joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10000129c
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1000036f8]
lea rdx, [0x100003700]
call qword [sym.imp.API_MS_WIN_Service_Core_L1_1_0.dll_SetServiceStatus]
test eax, eax
jne 0x1000012e6
mov dword [0x100003704], 1
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp qword [0x1000036f8], 0
mov dword [0x10000370c], eax
je 0x1000012dd
call fcn.10000129c
xor ecx, ecx
call qword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_ExitProcess]
inc dword [0x100003714]
add rsp, 0x28
ret

Function at 0x1000014b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x100003740], rdi
je 0x1000014fe
cmp rax, rdi
jne 0x1000014f1
mov edi, 1
mov r12d, edi
jmp 0x100001503
mov ecx, 0x3e8
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x1000014d5
mov edi, 1
mov eax, dword [0x100003738]
cmp eax, edi
jne 0x100001519
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x100001576
mov eax, dword [0x100003738]
test eax, eax
jne 0x100001570
mov dword [0x100003738], edi
lea r13, [0x1000011a0]
lea rsi, [0x100001188]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x100001562
test eax, eax
jne 0x100001562
mov rcx, qword [rsi]
test rcx, rcx
je 0x100001557
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x100001540
test eax, eax
je 0x100001576
mov eax, 0xff
jmp 0x100001648
mov dword [0x100003164], edi
mov eax, dword [0x100003738]
cmp eax, edi
jne 0x10000159d
lea rdx, [0x100001180]
lea rcx, [0x100001170]
call sub.msvcrt.dll__initterm
mov dword [0x100003738], 2
test r12d, r12d
jne 0x1000015ab
xor eax, eax
xchg qword [0x100003740], rax
cmp qword [0x100003748], 0
je 0x1000015d4
lea rcx, [0x100003748]
call fcn.10000189c
test eax, eax
je 0x1000015d4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100003748]
mov r8, qword [0x100003148]
mov rdx, qword [0x100003150]
mov ecx, dword [0x100003140]
call fcn.100001440
mov dword [0x100003160], eax
cmp dword [0x100003144], 0
jne 0x100001604
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100003164], 0
jne 0x100001619
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100003160]
jmp 0x100001648
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.100144000
add rsp, 0x28
jmp 0x1000014b0

Function at 0x100001908
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100001955
cmp rcx, 0xffffffffffffffff
je 0x100001955
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10000194d
cmp dword [rcx + 0x3c], edx
jl 0x10000194d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000194d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100001955
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140011424
Capabilities:
Terminate process

Disassembly:
jmp 0x14001c790
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14001153c
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001b640
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001b660
xor al, al
jmp 0x14001b6e1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001b673
xor al, al
jmp 0x14001b6e1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001b69d
xor al, al
jmp 0x14001b6e1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001b6b1
xor al, al
jmp 0x14001b6e1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001b6c3
xor al, al
jmp 0x14001b6e1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001b6df
xor al, al
jmp 0x14001b6e1
mov al, 1
add rsp, 0x38
ret
Function at 0x140015410
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x140030040]
xor rax, rbp
mov qword [rbp + 0x120], rax
lea rcx, [0x14003606d]
call fcn.14001175d
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140018480
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 0x108]
call fcn.140015f80
mov qword [rbp + 0x118], rax
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.1400137c0
nop
lea rcx, [rbp + 0x108]
call fcn.140016e50
lea rax, [0x140015300]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x150]
add rax, 8
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 8]
call fcn.140018af0
mov rcx, qword [rbp + 0x118]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x150]
mov qword [rcx], rax
mov rax, qword [rbp + 0x150]
cmp qword [rax], 0
je 0x140015510
lea rcx, [rbp + 8]
call fcn.140019370
jmp 0x140015529
mov rax, qword [rbp + 0x150]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400111a9
nop
lea rcx, [rbp + 8]
call fcn.140016e50
lea rcx, [rbp - 0x30]
lea rdx, [0x140024660]
call fcn.14001165e
mov rcx, qword [rbp + 0x120]
xor rcx, rbp
call fcn.1400113a2
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1400021d0
Capabilities:
Enumerate processes
Execute command

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x12c
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov dword [rsp + 0x20], 0x130
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140002232
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._____Resolver___https:__resolverfoundhitbox.ru__You_dont_have_access_to_the_process___Resolver_Loader__Coded_by_Lakon_n
call fcn.140002170
jmp 0x14000231e
mov qword [rsp + 0x178], rdi
lea rdx, [rsp + 0x20]
mov rcx, rbx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400022a7
mov qword [rsp + 0x170], rsi
lea rsi, str.java.exe
nop dword [rax]
lea r8, [rsp + 0x4c]
mov rax, rsi
sub r8, rsi
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140002283
inc rax
test ecx, ecx
jne 0x140002270
test edx, edx
je 0x14000229b
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140002260
jmp 0x14000229f
mov edi, dword [rsp + 0x28]
mov rsi, qword [rsp + 0x170]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, qword [rsp + 0x178]
mov rbx, rax
test rax, rax
jne 0x1400022e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._____Resolver___https:__resolverfoundhitbox.ru__Could_not_find_the_process___Resolver_Loader__Coded_by_Lakon_n
call fcn.140002170
jmp 0x14000231e
mov rcx, rbx
call fcn.140001080
test al, al
jne 0x140002309
lea rcx, str._____Resolver___https:__resolverfoundhitbox.ru__Injection_into_the_process_was_not_succes___Resolver_Loader__Coded_by_Lakon_n
call fcn.140002170
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000231e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.____Resolver___https:__resolverfoundhitbox.ru__Injection_into_the_process_was_succes___Resolver_Loader__Coded_by_Lakon_n
call fcn.140002170
lea rcx, str.PAUSE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140002360
add rsp, 0x160
pop rbx
ret

Function at 0x140002c34
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002c7e
mov ecx, GetCurrentThreadId
cmp word [rax], cx
jne 0x140002c7e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002c7e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002c7e
cmp dword [rcx + 0x84], 0xe
jbe 0x140002c7e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002c80
xor al, al
add rsp, 0x28
ret
Function at 0x10000f568
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x4c0
mov rax, qword [0x100081100]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
lea rdx, [0x10000b040]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
and qword [rsp + 0x48], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x68], 0
lea rax, [rsp + 0x70]
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov edx, 0x20019
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x30
mov dword [rsp + 0x58], 0x40
call qword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jns 0x10000f5e1
xor al, al
jmp 0x10000f674
lea rdx, [0x10000b0a8]
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x30]
lea r11, [rsp + 0x38]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x90]
lea rdx, [rsp + 0x80]
mov r8d, 2
mov dword [rsp + 0x20], 0x210
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x10000f5da
lea rdx, [0x10000b0d0]
lea rcx, [rsp + 0x9c]
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
jne 0x10000f672
lea rdx, [0x10000b0d8]
lea rcx, [rsp + 0x9c]
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
je 0x10000f5da
mov al, 1
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.10007cf60
add rsp, 0x4c0
pop rbx
ret
Function at 0x10001099c
Capabilities:
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0xa0
movzx eax, word [rcx + 0x18]
mov dword [rsp + 0x70], 0x30
and qword [r11 - 0x30], 0
and qword [r11 - 0x18], 0
and qword [r11 - 0x10], 0
add ax, ax
mov word [rsp + 0x50], ax
mov word [rsp + 0x52], ax
mov rax, qword [rcx + 0x10]
mov qword [r11 - 0x50], rax
lea rax, [r11 - 0x58]
neg r8b
mov qword [r11 - 0x28], rax
sbb eax, eax
mov rdi, r9
not eax
lea r8, [r11 - 0x38]
lea r9, [r11 - 0x48]
and eax, 2
mov edx, 0x100003
mov rcx, rdi
or eax, 1
mov dword [rsp + 0x28], 0x20
mov dword [r11 - 0x20], 0x40
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtOpenFile]
mov ebx, eax
test eax, eax
jns 0x100010a58
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x100010b03
mov edx, 0x7d7
mov eax, 0xbd5
cmp ebx, 0xc0000022
cmove edx, eax
lea r8, [0x1000015a8]
call fcn.1000187e8
jmp 0x100010b03
mov rcx, qword [rdi]
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x60]
mov r9d, 4
mov dword [rsp + 0x20], 0x11
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ebx, eax
test eax, eax
jns 0x100010ab9
cmp eax, 0x80000010
je 0x100010aa5
cmp eax, 0x80000011
je 0x100010a9e
cmp eax, 0xc00000a3
je 0x100010a9e
mov edx, 0x7d6
jmp 0x100010aaa
mov edx, 0x830
jmp 0x100010aaa
mov edx, 0xbe7
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x100010b03
jmp 0x100010a47
and dword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
and dword [rsp + 0x38], 0
mov ecx, dword [rsp + 0xc0]
and qword [rsp + 0x30], 0
mov rax, qword [rsp + 0xd0]
mov dword [rax], ecx
mov rcx, qword [rdi]
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x90083
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtFsControlFile]
mov eax, ebx
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret

Function at 0x100011544
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x100081100]
xor rax, rsp
mov qword [rsp + 0x70], rax
and dword [rsp + 0x64], 0
mov rbx, rcx
mov ecx, 0x800
mov dword [rsp + 0x60], 6
call fcn.10001ba38
mov rdi, rax
test rax, rax
jne 0x100011589
mov eax, 0xc000009a
jmp 0x100011600
xor edx, edx
mov r8d, 0x800
mov rcx, rax
call sub.ntdll.dll_memset
mov rcx, qword [rbx + 0x40]
mov dword [rsp + 0x48], 0x800
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 0xc
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x2d1400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
js 0x1000115e7
mov eax, dword [rdi + 0x14]
test eax, eax
jne 0x1000115f0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, rdi
mov dword [rbx + 0x170], eax
call fcn.10001bb74
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.10007cf60
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
Function at 0x100011ff8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [rcx]
mov r13, r9
mov edi, r8d
mov rbp, rcx
call qword [rax + 0x10]
mov rbx, qword [rsp + 0xa8]
movsxd r15, eax
mov eax, 0x20000
xor edx, edx
add rdi, rbx
div r15d
mov esi, eax
jmp 0x1000120d5
mov edx, esi
mov rcx, r15
add rdx, rbx
imul rcx, rbx
cmp rdx, rdi
jle 0x100012054
mov esi, edi
sub esi, ebx
and qword [rsp + 0x40], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xa0], rcx
mov rcx, qword [rbp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov r12d, esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
imul r12d, r15d
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtReadFile]
mov r9d, eax
mov dword [rbp + 0x58], eax
cmp eax, 0xc0000017
jne 0x1000120b2
shr esi, 1
mov eax, esi
sub rbx, rax
jmp 0x1000120d0
mov rdx, qword [rsp + 0x58]
mov r8d, 0xc0000000
and eax, r8d
cmp eax, r8d
je 0x1000120f8
mov eax, r12d
cmp rdx, rax
jne 0x1000120f8
add r13, rax
mov eax, esi
add rbx, rax
cmp rbx, rdi
jl 0x10001203f
mov al, 1
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbp + 0x190]
test rcx, rcx
je 0x100012152
mov eax, r9d
mov dword [rsp + 0x28], r12d
and eax, r8d
cmp eax, r8d
jne 0x100012134
mov rax, qword [rsp + 0xa0]
lea r8, [0x10000b228]
mov edx, 0x69a4
mov qword [rsp + 0x20], rax
call fcn.100018908
jmp 0x100012152
mov r9, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rdx
lea r8, [0x10000b238]
mov edx, 0x69a5
call fcn.100018908
cmp byte [rbp + 0x198], 0
je 0x10001218d
mov ecx, dword [rbp + 0x58]
cmp ecx, 0xc000000e
je 0x100012186
cmp ecx, 0xc0000013
je 0x100012186
cmp ecx, 0xc0000012
je 0x100012186
cmp ecx, 0xc0000098
je 0x100012186
cmp ecx, 0xc00000c0
jne 0x10001218d
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
xor al, al
jmp 0x1000120e0
Function at 0x1000125f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x510
mov rax, qword [0x100081100]
xor rax, rsp
mov qword [rsp + 0x500], rax
xor edi, edi
mov dword [rsp + 0x68], 0x30
mov eax, 0x208
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x80], edi
mov word [rsp + 0x52], ax
lea rax, [r11 - 0x228]
mov rbx, rcx
mov byte [rcx + 0x15b], dil
mov qword [rsp + 0x58], rax
lea rax, [0x10000ba00]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x50]
lea rdx, [0x10000ba20]
mov qword [rsp + 0x78], rax
mov qword [r11 - 0x490], rdi
mov dword [rsp + 0x90], edi
mov qword [r11 - 0x480], rdi
mov dword [rsp + 0xa0], edi
mov qword [r11 - 0x470], rdi
mov qword [r11 - 0x468], rdi
mov dword [rsp + 0xb8], edi
mov qword [r11 - 0x458], rdi
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0xc8], edi
mov word [rsp + 0x50], di
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntdll.dll_RtlQueryRegistryValues]
cmp eax, edi
mov dword [rbx + 0x58], eax
jl 0x100012766
mov rcx, qword [rbx + 0x40]
mov dword [rsp + 0x48], 0x20c
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edi
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x4d0008
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, edi
mov dword [rbx + 0x58], eax
jl 0x100012766
mov eax, 0x104
cmp word [rsp + 0xe0], ax
jae 0x10001275f
movzx eax, word [rsp + 0xe0]
lea rdx, [rsp + 0xe2]
lea rcx, [rsp + 0x2f0]
shr rax, 1
mov word [rsp + rax*2 + 0xe2], di
call qword [sym.imp.ntdll.dll__wcsicmp]
cmp eax, edi
jne 0x10001275b
mov byte [rbx + 0x15b], 1
mov al, 1
jmp 0x100012768
mov dword [rbx + 0x58], 0xc0000023
xor al, al
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.10007cf60
mov rbx, qword [rsp + 0x528]
add rsp, 0x510
pop rdi
ret

Function at 0x10001b0c8
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x70
mov rdi, r8
mov esi, edx
lea r8, [rax - 0x38]
lea rdx, [rax - 0x48]
mov r9d, 0x28
mov rbx, rcx
mov dword [rax - 0x58], 4
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jns 0x10001b103
xor al, al
jmp 0x10001b133
mov eax, dword [rsp + 0x60]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r9d, 0x28
mov rcx, rbx
mov dword [rsp + 0x60], esi
mov dword [rdi], eax
mov dword [rsp + 0x20], 4
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
setns al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x10001b14c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xc0
mov ebx, r8d
mov rdi, rdx
test r8d, r8d
jne 0x10001b16b
mov al, 1
jmp 0x10001b2a5
mov rax, qword [rcx + 0x10]
and dword [rsp + 0x28], 0
and qword [rsp + 0x98], 0
and qword [rsp + 0xb0], 0
and qword [rsp + 0xb8], 0
mov qword [rsp + 0x78], rax
movzx eax, word [rcx + 0x18]
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x90]
add ax, ax
lea rcx, [rsp + 0x60]
mov edx, 0x12019f
mov word [rsp + 0x70], ax
mov word [rsp + 0x72], ax
lea rax, [rsp + 0x70]
mov dword [rsp + 0x90], 0x30
mov dword [rsp + 0xa8], 0x40
mov dword [rsp + 0x20], 1
mov qword [rsp + 0xa0], rax
call qword [sym.imp.ntdll.dll_NtOpenFile]
cmp eax, 0xc000000f
je 0x10001b1fe
cmp eax, 0xc0000034
jne 0x10001b24c
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x40
mov dword [rsp + 0x38], 5
and dword [rsp + 0x30], 0
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x90]
lea rcx, [rsp + 0x60]
mov edx, 0x12019f
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
jns 0x10001b254
xor al, al
jmp 0x10001b2a5
and qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x60]
or qword [rsp + 0x68], 0xffffffffffffffff
lea rax, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], ebx
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
setns al
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret
Function at 0x10001b558
Capabilities:
Get storage device properties

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x100081100]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea rax, [0x10000b788]
mov rsi, rdx
mov rbp, rcx
mov qword [r11 - 0x68], rax
mov rax, qword [0x1000842b8]
mov rdi, r8
mov qword [r11 - 0x60], rax
and dword [rsp + 0x60], 0
and qword [r11 - 0x50], 0
and qword [r11 - 0x48], 0
xor eax, eax
lea rcx, [r11 - 0x68]
mov dword [r11 - 0x30], eax
mov dword [r11 - 0x2c], eax
and dword [r11 - 0x2c], eax
lea edx, [rax + 0x20]
xor r8d, r8d
mov dword [r11 - 0x28], eax
mov dword [r11 - 0x30], 1
call fcn.1000195cc
test rax, rax
je 0x10001b6c6
mov rbx, qword [rsp + 0x70]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], 0xc
lea rax, [rsp + 0x88]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov rcx, rbp
mov dword [rsp + 0x28], 0x2d1400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
js 0x10001b6c6
cmp dword [rbx], 0x20
jne 0x10001b6c6
cmp dword [rbx + 4], 0x20
jne 0x10001b6c6
cmp dword [rsp + 0x80], 0x20
jne 0x10001b6c6
test rsi, rsi
je 0x10001b686
cmp byte [rbx + 0x18], 0xe
lea rdx, [0x10000b840]
jae 0x10001b676
movzx eax, byte [rbx + 0x18]
lea rdx, [0x100083930]
mov rdx, qword [rdx + rax*8]
or r8d, 0xffffffff
mov rcx, rsi
call fcn.1000146e0
test al, al
je 0x10001b6c6
test rdi, rdi
je 0x10001b6b8
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x10]
test al, al
je 0x10001b6c6
mov rax, qword [rdi]
movzx r9d, word [rbx + 0x1c]
movzx r8d, word [rbx + 0x1a]
lea rdx, [0x10000b918]
mov rcx, rdi
call qword [rax + 0x20]
test al, al
je 0x10001b6c6
lea rcx, [rsp + 0x50]
call fcn.100019550
mov al, 1
jmp 0x10001b6d2
lea rcx, [rsp + 0x50]
call fcn.100019550
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.10007cf60
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x10001ba38
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rsi
sub rsp, 0x1b0
or dword [rax + 0x14], 0xffffffff
mov ebx, ecx
mov dword [rax + 0x10], 0xffffd8f0
mov esi, 1
jmp 0x10001ba6b
lea rdx, [rsp + 0x1c8]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtDelayExecution]
xor eax, eax
lock cmpxchg dword [0x1000845fc], esi
jne 0x10001ba5b
mov r8, qword [0x100081128]
cmp r8, 0xffffffffffffffff
jne 0x10001bb24
xor r9d, r9d
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x10001baaf
lock add dword [0x1000845fc], 0xffffffff
xor eax, eax
jmp 0x10001bb5d
xor r9d, r9d
lea rdx, [rsp + 0x60]
mov r8d, 0x148
lea ecx, [r9 + 2]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x10001baa0
mov eax, dword [rsp + 0x28]
mov r8d, dword [rsp + 0x8c]
mov rcx, qword [rsp + 0x48]
imul r8, rax
sub rcx, qword [rsp + 0x40]
mov rax, 0xfffffffffffffffe
cmp rcx, r8
cmovb r8, rcx
cmp r8, 0xffffffffffffffff
cmove r8, rax
cmp r8, 0x19000
ja 0x10001bb09
xor r8d, r8d
jmp 0x10001bb1d
movabs rax, 0xcccccccccccccccd
mul r8
shr rdx, 3
sub r8, rdx
mov qword [0x100081128], r8
cmp rbx, r8
ja 0x10001baa0
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
test rax, rax
je 0x10001bb55
sub qword [0x100081128], rbx
lock add dword [0x1000845fc], 0xffffffff
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1b0
pop rsi
ret

Function at 0x10001bb74
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
or dword [rax + 0x14], 0xffffffff
mov dword [rax + 0x10], 0xffffd8f0
mov rax, qword gs:[0x30]
mov rdi, rcx
mov rcx, qword [rax + 0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
mov r8, rdi
call qword [sym.imp.ntdll.dll_RtlSizeHeap]
mov esi, 1
mov rbx, rax
jmp 0x10001bbc5
lea rdx, [rsp + 0x38]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtDelayExecution]
xor eax, eax
lock cmpxchg dword [0x1000845fc], esi
jne 0x10001bbb8
mov rcx, qword [0x100081128]
cmp rcx, 0xffffffffffffffff
je 0x10001bbea
mov eax, ebx
add rcx, rax
mov qword [0x100081128], rcx
mov rax, qword gs:[0x30]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lock add dword [0x1000845fc], 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret