joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400095a0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, qword [0x14003d858]
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test rbx, rbx
je 0x1400095d4
cmp dword [0x14003d860], 0
jne 0x140009672
xor edx, edx
mov dword [rsp + 0x58], 0
lea r9, [rsp + 0x58]
xor r8d, r8d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov edx, dword [rsp + 0x58]
xor ecx, ecx
mov r8d, 0x6f734d64
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
jne 0x140009627
cmp byte [0x14003dcf0], al
je 0x1400096bf
mov edx, dword [rsp + 0x58]
lea rcx, [0x140012800]
call fcn.14000ca70
jmp 0x140009677
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, rdi
mov ecx, 0xb
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
xor edx, edx
mov rcx, rdi
and eax, 0xc0000000
cmp eax, 0xc0000000
jne 0x140009658
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140009677
mov rbx, qword [rdi + 0x18]
mov eax, dword [rdi + 0x20]
mov qword [0x14003d858], rbx
mov dword [0x14003d860], eax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test rbx, rbx
jne 0x140009693
cmp byte [0x14003dcf0], 0
je 0x1400096bf
lea rcx, [0x1400128c0]
mov rdx, rsi
call fcn.14000ca70
xor al, al
jmp 0x1400096c5
mov r9, rbp
mov r8, r14
mov rdx, rsi
mov rcx, rbx
call fcn.140009280
test al, al
jne 0x1400096c3
cmp byte [0x14003dcf0], al
je 0x1400096bf
lea rcx, [0x1400128f0]
mov rdx, rsi
call fcn.14000ca70
xor al, al
jmp 0x1400096c5
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140009820
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rdi, dword [rcx + 0x3c]
mov rbx, rcx
call fcn.140007a00
test al, al
jne 0x14000985b
cmp byte [0x14003dcf0], al
je 0x1400098a5
lea rcx, [0x140012a60]
call fcn.14000ca70
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0x5a4d
cmp word [rbx], ax
je 0x140009887
cmp byte [0x14003dcf0], 0
je 0x1400098a5
lea rcx, [0x140012a90]
call fcn.14000ca70
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp dword [rdi + rbx], 0x4550
je 0x1400098b2
cmp byte [0x14003dcf0], 0
je 0x1400098a5
lea rcx, [0x140012ac0]
call fcn.14000ca70
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x140009e50
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov ecx, ecx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140009e7b
xor al, al
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rsp + 0x40]
mov word [rsp + 0x30], 0
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ObSetHandleAttributes]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwClose]
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, 1
add rsp, 0x20
pop rbx
ret

Function at 0x140009ec0
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
test ecx, ecx
je 0x140009f03
mov ecx, ebx
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edx, eax
and edx, 0xc0000000
cmp edx, 0xc0000000
jne 0x140009f0b
cmp byte [0x14003dcf0], 0
je 0x140009f03
mov r8d, eax
lea rcx, [0x140012fb0]
mov edx, ebx
call fcn.14000ca70
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x14000a3c0
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14003cf48]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rdx
mov edi, ecx
call fcn.140009ec0
test rax, rax
jne 0x14000a408
cmp byte [0x14003dcf0], al
je 0x14000a401
mov edx, edi
lea rcx, [0x140012cd0]
call fcn.14000ca70
xor al, al
jmp 0x14000a4a2
xorps xmm0, xmm0
lea rdx, [rsp + 0x40]
mov rcx, rax
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
xor eax, eax
lea r8, [rsp + 0x38]
mov r9d, 8
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], eax
mov rcx, 0xffffffffffffffff
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x12]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov ecx, eax
mov edi, eax
and ecx, 0xc0000000
cmp ecx, 0xc0000000
jne 0x14000a482
cmp byte [0x14003dcf0], 0
je 0x14000a482
mov edx, eax
lea rcx, [0x140012d10]
call fcn.14000ca70
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test rbx, rbx
je 0x14000a49d
cmp qword [rsp + 0x38], 0
setne al
mov byte [rbx], al
test edi, edi
setns al
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14000ed70
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x14000abb0
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14003cf48]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, r8
mov byte [rsp + 0x28], 0
xor ebx, ebx
lea r9, [0x140013350]
mov r8d, 0x100
mov dword [rsp + 0x20], ebx
mov ebp, ecx
call fcn.140008840
mov rdi, rax
test rax, rax
jne 0x14000ac11
cmp byte [0x14003dcf0], bl
je 0x14000accd
lea rcx, [0x140013360]
jmp 0x14000acc8
mov byte [rsp + 0x28], bl
lea r9, [0x1400133a0]
mov r8d, 0x16
mov dword [rsp + 0x20], ebx
mov rdx, rdi
mov ecx, ebp
call fcn.140008840
test rax, rax
mov ecx, ebp
setne r15b
call fcn.140009ec0
test rax, rax
je 0x14000acb8
lea rdx, [rsp + 0x30]
mov rcx, rax
xor sil, sil
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000ad2c
cmp dword [rdi], 1
jne 0x14000ac8c
mov sil, 1
test r15b, r15b
je 0x14000ac8c
mov edx, dword [rdi + 4]
mov eax, edx
and eax, 0xc0000000
cmp eax, 0xc0000000
je 0x14000ad15
test r14, r14
jne 0x14000acf0
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov bl, 1
test sil, sil
jne 0x14000ad4e
mov ecx, 0xa
call fcn.14000cde0
mov ecx, ebp
call fcn.140009ec0
test rax, rax
jne 0x14000ac43
cmp byte [0x14003dcf0], 0
je 0x14000accd
lea rcx, [0x1400133d0]
call fcn.14000ca70
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000ed70
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rdi + 8]
lea rcx, [rsp + 0x30]
mov qword [r14], rax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov ecx, 0x64
movzx ebx, sil
call fcn.14000cde0
movzx eax, bl
jmp 0x14000accf
cmp byte [0x14003dcf0], 0
je 0x14000ad41
lea rcx, [0x140013440]
call fcn.14000ca70
jmp 0x14000ad41
cmp byte [0x14003dcf0], sil
je 0x14000ad41
lea rcx, [0x140013410]
call fcn.14000ca70
xor bl, bl
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov ecx, 0x64
call fcn.14000cde0
movzx eax, bl
jmp 0x14000accf
Function at 0x14000ad60
Capabilities:
Attach user process memory

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x14003cf48]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x100]
mov r13d, r9d
mov qword [rsp + 0x48], rax
mov r12d, r8d
mov rdi, rdx
mov ebx, ecx
call fcn.140009ec0
test rax, rax
jne 0x14000adc6
cmp byte [0x14003dcf0], al
je 0x14000aee4
lea rcx, [0x140013890]
call fcn.14000ca70
xor al, al
jmp 0x14000aff1
test rdi, rdi
jne 0x14000adee
cmp byte [0x14003dcf0], dil
je 0x14000aee4
mov edx, r12d
lea rcx, [0x1400138d0]
call fcn.14000ca70
xor al, al
jmp 0x14000aff1
lea rdx, [0x1400129b0]
mov rcx, rdi
call sub.ntoskrnl.exe_wcsstr
test rax, rax
je 0x14000ae06
add rdi, 8
mov ecx, ebx
call fcn.140009ec0
mov r14, rax
test rax, rax
jne 0x14000ae2d
cmp byte [0x14003dcf0], al
je 0x14000aee4
lea rcx, [0x1400136d0]
jmp 0x14000aeca
lea rdx, [rsp + 0x40]
mov ecx, ebx
call fcn.14000a3c0
test al, al
jne 0x14000ae59
cmp byte [0x14003dcf0], al
je 0x14000aee4
mov edx, ebx
lea rcx, [0x140013710]
call fcn.14000ca70
jmp 0x14000aecf
cmp byte [rsp + 0x40], 0
lea r8, [0x140013760]
lea rdx, [0x1400102c0]
mov ecx, ebx
sete r9b
call fcn.14000c450
mov r15, rax
test rax, rax
jne 0x14000ae90
cmp byte [0x14003dcf0], al
je 0x14000aee4
lea rcx, [0x140013780]
jmp 0x14000aeca
mov r9d, 0x1000
mov qword [rsp + 0x28], 0
mov r8d, r9d
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov ecx, ebx
call fcn.140005ef0
mov rsi, rax
test rax, rax
jne 0x14000aeeb
cmp byte [0x14003dcf0], al
je 0x14000aee4
lea rcx, [0x1400137c0]
call fcn.14000ca70
cmp byte [0x14003dcf0], 0
je 0x14000aee4
lea rcx, [0x140013920]
call fcn.14000ca70
xor al, al
jmp 0x14000aff1
mov edx, 0x1000
mov qword [rsp + 0x98], rbp
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbp, rax
test rax, rax
jne 0x14000af25
cmp byte [0x14003dcf0], al
je 0x14000afa1
lea rcx, [0x140013810]
call fcn.14000ca70
jmp 0x14000afa1
cmp byte [rsp + 0x40], 0
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
mov r8, rsi
sete r9b
mov dword [rsp + 0x28], 0x1000
mov rdx, r15
mov qword [rsp + 0x20], rbp
mov rcx, rdi
call fcn.14000b1d0
test al, al
jne 0x14000af6d
cmp byte [0x14003dcf0], al
je 0x14000af96
lea rcx, [0x140013850]
call fcn.14000ca70
jmp 0x14000af96
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r8d, dword [rsp + 0x44]
mov rdx, rbp
mov rcx, rsi
call fcn.14000ff00
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [rsp + 0x48]
mov r9d, r13d
mov r8d, r12d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov ecx, ebx
mov dil, 1
call fcn.14000b020
mov rbp, qword [rsp + 0x98]
test al, al
jne 0x14000afe3
cmp byte [0x14003dcf0], al
je 0x14000afde
lea rcx, [0x140013960]
call fcn.14000ca70
xor dil, dil
jmp 0x14000afed
mov rdx, rsi
mov ecx, ebx
call fcn.140006000
movzx eax, dil
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000ed70
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000b490
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
mov rbx, rdx
mov edi, r9d
mov rdx, rcx
mov rsi, r8
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x60], 0x30
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
xor ebx, ebx
mov dword [rsp + 0x78], 0x40
lea r8, [rsp + 0x60]
mov qword [rsp + 0x68], rbx
mov edx, 0xf003f
lea rcx, [rsp + 0x38]
movdqu xmmword [rsp + 0x80], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
and eax, 0xc0000000
cmp eax, 0xc0000000
je 0x14000b5ad
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r8d, [rbx + 2]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000034
je 0x14000b5a2
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14000b5a2
mov edx, eax
lea ecx, [rbx + 1]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rcx, qword [rsp + 0x38]
mov rbx, rax
test rax, rax
je 0x14000b5a7
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
mov eax, dword [rsp + 0x30]
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
and eax, 0xc0000000
cmp eax, 0xc0000000
jne 0x14000b5c4
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor al, al
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov eax, dword [rbx + 8]
cmp eax, edi
ja 0x14000b597
mov r8d, eax
lea rdx, [rbx + 0xc]
mov rcx, rsi
call fcn.14000ff00
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, 1
jmp 0x14000b5af

Function at 0x14000bd30
Capabilities:
Encode data using xor

Disassembly:
mov r9d, edx
mov r8, rcx
test edx, edx
je 0x14000bd61
nop word [rax + rax]
movzx eax, byte [r8]
lea r8, [r8 + 1]
movzx ecx, dl
dec edx
and cl, 3
ror al, cl
sub cl, 0x60
xor al, cl
mov byte [r8 - 1], al
sub r9, 1
jne 0x14000bd40
mov al, 1
ret
Function at 0x14000ca70
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x3b8
mov rax, qword [0x14003cf48]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
mov word [rsp + 0x100], ax
lea rcx, [rsp + 0x80]
call fcn.14000c9e0
movups xmm1, xmmword [rax]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rcx, xmm0
mov rax, rcx
shr rax, 0x10
movsx r11d, ax
movsx ebx, cx
movq r8, xmm1
mov rax, r8
shr rax, 0x30
movsx r10d, ax
mov rax, r8
shr rax, 0x20
movsx edx, ax
mov rax, r8
shr rax, 0x10
movsx ecx, ax
movsx r9d, r8w
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
lea r8, [0x1400140a0]
mov edx, 0x31
lea rcx, [rsp + 0xd0]
call sub.ntoskrnl.exe_sprintf_s
xor edx, edx
mov r8d, 0x12c
lea rcx, [rsp + 0x270]
call fcn.1400101c0
lea r8, [rsp + 0x3d8]
mov rdx, qword [rsp + 0x3d0]
lea rcx, [rsp + 0x270]
call sub.ntoskrnl.exe_vsprintf
xor edi, edi
mov qword [rsp + 0x80], rdi
xor edx, edx
mov r8d, 0x15e
lea rcx, [rsp + 0x110]
call fcn.1400101c0
lea r8, [rsp + 0xd0]
mov edx, 0x15e
lea rcx, [rsp + 0x110]
call sub.ntoskrnl.exe_strcat_s
lea r8, [rsp + 0x270]
mov edx, 0x15e
lea rcx, [rsp + 0x110]
call sub.ntoskrnl.exe_strcat_s
lea rax, [rsp + 0x110]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], dil
jne 0x14000cbe0
inc ebx
lea rcx, [rsp + 0x110]
call sub.ntoskrnl.exe_DbgPrint
mov rax, cr8
cmp al, 2
jb 0x14000cc07
xor al, al
jmp 0x14000cd1c
mov dword [rsp + 0x70], 0x280026
lea rax, [0x1400140c0]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0xa0], 0x30
mov qword [rsp + 0xa8], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], 0x200
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xc0], xmm0
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], 0x62
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x90]
lea r8, [rsp + 0xa0]
mov edx, 0x100004
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
and eax, 0xc0000000
cmp eax, 0xc0000000
jne 0x14000ccb0
xor al, al
jmp 0x14000cd1c
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x110]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
and eax, 0xc0000000
mov rcx, qword [rsp + 0x60]
cmp eax, 0xc0000000
jne 0x14000cd10
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor al, al
jmp 0x14000cd1c
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, 1
jmp 0x14000cd1c
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.14000ed70
add rsp, 0x3b8
pop rdi
pop rbx
ret
Function at 0x14000d070
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebp, ecx
mov edi, 0x2000
mov edx, edi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
je 0x14000d0e3
nop dword [rax]
xor r9d, r9d
mov r8d, edi
mov rdx, rbx
lea ecx, [r9 + 5]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov esi, eax
test eax, eax
jns 0x14000d125
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp esi, 0xc0000004
jne 0x14000d111
lea eax, [rdi + rdi]
xor ecx, ecx
mov edx, eax
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
jne 0x14000d0a0
cmp byte [0x14003dcf0], 0
je 0x14000d0fa
mov edx, edi
lea rcx, [0x1400142c0]
call fcn.14000ca70
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
cmp byte [0x14003dcf0], 0
je 0x14000d0fa
mov edx, esi
lea rcx, [0x140014300]
jmp 0x14000d0f5
xor edi, edi
mov rax, rbx
nop word [rax + rax]
cmp dword [rax + 0x50], ebp
je 0x14000d14d
mov ecx, dword [rax]
add rax, rcx
cmp dword [rax], edi
jne 0x14000d130
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
jmp 0x14000d0fc
mov edi, dword [rax + 0x130]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
jmp 0x14000d0fc

Function at 0x1004010e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
lea r9, str._______________Q_msgkey____M_shmkey____S_semkey__...
lea r8, str.usage:_ipcrm___q_msqid____m_shmid____s_semid_
lea rdx, str._s_n_s_n
call sub.cygwin1.dll_fprintf
mov ecx, 1
call sub.cygwin1.dll_exit
nop
nop word cs:[rax + rax]
Function at 0x1412e4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1412e41df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1412e4089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1412e406f
add dl, dl
jne 0x1412e4096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1412e40f6
xor eax, eax
add dl, dl
jne 0x1412e40a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1412e41ad
add dl, dl
jne 0x1412e40b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1412e40c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1412e40d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1412e40dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1412e40ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1412e407e
mov eax, 1
add dl, dl
jne 0x1412e4106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1412e4113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1412e40fb
sub eax, ebx
mov ebx, 1
jne 0x1412e414c
mov ecx, 1
add dl, dl
jne 0x1412e412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1412e413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1412e4123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1412e407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1412e4168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1412e4175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1412e415d
cmp eax, 0x7d00
jae 0x1412e419b
cmp eax, 0x500
jb 0x1412e4196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1412e407e
cmp eax, 0x7f
ja 0x1412e419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1412e407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1412e41d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1412e407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14001a140
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1400f49b0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x14001a1ce
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x14001a172
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x14001a1e0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1400f49b0]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x14001a2e4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x14001a2df
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x14001a2b4
cmp qword [rsp + 0x38], 2
jb 0x14001a2b4
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14001a2b4
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14001a2b4
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x14001a227
jmp 0x14001a376
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x14001a376
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x14001a34c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14001a34c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14001a34c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x14001a2e4
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x14001a5d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.1400add04
add rsp, 0x28
ret

Function at 0x14001a610
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.1400ab444
add rsp, 0x28
ret