x164a9
cmp dword [rsp + 0xa4], 4
jne 0x164a4
cmp dword [rsp + 0xa8], 4
jne 0x164a4
mov ecx, dword [rsp + 0xac]
mov dword [rdi], ecx
jmp 0x164a9
mov ebx, 0xc000000d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.0001d8f0
mov rbx, qword [rsp + 0x200]
add rsp, 0x1e0
pop rdi
ret

Function at 0x164e0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xb0
mov rax, qword [0x00020100]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov eax, 0x80
mov dword [rsp + 0x40], edx
mov rdx, rcx
mov word [rsp + 0x50], ax
mov eax, 0x82
lea rcx, [r11 - 0x28]
mov word [rsp + 0x52], ax
lea rax, [0x0001e5f0]
xor ebx, ebx
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x70], rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x60]
lea edx, [rbx + 2]
lea rcx, [rsp + 0x48]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x78], 0x240
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, ebx
jl 0x165c2
mov rcx, qword [rsp + 0x48]
lea r9d, [rbx + 4]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], r9d
lea rdx, [rsp + 0x90]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.0001d8f0
add rsp, 0xb0
pop rbx
ret
Function at 0x165e4
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [0x00046a48]
xor r9d, r9d
mov rdi, r8
mov rbx, rdx
mov r10, rcx
test eax, eax
jle 0x16622
lea rdx, [0x00052e40]
cmp rcx, qword [rdx]
je 0x16650
mov eax, dword [0x00046a48]
inc r9d
add rdx, 8
cmp r9d, eax
jl 0x1660b
mov rax, qword [rbx + 0xb8]
mov cl, byte [rax]
cmp cl, 0x1b
ja 0x16654
lea r8, [0x00052ea0]
movzx eax, cl
mov r8, qword [r8 + rax*8]
test r8, r8
je 0x16654
mov rdx, rbx
mov rcx, r10
call r8
mov dword [rdi], eax
jmp 0x1667c
xor al, al
jmp 0x1667e
cmp cl, 0x16
jne 0x16662
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PoStartNextPowerIrp]
and qword [rbx + 0x38], 0
mov ecx, 0xc0000010
xor edx, edx
mov dword [rbx + 0x30], ecx
mov dword [rdi], ecx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x17ca0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
cmp dword [0x00046a90], 0x7d0
mov r12, r9
mov r13, r8
mov rbx, rdx
mov esi, ecx
jb 0x17cd9
mov eax, 0xc0000256
jmp 0x17d95
test ecx, ecx
jne 0x17cfc
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
jne 0x17d16
mov eax, 0xc000000d
jmp 0x17d95
cmp ecx, 2
je 0x17d0f
cmp ecx, 1
jne 0x17cf2
lea rbx, [0x0001e750]
jmp 0x17d16
lea rbx, [0x0001e730]
call fcn.00017e88
mov rdi, rax
test rax, rax
je 0x17d90
lea rcx, [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [0x0001e150]
lea rdx, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, rdi
mov ebp, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebp, ebp
jns 0x17d6f
mov eax, ebp
jmp 0x17d95
cmp dword [0x00046a94], 0
je 0x17d90
mov r9, r12
mov r8, r13
mov rdx, rbx
mov ecx, esi
call fcn.00017860
test al, al
je 0x17d90
xor eax, eax
jmp 0x17d95
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret

Function at 0x187bc
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
xor edi, edi
mov r13, rdx
mov r14, rcx
lea esi, [rdi + 0xb]
lea r9, [rax + 0x18]
xor r8d, r8d
xor edx, edx
mov ecx, esi
mov r12, rdi
mov dword [rax + 0x18], edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
je 0x18803
xor eax, eax
jmp 0x18895
mov edx, dword [rsp + 0x60]
mov ecx, 1
call fcn.0001c068
mov rbx, rax
cmp rax, rdi
je 0x187fc
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
mov rdx, rax
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, edi
jl 0x1888a
mov esi, edi
cmp dword [rbx], edi
jbe 0x18887
lea rbp, [rbx + 0x2e]
movzx ecx, word [rbp]
mov eax, esi
mov rdx, r14
imul rax, rax, 0x128
add rax, rbx
lea rcx, [rcx + rax + 0x30]
call sub.ntoskrnl.exe__stricmp
cmp eax, edi
je 0x1886c
inc esi
add rbp, 0x128
cmp esi, dword [rbx]
jb 0x1883c
jmp 0x18887
mov eax, esi
imul rax, rax, 0x128
mov r12, qword [rax + rbx + 0x18]
cmp r13, rdi
je 0x18887
mov eax, dword [rax + rbx + 0x20]
mov dword [r13], eax
mov rdi, r12
mov rcx, rbx
call fcn.0001c0e0
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x188b4
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x188d3
xor eax, eax
jmp 0x188ee
mov rcx, qword [rsp + 0x38]
call fcn.0001deb6
mov rcx, qword [rsp + 0x38]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1895c
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov dil, bl
cmp rcx, rbx
jne 0x18985
xor al, al
jmp 0x18a47
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, ebx
jl 0x1897e
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsReferencePrimaryToken]
mov rsi, rax
cmp rax, rbx
je 0x18a3a
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_SeQueryInformationToken]
cmp eax, ebx
jl 0x18a2e
call fcn.000190d4
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
mov rdx, qword [rax + 0x108]
call qword [sym.imp.ntoskrnl.exe_RtlEqualSid]
mov dil, al
cmp al, bl
jne 0x18a21
call fcn.000190d4
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
mov rdx, qword [rax + 0x180]
call qword [sym.imp.ntoskrnl.exe_RtlEqualSid]
mov dil, al
cmp al, bl
jne 0x18a21
call fcn.000190d4
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
mov rdx, qword [rax + 0x188]
call qword [sym.imp.ntoskrnl.exe_RtlEqualSid]
mov dil, al
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PsDereferencePrimaryToken]
mov bl, dil
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x18acc
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rsi, r9
mov rbp, r8
mov r12, rdx
mov r13, rcx
mov eax, 0x10000
mov edx, eax
mov ecx, 1
mov dword [rsp + 0x30], eax
call fcn.0001c068
mov rdi, rax
test rax, rax
je 0x18b7e
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x18b3f
mov rcx, rdi
call fcn.0001c0e0
mov eax, dword [rsp + 0x30]
add eax, 0x4000
jmp 0x18af5
test eax, eax
js 0x18b76
mov rbx, rdi
mov r8, qword [rbx + 0x40]
test r8, r8
je 0x18b6a
mov edx, dword [rbx + 0x64]
mov rcx, qword [rbx + 0x50]
mov r9, r12
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbp
call r13
test al, al
je 0x18b76
cmp dword [rbx], 0
je 0x18b76
mov eax, dword [rbx]
add rbx, rax
jmp 0x18b46
mov rcx, rdi
call fcn.0001c0e0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x18ba0
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea rdx, [rsp + 0x40]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, ebx
jge 0x18bc7
xor al, al
jmp 0x18bf4
mov rcx, qword [rsp + 0x40]
call fcn.0001d95e
cmp rax, rbx
je 0x18be7
mov rdx, rdi
mov rcx, rax
call sub.ntoskrnl.exe__stricmp
cmp eax, ebx
jne 0x18be7
mov bl, 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x19380
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0xc0
and qword [rax + 0x18], 0
lea rdx, [0x0001e960]
lea rcx, [rax - 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x90], 0
and qword [rsp + 0xa8], 0
and qword [rsp + 0xb0], 0
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0xe0]
mov edi, 1
mov edx, 0x80100000
mov dword [rsp + 0x28], 0x60
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x88], 0x30
mov dword [rsp + 0xa0], 0x240
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
js 0x1951c
mov rcx, qword [rsp + 0xe0]
lea r9d, [rdi + 0x17]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x194de
movsxd rbx, dword [rsp + 0x7c]
mov eax, dword [rsp + 0x78]
shl rbx, 0x20
or rbx, rax
je 0x19509
cmp rbx, 0x6400000
ja 0x19509
mov rdx, rbx
mov ecx, edi
call fcn.0001c068
mov rdi, rax
test rax, rax
je 0x194d9
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0xe0]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov esi, eax
test eax, eax
jns 0x194ca
mov rcx, rdi
call fcn.0001c0e0
mov ebx, esi
jmp 0x194de
cmp qword [rsp + 0x58], rbx
je 0x194f0
mov rcx, rdi
call fcn.0001c0e0
mov ebx, 0xc0000001
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
jmp 0x1951c
mov rcx, qword [rsp + 0xe0]
mov qword [0x00046ba8], rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
jmp 0x1951c
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc0000001
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x19538
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rdx, [rsp + 0x38]
xor edi, edi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, edi
jge 0x1955c
xor al, al
jmp 0x19583
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov ecx, 1
movzx ebx, dil
cmp rax, rdi
cmovne ebx, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1962c
Capabilities:
Find process by pid

Disassembly:
push rdi
sub rsp, 0x20
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x19650
lea rax, [0x0001e140]
jmp 0x196c0
mov rcx, qword [rsp + 0x38]
call fcn.0001d95e
mov r11, rax
test rax, rax
jne 0x1966f
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x19647
lea rdi, [0x00046bb0]
mov byte [0x00046cb3], 0
mov edx, 0x103
mov rcx, rdi
sub r11, rdi
lea rax, [rdx + 0x7ffffefb]
test rax, rax
je 0x196a7
mov al, byte [r11 + rcx]
test al, al
je 0x196a7
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x19688
test rdx, rdx
jne 0x196af
dec rcx
mov byte [rcx], 0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x19aec
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x00046cd0]
and dword [rsp + 0x30], 0
test rax, rax
jne 0x19bcd
lea edi, [rax + 0xb]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov ecx, edi
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
je 0x19b33
xor eax, eax
jmp 0x19bcd
mov edx, dword [rsp + 0x30]
mov ecx, 1
call fcn.0001c068
mov rbx, rax
test rax, rax
je 0x19b2c
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
jns 0x19b6c
mov rcx, rbx
call fcn.0001c0e0
jmp 0x19b2c
xor edi, edi
cmp dword [rbx], edi
jbe 0x19bbe
lea rsi, [rbx + 0x2e]
movzx ecx, word [rsi]
mov eax, edi
lea rdx, [0x0001e680]
imul rax, rax, 0x128
add rax, rbx
lea rcx, [rcx + rax + 0x30]
call sub.ntoskrnl.exe__stricmp
test eax, eax
je 0x19ba9
inc edi
add rsi, 0x128
cmp edi, dword [rbx]
jb 0x19b76
jmp 0x19bbe
mov eax, edi
imul rax, rax, 0x128
mov rax, qword [rax + rbx + 0x18]
mov qword [0x00046cd0], rax
mov rcx, rbx
call fcn.0001c0e0
mov rax, qword [0x00046cd0]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x19c8c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov bpl, r9b
mov bl, r8b
mov esi, edx
mov r12, rcx
call fcn.00019be4
test rax, rax
je 0x19ceb
mov rcx, rax
call fcn.0001c43c
test eax, eax
jne 0x19ceb
call fcn.0001d990
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
xor r9d, r9d
lea ecx, [r9 + 0x21]
mov rdx, rax
mov r8d, ebx
call fcn.0001b50c
xor eax, eax
jmp 0x19ddb
test bl, bl
je 0x19cf8
mov ecx, esi
call fcn.0001c350
mov esi, eax
cmp esi, 0xffffffff
je 0x19ce4
cmp qword [0x00046ba8], 0
jne 0x19d28
lea rdx, [0x00046ba8]
lea rcx, [0x0001e960]
call fcn.00019380
test eax, eax
js 0x19ce4
cmp qword [0x00046ba8], 0
je 0x19ce4
call fcn.0001adc8
mov rdi, rax
test rax, rax
je 0x19ce4
call fcn.00019aec
mov rbx, qword [0x00046ba8]
mov r13d, 0x5a4d
sub rdi, rax
cmp word [rbx], r13w
je 0x19d54
xor ecx, ecx
jmp 0x19d5b
movsxd rcx, dword [rbx + 0x3c]
add rcx, rbx
mov edx, edi
call fcn.0001c918
test eax, eax
je 0x19ce4
mov edx, eax
add rdx, rbx
cmp word [rbx], r13w
jne 0x19d84
movsxd rax, dword [rbx + 0x3c]
add rax, rbx
je 0x19d84
mov rcx, qword [rax + 0x30]
jmp 0x19d86
xor ecx, ecx
movsxd rax, esi
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x28]
mov rbx, qword [rdx + rax*8]
lea rdx, [rsp + 0x24]
sub rbx, rcx
lea rcx, [rsp + 0x20]
add rbx, r12
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
cmp dword [rsp + 0x20], 5
jne 0x19dbf
cmp dword [rsp + 0x24], 2
jne 0x19dbf
and rbx, 0xfffffffffffffff0
test bpl, bpl
je 0x19dd8
cmp byte [rbx], 0xff
jne 0x19dd8
cmp byte [rbx + 1], 0x25
jne 0x19dd8
movsxd rcx, dword [rbx + 2]
mov rbx, qword [rcx + rbx + 6]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret

Function at 0x1aac0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x48
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x24]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov eax, 1
test eax, eax
jne 0x1aaf9
cmp dword [rsp + 0x24], 5
jne 0x1aaf9
cmp dword [rsp + 0x20], 1
jne 0x1aaf9
mov al, 1
jmp 0x1aafb
xor al, al
add rsp, 0x48
ret
Function at 0x1ab18
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
lea rax, [0x0001e390]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x38]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov dword [rsp + 0x30], ecx
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x50]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov dword [rsp + 0x28], ecx
xor r9d, r9d
lea r8, [rsp + 0x2c]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x24]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov eax, 1
test eax, eax
jne 0x1ab93
cmp dword [rsp + 0x24], 5
jne 0x1ab93
cmp dword [rsp + 0x20], 1
je 0x1ab97
xor al, al
jmp 0x1abe0
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
call sub.ntoskrnl.exe__stricmp
test eax, eax
jne 0x1abae
mov al, 1
jmp 0x1abe0
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x28], eax
jle 0x1abde
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x28]
sub eax, ecx
cdqe
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rdx, qword [rsp + 0x38]
call sub.ntoskrnl.exe__stricmp
test eax, eax
jne 0x1abde
mov al, 1
jmp 0x1abe0
xor al, al
add rsp, 0x40
pop rdi
ret

Function at 0x1abec
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
lea rax, [0x0001e8a0]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x38]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov dword [rsp + 0x30], ecx
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov dword [rsp + 0x28], ecx
xor r9d, r9d
lea r8, [rsp + 0x2c]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x24]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov eax, 1
test eax, eax
jne 0x1ac69
cmp dword [rsp + 0x24], 5
jne 0x1ac69
cmp dword [rsp + 0x20], 1
je 0x1ac6d
xor al, al
jmp 0x1acb8
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
call fcn.0001d976
test eax, eax
jne 0x1ac84
mov al, 1
jmp 0x1acb8
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x28], eax
jle 0x1acb6
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x28]
sub eax, ecx
movsxd rcx, eax
mov rax, qword [rsp + 0x50]
lea rcx, [rax + rcx*2]
mov rdx, qword [rsp + 0x38]
call fcn.0001d976
test eax, eax
jne 0x1acb6
mov al, 1
jmp 0x1acb8
xor al, al
add rsp, 0x40
pop rdi
ret

Function at 0x1ad14
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov byte [rsp + 0x20], 0
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x1ad67
mov rcx, qword [rsp + 0x28]
call fcn.0001acc4
mov byte [rsp + 0x20], al
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, byte [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x1bbcc
Capabilities:
Allocate or change rwx memory
Attach user process memory

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r12
mov qword [rax + 8], rcx
push r13
sub rsp, 0xc0
mov r12, rdx
mov rsi, rcx
and qword [rsp + 0x30], 0
mov rcx, rdx
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov r13, qword [rsp + 0xf8]
mov qword [rsp + 0x40], r13
and qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rax
and qword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0x30
and qword [rsp + 0x60], 0
mov dword [rsp + 0x70], 0x200
and qword [rsp + 0x68], 0
and qword [rsp + 0x78], 0
and qword [rsp + 0x80], 0
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x58]
mov edx, 0x1f0fff
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
test eax, eax
js 0x1bd14
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov ebx, eax
test eax, eax
js 0x1bcfb
lea rdx, [rsp + 0x88]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov r8, r13
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x30]
call fcn.0001db70
jmp 0x1bced
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
js 0x1bd12
mov rax, qword [rsp + 0x30]
mov qword [rsi], rax
mov eax, ebx
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret