joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57bc20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57be66
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x88], rax
mov rsi, qword [rdi]
nop
mov rsi, qword [rsi + 8]
mov qword [rsp + 0x70], rsi
mov r8, qword [rax + 8]
mov r9, qword [rax]
cmp qword [rax + 0x10], rsi
jl 0x57bcbe
test r8, r8
je 0x57bcab
shl r8, 3
mov rax, r9
mov rbx, r8
call fcn.00465140
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0xa0]
mov rdx, qword [rax + 0x10]
cmp rdx, rsi
jb 0x57be5a
mov qword [rax + 8], rsi
jmp 0x57bd13
lea rax, [0x005edf60]
mov rbx, rsi
mov rcx, rbx
call fcn.00449bc0
mov rdx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x88]
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
cmp dword [0x0081ed80], 0
jne 0x57bcf3
mov qword [rdi], rax
jmp 0x57bcf8
call fcn.00464600
mov rax, rdi
mov rcx, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0xa0]
mov rdx, qword [rdi]
mov rsi, qword [rbx + 8]
mov r8, qword [rbx]
mov r9, qword [rbx + 0x10]
mov r10, qword [rdx + 8]
mov r11, qword [rdx]
mov rdx, qword [rdx + 0x10]
cmp r10, rsi
jne 0x57be47
mov r12, qword [rcx + 8]
mov r13, qword [rcx]
mov rcx, qword [rcx + 0x10]
cmp r10, r12
jne 0x57be47
mov rbx, qword [rax]
mov r15, qword [rax + 8]
mov rax, qword [rax + 0x10]
mov rdi, qword [rdi + 0x10]
mov qword [rsp], rbx
mov qword [rsp + 8], r15
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rdi
call fcn.0057cf60
xorps xmm15, xmm15
mov r14, qword [0x0081eb58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax]
mov rax, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x88]
mov rbx, qword [rdx + 8]
mov rsi, qword [rdx]
mov rdi, qword [rcx + 0x10]
mov r8, qword [rcx]
cmp rdi, rbx
jb 0x57be3c
xor edi, edi
xor r9d, r9d
nop
jmp 0x57be00
lea r10, [rdi + 1]
mov r11, qword [rsi + rdi*8]
sub r11, qword [r8 + rdi*8]
sub r11, r9
shr r11, 0x3f
mov rdi, r10
mov r9, r11
nop dword [rax + rax]
cmp rdi, rbx
jl 0x57bde2
mov rsi, rax
sub rax, r9
sbb rbx, rbx
sub r9, rsi
sbb rsi, rsi
nop
neg rbx
neg rsi
or rbx, rsi
xor rbx, 1
mov rax, rdx
call fcn.0057ad40
mov rax, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rcx, rbx
mov rdx, rdi
call fcn.00464b20
lea rax, [0x005edea0]
lea rbx, [0x006943e0]
call fcn.004357a0
mov rcx, rsi
nop dword [rax]
call fcn.00464b20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00462440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0057bc20
Function at 0x58d520
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58d6fc
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x80], rdi
mov r9, qword [rbx + 0x18]
mov r10, qword [r9]
mov r10, qword [r10 + 8]
mov r11, r10
shl r10, 6
sub r10, r11
sub r10, qword [r9 + 8]
lea r9, [r10 + 7]
sar r9, 0x3f
shr r9, 0x3d
lea r9, [r9 + r10]
lea r9, [r9 + 7]
sar r9, 3
cmp rsi, r9
jl 0x58d649
nop word [rax + rax]
cmp r8, r9
jb 0x58d6f0
mov rdx, r9
shl r9, 3
sub r9, r10
test r9, r9
jle 0x58d687
nop dword [rax]
test rdi, rdi
jne 0x58d5b0
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x58d643
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x50], rcx
nop
test rdx, rdx
ja 0x58d5d1
lea rax, [rsp + 0x28]
xor esi, esi
xor r8d, r8d
jmp 0x58d60a
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x40], rdx
lea rax, [rsp + 0x28]
mov rbx, rdx
xor ecx, ecx
mov rdi, rbx
lea rsi, [0x005ee060]
call fcn.00449ca0
mov rdx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x80]
mov rsi, rcx
mov r8, rbx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x48], rax
mov rbx, rdi
mov rcx, rdx
nop
call fcn.00465440
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x70]
mov r9, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
lea r8, [rdx - 1]
jmp 0x58d692
mov rdx, qword [rbx + 0x18]
mov rax, rcx
mov rbx, rdi
mov rcx, rsi
mov rdi, r8
mov rsi, rdx
nop dword [rax]
call fcn.0057a880
test rbx, rbx
jne 0x58d674
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rax, [0x005edea0]
lea rbx, [0x00694350]
call fcn.004357a0
mov rsi, rdx
jmp 0x58d649
dec r8
mov rcx, rdi
test r8, r8
jl 0x58d6e3
cmp r9, 8
sbb r10d, r10d
movzx r11d, byte [rax + r8]
mov rdi, rcx
mov rcx, r9
shr r11b, cl
and r10d, r11d
mov byte [rax + r8], r10b
test r8, r8
jle 0x58d68c
movzx r11d, byte [r8 + rax - 1]
lea r12, [rcx - 8]
neg r12
test r12, r12
jl 0x58d6eb
cmp r12, 0x20
sbb r13d, r13d
mov rcx, r12
shl r11d, cl
and r11d, r13d
or r10d, r11d
mov byte [rax + r8], r10b
jmp 0x58d68c
mov r8, rsi
mov rdi, rax
jmp 0x58d687
call fcn.00434400
mov rcx, r9
mov rdx, r8
call fcn.00464b20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00462440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax]
jmp fcn.0058d520
Function at 0x5905a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5907b7
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x5906ce
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x5907a9
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x590642
mov rax, rdx
mov rcx, rsi
call fcn.00465440
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x5906aa
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00590a40
xorps xmm15, xmm15
mov r14, qword [0x0081eb58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x5907a1
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x5906d4
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x590751
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.00590a40
xorps xmm15, xmm15
mov r14, qword [0x0081eb58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x59078f
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x59078b
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.00465440
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
mov rax, rsi
call fcn.00464b60
mov rax, rdx
mov ecx, 0x40
call fcn.00464b60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00462440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005905a0
Function at 0x5999e0
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x599c5c
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
movzx ecx, byte [rbx + 0x1f]
mov qword [rsp + 0x98], rcx
movzx edx, byte [rbx + 0x1e]
mov qword [rsp + 0x90], rdx
movzx esi, byte [rbx + 0x1d]
mov qword [rsp + 0x88], rsi
movzx edi, byte [rbx + 0x1c]
mov qword [rsp + 0x80], rdi
movzx r8d, byte [rbx + 0x1b]
mov qword [rsp + 0x78], r8
movzx r9d, byte [rbx + 0x1a]
mov qword [rsp + 0x70], r9
movzx r10d, byte [rbx + 0x19]
mov qword [rsp + 0x68], r10
movzx r11d, byte [rbx + 0x18]
mov qword [rsp + 0x60], r11
movzx r12d, byte [rbx + 0x17]
mov qword [rsp + 0x58], r12
movzx r13d, byte [rbx + 0x16]
mov qword [rsp + 0x50], r13
movzx r15d, byte [rbx + 0x15]
mov qword [rsp + 0x48], r15
movzx r11d, byte [rbx + 0x14]
mov qword [rsp + 0x40], r11
movzx r10d, byte [rbx + 0x13]
mov qword [rsp + 0x38], r10
movzx r9d, byte [rbx + 0x12]
mov qword [rsp + 0x30], r9
movzx r8d, byte [rbx + 0x11]
mov qword [rsp + 0x28], r8
movzx edi, byte [rbx + 0x10]
mov qword [rsp + 0x20], rdi
movzx esi, byte [rbx + 0xf]
movzx edx, byte [rbx + 0xe]
movzx ecx, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
movzx r8d, byte [rbx + 0xb]
mov qword [rsp + 0x18], r8
movzx r9d, byte [rbx + 0xa]
mov qword [rsp + 0x10], r9
movzx r10d, byte [rbx + 9]
mov qword [rsp + 8], r10
movzx r11d, byte [rbx + 8]
mov qword [rsp], r11
movzx r15d, byte [rbx + 7]
shl r15, 0x38
movzx r13d, byte [rbx + 6]
shl r13, 0x30
movzx r12d, byte [rbx + 5]
shl r12, 0x28
movzx r11d, byte [rbx + 4]
shl r11, 0x20
movzx r10d, byte [rbx + 3]
shl r10, 0x18
movzx r9d, byte [rbx + 2]
shl r9, 0x10
movzx r8d, byte [rbx + 1]
shl r8, 8
movzx ebx, byte [rbx]
add rbx, r8
add rbx, r9
add rbx, r10
add rbx, r11
add rbx, r12
add rbx, r13
add rbx, r15
mov qword [rax], rbx
shl rsi, 0x38
shl rdx, 0x30
shl rcx, 0x28
shl rdi, 0x20
mov rbx, qword [rsp + 0x18]
shl rbx, 0x18
mov r8, qword [rsp + 0x10]
shl r8, 0x10
mov r9, qword [rsp + 8]
shl r9, 8
mov r10, qword [rsp]
add r9, r10
add r8, r9
add rbx, r8
add rbx, rdi
add rcx, rbx
add rcx, rdx
add rcx, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x58]
shl rcx, 0x38
mov rdx, qword [rsp + 0x50]
shl rdx, 0x30
mov rbx, qword [rsp + 0x48]
shl rbx, 0x28
mov rsi, qword [rsp + 0x40]
shl rsi, 0x20
mov rdi, qword [rsp + 0x38]
shl rdi, 0x18
mov r8, qword [rsp + 0x30]
shl r8, 0x10
mov r9, qword [rsp + 0x28]
shl r9, 8
mov r10, qword [rsp + 0x20]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x98]
shl rcx, 0x38
mov rdx, qword [rsp + 0x90]
shl rdx, 0x30
mov rbx, qword [rsp + 0x88]
shl rbx, 0x28
mov rsi, qword [rsp + 0x80]
shl rsi, 0x20
mov rdi, qword [rsp + 0x78]
shl rdi, 0x18
mov r8, qword [rsp + 0x70]
shl r8, 0x10
mov r9, qword [rsp + 0x68]
shl r9, 8
mov r10, qword [rsp + 0x60]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x18], rcx
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00462440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005999e0
Function at 0x5d2920
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x5d2b58
sub rsp, 0xa0
mov qword [rsp + 0x98], rbp
lea rbp, [rsp + 0x98]
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xa8], rax
test rdi, rdi
je 0x5d2979
xor ecx, ecx
xor edx, edx
jmp 0x5d29a0
mov rdx, qword [rax + 0x40]
mov rsi, qword [rdx]
mov rdi, rax
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
call rsi
mov rdx, rdi
mov rdi, rax
mov rsi, rbx
mov rax, qword [rsp + 0xa8]
nop
test rcx, rcx
jne 0x5d2ae1
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x60], rdi
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
mov rdx, qword [rax + 0x18]
mov qword [rsp + 0x50], rdx
mov rbx, qword [rax + 0x20]
mov qword [rsp + 0x68], rbx
mov rsi, qword [rax + 0x28]
mov qword [rsp + 0x48], rsi
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403300
xorps xmm15, xmm15
mov r14, qword [0x0081eb58]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5d2a3d
xor eax, eax
lea rbx, [0x00692eb8]
mov ecx, 1
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x50]
lea r8, [0x0062c54a]
mov r9d, 2
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x48]
call fcn.0044dc60
jmp 0x5d2a65
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x00692d70]
mov esi, 1
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x48]
nop
call fcn.0044db80
mov rdx, qword [rsp + 0xa8]
mov rsi, qword [rdx + 8]
mov rcx, rax
mov rdi, rbx
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x80]
call fcn.005a97a0
test rsi, rsi
jne 0x5d2aca
call fcn.005a94c0
cmp dword [0x0081ed80], 0
jne 0x5d2aa9
mov rcx, qword [rsp + 0xa8]
mov qword [rcx], rax
jmp 0x5d2ab6
mov rdi, qword [rsp + 0xa8]
call fcn.00464600
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov rax, rsi
mov rbx, r8
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
nop
ret
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x78], rdx
movups xmmword [rsp + 0x88], xmm15
mov rcx, qword [rax + 0x10]
mov rbx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.0040ae20
lea rcx, [0x005edea0]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x78]
lea rcx, [0x00638a6d]
mov edi, 0x26
lea rsi, [rsp + 0x88]
mov r8d, 1
mov r9, r8
call fcn.0051ac60
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00462440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.005d2920
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
push rsi
mov rsi, qword [rdx + 0x50]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
push rax
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
pop r8
add rax, rdx
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x1416bdeaf
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffe9532e2e
call fcn.141790da0
add byte [rbx + 0x45], cl
or eax, 0x454b0000
push rdx
xor r14, qword [rdx]
insb byte [rdi], dx
insb byte [rdi], dx
add byte [rax], dh
jae 0x1416bdeb6
invalid
Function at 0x122b0
Capabilities:
Create device object

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x50
and qword [r11 - 0x10], 0
and qword [r11 - 0x18], 0
mov rax, rdx
mov rsi, r9
mov rbx, r8
mov rdi, rcx
lea r9, [r11 - 0x18]
lea r8, [r11 - 0x10]
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
test eax, eax
jns 0x122fa
mov eax, 0xc0000369
jmp 0x123b5
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x12310
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
and qword [rsp + 0x48], 0
mov qword [rsp + 0x30], rbx
mov r9d, 0x22
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov byte [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
js 0x123b5
mov rdx, qword [rsp + 0x40]
test byte [rdx + 0x30], 4
je 0x1234e
mov rax, qword [rbx]
or dword [rax + 0x30], 4
mov rdx, qword [rsp + 0x40]
test byte [rdx + 0x30], 0x10
je 0x12360
mov rax, qword [rbx]
or dword [rax + 0x30], 0x10
mov rdx, qword [rsp + 0x40]
bt dword [rdx + 0x30], 0xd
jae 0x12374
mov rax, qword [rbx]
bts dword [rax + 0x30], 0xd
mov rdx, qword [rsp + 0x40]
bt dword [rdx + 0x34], 8
jae 0x12388
mov rax, qword [rbx]
bts dword [rax + 0x34], 8
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStack]
mov qword [rsi], rax
test rax, rax
jne 0x123ab
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
and qword [rbx], 0
jmp 0x122f0
mov rax, qword [rbx]
btr dword [rax + 0x30], 7
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x13658
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
xor edi, edi
mov rbp, r8
mov esi, edx
mov rbx, rcx
test rcx, rcx
je 0x1377b
cmp dword [rcx], 2
jne 0x1377b
mov rcx, qword [rcx + 0x18]
call fcn.000153d0
test rax, rax
je 0x1377b
cmp dword [rax], 1
jne 0x1377b
lea rcx, [rax + 0x47]
test rcx, rcx
je 0x1377b
cmp qword [rcx], rdi
je 0x1377b
mov rdx, qword [rbx + 4]
and dword [rsp + 0x68], edi
and qword [rsp + 0x60], rdi
lea rax, [rsp + 0x60]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
call fcn.000142ec
mov edi, eax
cmp eax, 0xc0000016
jne 0x1377b
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x1377b
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x1377b
test byte [rbx + 0xa], 5
je 0x13712
mov rax, qword [rbx + 0x18]
jmp 0x13731
xor r9d, r9d
xor edx, edx
mov rcx, rbx
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x10
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
test rax, rax
je 0x1377b
mov ecx, esi
sub ecx, dword [rsp + 0x68]
cmp dword [rbx + 0x28], ecx
jb 0x1377b
mov edx, dword [rsp + 0x68]
mov r8d, ecx
mov rcx, rax
add rdx, rbp
call fcn.000550e0
mov r11, qword [rsp + 0x60]
xor edx, edx
and dword [r11 + 0x30], 0
sub esi, dword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov ecx, esi
xor edi, edi
mov qword [rax + 0x38], rcx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x164b4
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
cmp edx, r11d
jbe 0x164df
mov r8, rcx
mov r9, rcx
mov r10d, edx
movzx eax, word [r9]
add r9, 4
xor ax, 0xb
mov word [r8], ax
add r8, 2
sub r10, 1
jne 0x164c5
mov eax, edx
mov word [rcx + rax*2], r11w
ret
Function at 0x1790c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, qword [rsp + 0x80]
mov ebp, 0x104
mov edi, r9d
mov rsi, r8
mov rax, rcx
cmp edx, ebp
jae 0x17948
mov dword [rbx + 0x104], edx
mov r8d, edx
mov rdx, rcx
jmp 0x17954
mov dword [rbx + 0x104], ebp
mov rdx, rax
mov r8, rbp
mov rcx, rbx
call fcn.000550e0
lea rcx, [rbx + 0x108]
mov rdx, rsi
cmp edi, ebp
jae 0x17975
mov dword [rbx + 0x20c], edi
mov r8, rdi
jmp 0x1797e
mov dword [rbx + 0x20c], ebp
mov r8, rbp
call fcn.000550e0
lea rax, [0x000177c8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
jns 0x179bc
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1915c
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
and dword [rax + 0x18], 0
xor r9d, r9d
mov rdi, rdx
lea rax, [rax + 0x18]
lea edx, [r9 + 2]
xor r8d, r8d
mov rsi, rcx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
mov ebx, eax
test eax, eax
jns 0x191a3
cmp eax, 0x80000005
je 0x191a3
cmp eax, 0xc0000023
jne 0x19212
mov eax, 0xc0000034
cmp ebx, eax
je 0x19212
mov eax, dword [rsp + 0x50]
test eax, eax
jne 0x191b8
mov eax, ebx
jmp 0x19212
mov rdx, rax
xor ecx, ecx
mov r8d, 0x72656778
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rdi], rax
test rax, rax
je 0x191b4
mov r9d, dword [rsp + 0x50]
lea rcx, [rsp + 0x50]
mov r8, rax
mov qword [rsp + 0x20], rcx
mov rcx, rsi
mov edx, 2
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
mov ebx, eax
test eax, eax
jns 0x19210
mov rcx, qword [rdi]
test rcx, rcx
je 0x191b4
mov edx, 0x72656778
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and qword [rdi], 0
jmp 0x191b4
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret