joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007a9d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg r15, rbx
mov dword [rsp + 0x18], r8d
nop
mov qword [rsp - 8], rdi
sub rsp, 8
neg rsp
sub rsp, 0xfffffffffffffdc0
neg rsp
mov rbx, rdx
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
xor edx, edx
mov dword [rsp - 0x18], edx
lea rcx, [rsp + 0x30]
mov r8d, 0x7bf59432
xor r8d, 0x15fc2f3c
xor r8d, 0x34abee22
add r8d, 0xfb772dc
sub r8d, 0x6a59c600
call fcn.140096790
mov rax, qword gs:[0x60]
xchg rbp, rbp
xchg r13, r8
mov r13, qword [rax + 0x18]
xchg r13, r8
mov rax, qword [r8 + 0x10]
mov dword [rsp - 0x3c], 0x71b81f06
mov r8, qword [rax]
test r8, r8
je 0x14007ac5e
mov r8, qword [r8 + 0x50]
xchg rcx, rcx
test r8, r8
je 0x14007ac5e
mov edx, 0x7171802a
sub edx, 0x2e9f22ce
add edx, 0x338f768d
sub edx, 0x5c08ff8e
xor edx, 0x1a58d55f
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x44], 0x5a9003a3
lea r9d, [rdx - 1]
call fcn.140097150
mov edx, 0x68157391
xor edx, 0x780b1706
add edx, 0x2c1897fb
add edx, 0x22c0ba68
sub edx, 0x5ef7b69e
lea rcx, [rsp + 0x30]
call fcn.140097220
test rax, rax
mov rsp, rsp
je 0x14007ac26
xor ecx, ecx
mov rdx, rdi
mov r8, r8
mov word [rax], cx
movabs rcx, 0xe4394e1f77ea0ed9
sub rcx, 0x649664d1
xor rcx, 0x172ed7fb
add rcx, 0x2ca937a
mov r8, qword [0x14049f7f0]
xchg rbp, rbp
movabs rax, 0x1dae4dec58c47bab
xor rax, 0x57c91986
xor rax, 0x16faa0f1
xor rax, 0x2048d1ef
sub rax, 0x36e21555
not r8
ror r8, 0xf
ror r8, 0xd
add r8, rcx
mov dword [rsp - 0x20], 0x11004f33
lea rcx, [rsp + 0x20]
not r8
sub r8, rax
ror r8, 6
ror r8, 7
call r8
mov dword [rsp - 0x30], edi
mov r10, qword [0x14049f7e0]
lea r8, [rsp + 0x20]
movabs rcx, 0xbe86f5ab59e03350
xor rcx, 0x769a5299
add rcx, 0x3a735f42
xor rcx, 0x4cac9d3b
sub rcx, 0x2fb2633
lea rdx, [rsp + 0x260]
add r10, rcx
movabs rax, 0x4cde187379877150
sub rax, 0x4a08bdfc
add rax, 0x4265a2a2
xor rax, 0x22ba84d3
sub rax, 0x32fb264d
not r10
mov dword [rsp - 0x40], ecx
lea rcx, [rsp + 0x30]
sub r10, rax
mov r9, rbx
mov dword [rsp - 0x20], ebp
movabs rax, 0x586bc1c10277e95f
add rax, 0x27e640eb
add rax, 0x207b8563
add rax, 0x7fffffff
add rax, 0x2a03af3f
xor r10, rax
mov dword [rsp - 0x28], ecx
call r10
xchg r13, rbx
mov r13, qword [rsp + 0x250]
xchg rbx, r13
add rsp, 0x6c3e8943
sub rsp, 0x6c3e8703
nop
mov rdi, qword [rsp]
add rsp, 8
ret
mov eax, 0x76c63272
sub eax, 0x4bba6ea6
xor eax, 0x798d3dc8
xor eax, 0x9286fe05
mov rbx, qword [rsp + 0x250]
mov r14, r14
sub rsp, 0x2f85e649
add rsp, 0x2f85e889
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
xchg rbx, rdi
mov rdi, qword [rsp + 0x250]
xchg rbx, rdi
mov eax, 0x1f668159
xor eax, 0x61ff2787
sub eax, 0x103664c
xor eax, 0x50bf2d49
add eax, 0x92d6935a
neg rsp
add rsp, 0xfffffffffffffdc0
neg rsp
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140081cc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1404a00c4], 0
jne 0x140081dda
xchg r8, r8
xor edx, edx
lea r8, [0x1404a00c0]
nop word [rax + rax]
mov dword [rsp - 0x1c], 0x6e75f8d9
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov dword [rsp - 0x34], ebx
mov eax, edx
shr eax, 1
neg ecx
mov dword [rsp - 0x14], 0x78bc0342
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
mov r12, r12
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0xc], edx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
mov dword [rsp - 0xc], 0x5845a2b
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x18], 0x68f8671d
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x18], 0x22e9b769
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x18], ecx
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
xchg rbx, rbx
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov r14, r14
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0x10], 0x4d0f27f1
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
xchg r8, r8
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov r11, r11
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x2c], 0xd408020
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
mov dword [rsp - 0x10], 0x401950a8
cmp edx, 0x100
jb 0x140081ceb
ret
Function at 0x140086d32
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
nop
push 0x69279cb5
mov qword [rsp], rbp
nop
push 0x5c721c5c
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], r12
push r13
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
nop
add rsp, 0x602ffd23
sub rsp, 0x602ffd4b
xchg r14, r15
mov r15, rdx
xchg r15, r14
mov r13d, r8d
mov edx, 0x77595e55
xor edx, 0x6676bd4a
add edx, 0x460b6a75
sub edx, 0x57374d94
cmp r8d, edx
mov dword [rsp - 0x14], edx
jae 0x140086cc2
mov edx, r13d
nop
movabs rcx, 0xffffffff1d0bb801
xor rcx, 0x10a09adf
add rcx, 0x2d18b7d5
add rcx, 0x7fffffff
add rcx, 0x453c254d
mov eax, 0x85637ab
sub eax, 0x28398ae
add eax, 0x5c69f80b
sub eax, 0x40a29f4d
xor eax, 0x2199f7bf
mul rdx
cmovo rax, rcx
xchg rdx, rdx
xchg r10, rax
mov rcx, r10
xchg r10, rax
call fcn.140096050
xchg r9, r15
mov r9, rax
xchg r15, r9
mov byte [rsp + 0x70], 0x63
sub byte [rsp + 0x70], 0x4a
sub byte [rsp + 0x70], 1
xor byte [rsp + 0x70], 0x19
mov rax, qword [rsp + 0x60]
lea r12d, [r13 + 0xfffff]
mov dword [rsp - 0x30], 0x3ba4f518
xor esi, esi
shr r12d, 0xe
shr r12d, 1
shr r12d, 3
shr r12d, 1
shr r12d, 1
mov ebp, dword [rax + 0x18]
test r12d, r12d
mov rsp, rsp
je 0x140086e80
mov qword [rsp + 0x68], rbx
mov ecx, 0x5512766
add ecx, 0x506e3f34
add ecx, 0x1c4768e2
sub ecx, 0x71f6cf7c
mov qword [rsp + 0x20], rdi
mov r15, r15
mov edi, esi
mov ebx, r13d
shl edi, 0x10
shl edi, 2
shl edi, 1
shl edi, 1
xchg r15, rdx
mov r15, rdx
xchg rdx, r15
sub ebx, edi
cmp ebx, ecx
xchg rdi, rdi
cmova ebx, ecx
xchg r9, rax
mov rcx, r9
xchg r9, rax
mov r8d, ebx
call fcn.140083630
test al, al
xchg rdx, rdx
je 0x140086e56
shr ebx, 1
shr ebx, 1
xor eax, eax
shr edi, 2
mov rdi, rdi
test ebx, ebx
je 0x140086e19
xchg rbx, r15
mov r9, rbx
xchg rbx, r15
lea ecx, [rdi + rax]
xchg r10, r10
mov r8d, ebp
xor r8d, dword [r9]
lea r9, [r9 + 4]
xor r8d, 0x28cb554b
mov dword [rsp - 0xc], 0x15473e30
inc eax
mov dword [r14 + rcx*4], r8d
cmp eax, ebx
mov dword [rsp - 0x20], esp
jb 0x140086de8
xchg rsi, rax
mov rsi, qword [rsp + 0x60]
xchg rsi, rax
inc esi
mov rdi, rdi
mov ecx, 0x4c2de970
xor ecx, 0x3d5eabe1
sub ecx, 0x1a4f7784
xor ecx, 0x3b71208f
sub ecx, 0x6c42eb82
cmp esi, r12d
jb 0x140086d8f
mov dword [rsp - 0xc], esi
jmp 0x140086e6a
mov byte [rsp + 0x70], 0x1b
xor byte [rsp + 0x70], 0x23
xor byte [rsp + 0x70], 0x57
sub byte [rsp + 0x70], 0x6f
xchg rbx, r9
mov r9, qword [rsp + 0x68]
xchg r9, rbx
xchg r12, rdi
mov r12, qword [rsp + 0x20]
xchg rdi, r12
xchg r15, rcx
mov r15, rcx
xchg r15, rcx
call fcn.140096060
movzx eax, byte [rsp + 0x70]
add rsp, 0x28
mov r8, r8
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
pop r13
mov rbp, rbp
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140086ee0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov rsp, rsp
xchg rcx, rbp
mov qword [rsp + 0x10], rcx
xchg rcx, rbp
mov qword [rsp + 0x20], rsi
nop
push r13
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r15
nop
add rsp, 0x46c1d043
sub rsp, 0x46c1d063
mov r14d, r8d
mov dword [rsp - 0x10], 0x4249c620
xchg rdi, rdx
mov rdx, rdi
xchg rdx, rdi
mov r9d, r14d
xchg r11, r11
xchg rdx, r13
mov rdx, rcx
xchg r13, rdx
cmp r8d, 0x40000
jb 0x140086f7b
mov r14, r14
mov r9d, 0x631f4f34
add r9d, 0x7dad5bd
xor r9d, 0x63f6b88a
add r9d, 0x1bd90ab1
sub r9d, 0x24e1a72c
nop
movabs rcx, 0xffffffff4beead11
xor rcx, 0x417fbf32
add rcx, 0x471f74de
sub rcx, 0x1c9fea46
add rcx, 0x7fffffff
add rcx, 0x4aef6345
mov eax, 0x2665adab
add eax, 0x4cfb26dd
xor eax, 0x1ef41ea
sub eax, 0x728f955e
mul r9
mov dword [rsp - 0xc], edx
cmovo rax, rcx
mov rcx, rax
call fcn.140096050
mov r13, r13
mov esi, dword [r13 + 0x18]
lea r15d, [r14 + 0xfffff]
shr r15d, 4
shr r15d, 1
shr r15d, 2
shr r15d, 0xa
shr r15d, 2
shr r15d, 1
xor ebx, ebx
xchg rsp, rax
mov rbp, rsp
xchg rsp, rax
mov r12b, 0x4e
xor r12b, 0x5f
add r12b, 0xf
sub r12b, 0x1f
test r15d, r15d
mov dword [rsp - 0x2c], edi
je 0x140087123
nop
mov r8d, ebx
xchg rsi, rsi
mov r10d, r14d
shl r8d, 9
shl r8d, 1
shl r8d, 1
shl r8d, 6
shl r8d, 2
shl r8d, 1
xor eax, eax
sub r10d, r8d
mov dword [rsp - 0x28], ebp
shr r8d, 2
cmp r10d, 0x100000
jbe 0x14008709c
mov r10d, 0x1add7183
sub r10d, 0x46ed56
xor r10d, 0x18ca9a4b
xor r10d, 0x6ae3dbd7
sub r10d, 0x68afc5b1
mov r11d, 0x62d9c194
xor r11d, 0x1af696a7
sub r11d, 0x1b8eb3
xor r11d, 0x42352f17
sub r11d, 0x3a22e797
jmp 0x1400870af
mov r11d, r10d
xchg rsi, rsi
shr r11d, 2
test r11d, r11d
je 0x1400870e5
mov r9, rbp
xchg r14, r14
nop dword [rax]
lea edx, [r8 + rax]
mov ecx, esi
mov dword [rsp - 0x3c], esi
xor ecx, dword [rdi + rdx*4]
lea r9, [r9 + 4]
xor ecx, 0x28cb554b
inc eax
mov rbp, rbp
mov dword [r9 - 4], ecx
cmp eax, r11d
jb 0x1400870bc
mov r8d, r10d
mov r9, r9
xchg rdx, r11
mov r11, rbp
xchg r11, rdx
xchg rdi, r13
mov rcx, rdi
xchg rdi, r13
call fcn.140083a60
test al, al
mov rcx, rcx
je 0x140087120
inc ebx
cmp ebx, r15d
mov r10, r10
jb 0x14008701b
jmp 0x140087123
xor r12b, r12b
xchg rsp, rbp
mov rcx, rsp
xchg rbp, rsp
call fcn.140096060
mov dword [rsp - 0x40], 0x40111572
xchg r11, rbx
mov r11, qword [rsp + 0x50]
xchg rbx, r11
movzx eax, r12b
mov r9, r9
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
nop
sub rsp, 0x3eeb90ee
add rsp, 0x3eeb910e
pop r15
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
pop rdi
ret
Function at 0x140087190
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 0x10], rsi
xchg rsi, rbx
mov qword [rsp + 0x18], rbp
mov dword [rsp - 0x34], ebp
push rsi
push rdx
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
mov eax, 0x22770d5
add eax, 0x10abac6
xor eax, 0x1748c1e
xor eax, 0x7268156e
sub eax, 0x702ea2cb
call fcn.140097dc0
sub rsp, rax
xchg r10, r10
mov r15, rcx
call fcn.140097ca0
mov ebp, eax
and ebp, 0x3fc
mov rbx, rbx
jbe 0x140087245
lea rdi, [rsp + 0x20]
mov esi, ebp
mov dword [rsp - 0xc], 0x332e2fd
call fcn.140097ca0
movzx ebx, ax
shl ebx, 0xa
shl ebx, 5
shl ebx, 1
call fcn.140097ca0
mov dword [rsp - 0x2c], esp
movzx ecx, ax
lea rdi, [rdi + 4]
or ecx, ebx
mov dword [rdi - 4], ecx
mov r9, r9
sub rsi, 1
jne 0x140087213
lea r14d, [rbp*4]
mov dword [rsp - 0x38], 0x7a58bd3f
mov eax, 0x26cb46a
add eax, 0x2d17230d
xor eax, 0x11c3d912
sub eax, 0x3e400e61
mov ecx, r14d
mov dword [rsp - 0x40], edi
mul rcx
pushf
movabs rcx, 0xffffffff42b27ec8
sub rcx, 0x3b2f5e7d
xor rcx, 0x73c59804
sub rcx, 0x1b8965ef
add rcx, 0x7fffffff
xor rcx, 0x2742ada0
popf
cmovo rax, rcx
xchg r15, rax
mov rcx, r15
xchg r15, rax
call fcn.140096050
xchg r11, r11
mov edi, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 6
shr ebp, 1
shr ebp, 6
shr ebp, 7
xor ebx, ebx
mov rsi, rax
mov r12b, 8
add r12b, 0xb
add r12b, 0x6b
sub r12b, 0x41
sub r12b, 0x3c
test ebp, ebp
je 0x1400873f5
xchg rcx, rcx
nop
mov r8d, ebx
mov r10d, r14d
mov dword [rsp - 0x44], 0x4f8d56b2
shl r8d, 0xa
shl r8d, 6
shl r8d, 1
shl r8d, 1
shl r8d, 1
shl r8d, 1
xor eax, eax
sub r10d, r8d
shr r8d, 2
mov dword [rsp - 0x38], esi
cmp r10d, 0x100000
jbe 0x140087369
mov r10d, 0x659b764c
sub r10d, 0x2e2d8a69
add r10d, 0x190d8543
sub r10d, 0x506b7126
mov r11d, 0x8478dcf
add r11d, 0x52b563eb
sub r11d, 0x7ede02a
sub r11d, 0x530b1190
jmp 0x140087381
mov r11d, r10d
mov r13, r13
shr r11d, 1
shr r11d, 1
test r11d, r11d
je 0x1400873bc
xchg rsp, rsp
mov r9, rsi
nop dword [rax]
lea edx, [r8 + rax]
mov dword [rsp - 0x20], 0x10127f63
mov ecx, edi
xor ecx, dword [rsp + rdx*4 + 0x20]
lea r9, [r9 + 4]
xchg r12, r12
xor ecx, 0x28cb554b
inc eax
mov dword [r9 - 4], ecx
cmp eax, r11d
mov r10, r10
jb 0x14008738b
mov r8d, r10d
mov rdx, rsi
xchg r14, r14
xchg rcx, r15
mov r15, rcx
xchg rcx, r15
call fcn.140083a60
test al, al
mov dword [rsp - 0x44], edi
je 0x1400873f2
inc ebx
cmp ebx, ebp
jb 0x1400872f2
mov dword [rsp - 0x2c], edi
jmp 0x1400873f5
xor r12b, r12b
xchg r10, rcx
mov r10, rsi
xchg rcx, r10
call fcn.140096060
lea r11, [rsp + 0x1020]
movzx eax, r12b
mov dword [rsp - 0x18], 0x40c42fab
xchg r10, rbx
mov r10, qword [r11 + 0x38]
xchg rbx, r10
mov rbp, qword [r11 + 0x40]
mov dword [rsp - 0x44], 0x3bb7925c
mov rsp, r11
pop r15
pop r14
mov dword [rsp - 0x3c], 0x6712eb11
pop r12
pop rdi
nop
mov rsi, qword [rsp]
add rsp, 8
ret
Function at 0x14008a610
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov ebx, edx
mov r8d, ecx
mov dword [rsp - 0x44], 0x234653ef
test ecx, ecx
jne 0x14008a63b
xor eax, eax
mov rsp, rsp
xchg rbx, rdi
mov rdi, qword [rsp + 8]
xchg rbx, rdi
ret
xor r10d, r10d
mov r11d, r8d
mov edx, r10d
mov dword [rsp - 0x20], edi
mov r9d, r8d
nop dword [rax]
nop word [rax + rax]
mov dword [rsp - 0x24], ebp
lea eax, [r9 + r9]
mov ecx, edx
xor ecx, r9d
mov r9d, eax
mov dword [rsp - 0x18], ebx
test r11b, 1
cmove ecx, edx
xor r9d, ebx
cmp eax, 0x100
mov r8, r8
mov edx, ecx
cmovb r9d, eax
shr r11d, 1
mov r15, r15
jne 0x14008a65d
mov r11d, r8d
mov r9d, r10d
mov dword [rsp - 0xc], esp
test ecx, ecx
je 0x14008a6dd
lea eax, [r11 + r11]
mov dword [rsp - 0x18], ecx
mov ecx, r9d
xor ecx, r11d
mov r11d, eax
mov dword [rsp - 0x40], esi
test dl, 1
cmove ecx, r9d
xor r11d, ebx
cmp eax, 0x100
mov dword [rsp - 0x34], esp
mov r9d, ecx
cmovb r11d, eax
shr edx, 1
xchg rsp, rsp
jne 0x14008a6a3
mov r11d, r9d
mov edx, r10d
test r9d, r9d
xchg rdi, rdi
je 0x14008a730
nop dword [rax]
nop word [rax + rax]
lea eax, [r11 + r11]
mov r13, r13
mov ecx, edx
xor ecx, r11d
mov r11d, eax
test r9b, 1
mov rsi, rsi
cmove ecx, edx
xor r11d, ebx
cmp eax, 0x100
mov edx, ecx
mov rdx, rdx
cmovb r11d, eax
shr r9d, 1
jne 0x14008a6fd
test edx, edx
xchg rbx, rbx
je 0x14008a77f
nop word [rax + rax]
mov ecx, r10d
mov dword [rsp - 0x24], esp
xor ecx, r8d
test dl, 1
cmove ecx, r10d
mov r10d, ecx
mov r10, r10
lea ecx, [r8 + r8]
mov r8d, ecx
xor r8d, ebx
mov dword [rsp - 0x40], 0x648a5546
cmp ecx, 0x100
cmovb r8d, ecx
shr edx, 1
jne 0x14008a741
xchg r9, r9
mov rbx, qword [rsp + 8]
mov eax, r10d
ret
Function at 0x140097dc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x10
mov dword [rsp - 0x34], ebp
xchg r10, r11
mov qword [rsp], r11
xchg r11, r10
mov qword [rsp + 8], r11
mov r11, r11
xor r11, r11
lea r10, [rsp + 0x18]
sub r10, rax
cmovb r10, r11
xchg rdx, rdx
mov r11, qword gs:[0x10]
cmp r10, r11
bnd jae 0x140097e2d
mov dword [rsp - 0x10], 0x16a887d0
and r10w, 0xf000
lea r11, [r11 - 0x1000]
mov byte [r11], 0x52
sub byte [r11], 0xa
sub byte [r11], 0x2d
sub byte [r11], 4
xor byte [r11], 0x17
cmp r10, r11
bnd jne 0x140097e09
xchg rsp, rsp
mov r10, qword [rsp]
mov r11, qword [rsp + 8]
nop
sub rsp, 0xb8018
add rsp, 0xb8028
bnd ret
Function at 0x1404929e0
Capabilities:
Execute syscall

Disassembly:
xchg r10, rsp
mov rsp, rcx
xchg rsp, r10
mov eax, dword [0x1404a0084]
xchg r10, r10
cmp qword [0x1404a0098], 0
jne 0x140087450
syscall
xchg r12, r12
ret
jmp 0x140087f77
Function at 0x140001000
Capabilities:
Find process by pid
Print debug messages

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov qword [rsp + 0x28], 0
movsxd rax, dword [rsp + 0x50]
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140001066
cmp dword [rsp + 0x20], 0xc000000d
jne 0x140001049
lea rcx, [0x140002c80]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [rsp + 0x20], 0xc000000b
jne 0x14000105f
lea rcx, [0x140002ca0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xffffffff
jmp 0x1400010ab
mov eax, dword [0x140005318]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x58]
cmp eax, ecx
jne 0x14000109d
lea rcx, [0x140002cf0]
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
jmp 0x1400010ab
mov rax, qword [rsp + 0x30]
movzx ecx, byte [rsp + 0x58]
mov byte [rax], cl
xor eax, eax
add rsp, 0x48
ret

Function at 0x1400010b0
Capabilities:
Create device object
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
lea rcx, [0x140005580]
call sub.ntoskrnl.exe_ExInitializePushLock
mov rax, qword [rsp + 0x50]
add rax, 8
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x22
lea r8, section..data
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
lea rdx, section..data
lea rcx, [0x140005010]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
call fcn.140001630
test eax, eax
je 0x140001139
lea rcx, [0x140003140]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x50]
call fcn.140002290
mov eax, 0xc0000001
jmp 0x1400011a5
lea rcx, [0x140003190]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0x50]
lea rcx, [fcn.140002290]
mov qword [rax + 0x68], rcx
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x50]
lea rdx, [0x140001e80]
mov qword [rcx + rax + 0x70], rdx
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x50]
lea rdx, [0x140001610]
mov qword [rcx + rax + 0x70], rdx
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x50]
lea rdx, [0x1400015f0]
mov qword [rcx + rax + 0x70], rdx
xor eax, eax
add rsp, 0x48
ret
Function at 0x140001450
Capabilities:
Find process by pid
Print debug messages

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov qword [rsp + 0x30], 0
movsxd rax, dword [rsp + 0x50]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1400014b5
cmp dword [rsp + 0x20], 0xc000000d
jne 0x140001495
lea rcx, [0x140002e60]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [rsp + 0x20], 0xc000000b
jne 0x1400014ab
lea rcx, [0x140002e80]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xffffffff
jmp 0x1400015dc
mov eax, dword [0x140005314]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
lea rcx, [0x140005580]
call qword [sym.imp.ntoskrnl.exe_ExAcquirePushLockExclusiveEx]
mov rax, qword [rsp + 0x28]
cmp qword [rax], 0
je 0x1400014f1
mov rax, qword [rsp + 0x28]
cmp qword [rax + 8], 0
jne 0x140001505
xor edx, edx
lea rcx, [0x140005580]
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
jmp 0x1400015ba
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
cmp qword [rax + 8], rcx
jne 0x14000152b
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x28]
cmp qword [rax], rcx
je 0x140001550
xor edx, edx
lea rcx, [0x140005580]
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
lea rcx, [0x140002eb0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xffffffff
jmp 0x1400015dc
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [rax], 0
mov rax, qword [rsp + 0x28]
mov qword [rax + 8], 0
xor edx, edx
lea rcx, [0x140005580]
call qword [sym.imp.ntoskrnl.exe_ExReleasePushLockExclusiveEx]
mov rcx, qword [rsp + 0x30]
call sub.ntoskrnl.exe_PsGetProcessImageFileName
mov rdx, rax
lea rcx, [0x140002ee0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400015cf
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
add rsp, 0x48
ret
Function at 0x140001af0
Capabilities:
Find process by pid
Print debug messages

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov ecx, 4
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140001b4e
cmp dword [rsp + 0x20], 0xc000000d
jne 0x140001b2e
lea rcx, [0x140002c80]
call sub.ntoskrnl.exe_DbgPrint
cmp dword [rsp + 0x20], 0xc000000b
jne 0x140001b44
lea rcx, [0x140002ca0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xffffffff
jmp 0x140001bde
mov eax, dword [0x140005314]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov eax, dword [0x140005314]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x28]
cmp qword [rcx], rax
je 0x140001bd5
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 8]
lea rcx, [0x140002cd0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [0x140005314]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, rcx
mov ecx, dword [0x140005318]
add rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
jmp 0x140001b64
jmp 0x140001bde
add rsp, 0x48
ret
Function at 0x140002290
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
cmp qword [0x140005360], 0
je 0x1400022bc
mov r8d, 0xc
lea rdx, [0x140005354]
mov rcx, qword [0x140005360]
call fcn.1400022f0
lea rcx, [0x140005010]
call qword [sym.imp.ntoskrnl.exe_IoDeleteSymbolicLink]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
lea rcx, [0x140002f30]
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x28
ret

Function at 0x1400022f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140002346
lea rcx, [0x140002af0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xffffffff
jmp 0x1400023de
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov qword [rsp + 0x38], rax
mov edx, 4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_MmProtectMdlSystemAddress]
test eax, eax
je 0x1400023a5
lea rcx, [0x140002af0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xffffffff
jmp 0x1400023de
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
rep movsb byte [rdi], byte [rsi]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
xor eax, eax
add rsp, 0x48
pop rdi
pop rsi
ret