joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140707b62
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x40], 0x4f3b089f
mov r9, qword [rsp + 0x18]
shr dword [rsp + 0x48], 0x65
neg byte [rsp + 0x40]
js 0x14001c029
jne 0x140500ab8
pop rbx
invalid
add qword [rsp + 8], 0xffffffffbf9b2561
shr r10d, 6
sets r10b
mov r10, qword [rsp + r10*2 - 0x54bafe0]
seta byte [rsp + 0x40]
call fcn.1403e573e
push r12
sub ebp, ebp
movabs r12, 0x528bee85fe247a38
sub r12w, 0xa28c
shl r12b, 0xc9
xchg qword [rsp + 0x20], rcx
mov r12, qword [rsp + rbp*8]
movabs r15, 0xe0b6d107da3ad784
neg ebp
not r15b
call fcn.1404bb013
jl 0x140637058
mov qword [rsp + 0x48], 0x3404de36
jae 0x1403e1dfb

Function at 0x140709607
Capabilities:
Encode data using xor

Disassembly:
sub dil, byte [rsp + rdi - 0x784a6a7e]
call fcn.1406e0b02

Function at 0x14070a6a1
Capabilities:
Packed with generic packer

Disassembly:
call fcn.14068894e
jge 0x140592c51
mov qword [rsp + 0x38], rax
jno 0x1404ca1fc

Function at 0x14070e3e9
Capabilities:
Encode data using xor

Disassembly:
mov r14, qword [rsp + r14 - 0x13575503]
neg dword [rsp + 0x28]
test byte [rsp + 0x28], 0x8d
jae 0x1403d795b
or byte [rsp + 0x28], 0x37
xor r14d, dword [rsp + 0x29]
jg 0x1403e26e5
push 0x4a
out dx, al
in al, dx
sub dword [rdi - 0x73], esi
invalid
mov rbx, qword [rsp + 0x40]
shl r14, 0x34
jb fcn.1404b496a
jae 0x140428302
adc dh, bl
invalid
jno 0x1406d678d

Function at 0x14070f654
Capabilities:
Authenticate hmac
Encode data using xor
Encrypt data using aes mixcolumns step
Resolve function by parsing pe exports

Disassembly:
pushfq
mov qword [rsp + 8], 0xffffffffc8290801
lea rsp, [rsp + 8]
call fcn.140848552

Function at 0x14071e85e
Capabilities:
Packed with generic packer

Disassembly:
ja 0x1403f64bc
cmp qword [rsp + rdi + 0x33e0b1dd], 0xffffffffd60df7b4
push rdx
lea rax, [rax + rdi*2 + 0x25cd3057]
push rsi
call fcn.1405623b5
pop rbp
mov ebp, 0x296fbdc2
mov byte [rdx - 0x6e], al
invalid

Function at 0x140722c8b
Capabilities:
Encode data using xor

Disassembly:
shl r8w, 5
xchg qword [rsp + 0x38], rsi
mov r11, qword [rsp + 0x10]
and dx, dx
jg 0x1406aaff5
setl r11b
jle 0x140709af3
jl 0x14041f9b0
lea rsi, [rsi + 0xc2fbcac]
and dx, 0x4aa4
jns 0x14043480a
outsb dx, byte [rsi]
xchg esp, eax
enter 0x6e39, 0x4e
jmp 0x140506735
mov dl, 5
adc dword [rbx], edx
mov r11b, 9
mov al, setsockopt
jns 0x14050671d
mov ebx, 0x2c0da340
cmp dl, dl
cmp dword [rax + 0x40], 1
movabs dword [0x1407883d2382c0d], eax
cmp dword [rax], eax
add al, 0x60
invalid
jae 0x140506710
xor dl, byte [rbp + rax*8 + 0x3d9e6f3f]
and esp, dword [rcx + 4]
cmp rdx, rsi
test al, 0x9f
push rcx
mov edi, 0xadbeea62
push rbx
add eax, 0x3bfb9b77
add byte [rsi + 0x19875430], dl
cwde
cwde
outsb dx, byte [rsi]
jbe 0x1405067a0
invalid
xchg byte [rdx + 0x5c8d2788], ch
invalid
push r8
movabs rsi, 0x1829c1a7140fe89d
add qword [rsp + 8], 0xfffffffffff34b55
mov rsi, qword [rsp + 0x28]
mov rsi, qword [rsi]
test dh, dl
mov r8, rdx
jge 0x1405066b9
sub dword [rcx - 0x66], 0xffffffc8
xchg byte [0xd2a7d9c2], bh
movabs r10, 0xff4ddeeed76d4538
cmp ecx, ecx
mov esi, 0x6a04fb41
jmp 0x140722ce2
lodsd eax, dword [rsi]
xor eax, 0xa21ee5e5
invalid
Function at 0x1400049fc
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14003d048]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
lea rcx, [rsp + 0x30]
call fcn.140003de8
lea rcx, [rsp + 0x30]
call fcn.1400059f4
nop
lea rdi, [rbx + 8]
lea rcx, [rsp + 0x30]
call fcn.14000251c
mov r9, rax
mov qword [rsp + 0x28], rdi
and dword [rsp + 0x20], 0
lea r8, [0x140005a38]
xor edx, edx
xor ecx, ecx
call fcn.140014b6c
mov qword [rbx], rax
test rax, rax
je 0x140004a8d
lea rcx, [rsp + 0x30]
call fcn.1400040cc
nop
lea rcx, [rsp + 0x30]
call fcn.140004f18
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14000e4c0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
and dword [rdi], 0
mov ecx, 6
call fcn.14000ce44
int3

Function at 0x140005e68
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x140005ff5
cmp ecx, 0x7c
je 0x140005ff5
cmp ecx, 0x29
jne 0x140005ee2
cmp dword [rdi + 0x1c], 0
jne 0x140005ff5
lea rbx, [rdi + 0x80]
test dword [rbx], 0x10000000
je 0x14000600b
cmp ecx, 0x5d
jne 0x140005ebf
test dword [rbx], 0x10000000
je 0x140006016
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.140006e78
mov rcx, rdi
call fcn.140005e34
mov rcx, rdi
call fcn.140006d18
mov ecx, dword [rdi + 0x7c]
mov al, 1
jmp 0x140005e7a
lea rbx, [rdi + 0x80]
cmp ecx, 0x2e
jne 0x140005ef9
lea rcx, [rdi + 0x40]
call fcn.140006e6c
jmp 0x140005ecb
cmp ecx, 0x5c
jne 0x140005f47
mov rcx, rdi
call fcn.140005e34
test byte [rbx], 0x80
je 0x140005f3d
mov al, byte [rdi + 0x78]
cmp al, 0x62
jne 0x140005f25
lea rcx, [rdi + 0x40]
call fcn.140006e60
mov rcx, rdi
call fcn.140005e34
jmp 0x140005edb
cmp al, 0x42
jne 0x140005f3d
lea rcx, [rdi + 0x40]
call fcn.140006e60
lea rcx, [rdi + 0x40]
call fcn.140006f04
jmp 0x140005f1b
mov rcx, rdi
call fcn.140006b80
jmp 0x140005ed3
cmp ecx, 0x5b
jne 0x140005f72
mov rcx, rdi
call fcn.140005e34
mov rcx, rdi
call fcn.140006b18
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.140006afc
jmp 0x140005ed3
cmp ecx, 0x28
jne 0x140005fa7
mov rcx, rdi
call fcn.140005e34
mov rcx, rdi
call fcn.140006c6c
mov edx, 0x29
mov rcx, rdi
mov bl, al
lea r8d, [rdx - 0x24]
call fcn.140006afc
test bl, bl
je 0x140005edb
jmp 0x140005ed3
cmp ecx, 0x5e
jne 0x140005fba
lea rcx, [rdi + 0x40]
call fcn.140006e48
jmp 0x140005f1b
cmp ecx, 0x24
jne 0x140005fcd
lea rcx, [rdi + 0x40]
call fcn.140006e54
jmp 0x140005f1b
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x140006021
cmp ecx, 0x3f
je 0x140006021
cmp ecx, 0x7b
je 0x140006021
cmp ecx, 0x7d
jne 0x140005eae
test dword [rbx], 0x10000000
je 0x140006000
jmp 0x140005ebf
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 6
call fcn.14000527c
int3
mov edx, 5
call fcn.14000527c
int3
mov edx, 4
call fcn.14000527c
int3
mov edx, 0xa
call fcn.14000527c
int3
Function at 0x14000f244
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140029130]
test rax, rax
je 0x14000f28e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f28e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f28e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f28e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f28e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000f290
xor al, al
add rsp, 0x28
ret

Function at 0x14001913c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140018f2c
Function at 0x140002080
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov rdi, rcx
movabs rbp, 0x9e3779b185ebca87
movabs r15, 0x27d4eb2f165667c5
movabs r14, 0xc2b2ae3d27d4eb4f
movabs r12, 0x7a1435883d4d519d
cmp rsi, 0x20
jb 0x14000217b
mov rcx, qword [rcx + 8]
mov r8, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
mov rax, r8
mov rdx, qword [rdi + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rdx
rol rax, 7
add r10, rax
mov rax, rcx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rcx, r14
imul rdx, r14
imul r8, r14
imul r9, r14
rol rcx, 0x1f
imul rcx, rbp
rol rdx, 0x1f
xor r10, rcx
rol r8, 0x1f
imul r10, rbp
imul rdx, rbp
imul r8, rbp
sub r10, r12
rol r9, 0x1f
xor r10, rdx
imul r10, rbp
imul r9, rbp
sub r10, r12
xor r10, r8
imul r10, rbp
sub r10, r12
xor r10, r9
imul r10, rbp
add rax, r10
add rax, rsi
jmp 0x140002183
lea rax, [rsi + r15]
add rax, qword [rcx + 0x18]
lea rdx, [rdi + 0x30]
cmp rdx, rbx
ja 0x1400021ba
nop dword [rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, r14
add r11, 8
rol rcx, 0x1f
imul rcx, rbp
xor rax, rcx
rol rax, 0x1b
imul rax, rbp
sub rax, r12
cmp rdx, rbx
jbe 0x140002190
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1400021e5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rbp
xor rax, rcx
rol rax, 0x17
imul rax, r14
add rax, r8
cmp r11, rbx
jae 0x14000220b
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r15
xor rax, rcx
rol rax, 0xb
imul rax, rbp
cmp r11, rbx
jb 0x1400021f0
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
shr rcx, 0x21
xor rcx, rax
imul rcx, r14
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
pop r12
ret

Function at 0x14000a2e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14002c008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a325
xor al, al
jmp 0x14000a372
cmp word [rbx], 0
je 0x14000a33d
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a330
cmp word [rsp + 0x30], 0
je 0x14000a36b
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a393
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a350
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000b630
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000f708
int3
Function at 0x14000acc0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x2030
call fcn.14001f710
sub rsp, rax
mov rax, qword [0x14002c008]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r11d, dword [0x14002dd70]
lea rsi, [0x140032db0]
mov rdi, rcx
test r11d, r11d
jne 0x14000ad39
mov r8d, 0x1000
lea rdx, str._HOME_
lea rcx, [rsp + 0x20]
call fcn.14000a3a0
test al, al
je 0x14000ae19
lea rcx, [rsp + 0x20]
call fcn.140013d4c
movsxd r11, dword [0x14002dd70]
mov qword [rsi + r11*8], rax
inc r11d
mov dword [0x14002dd70], r11d
xor r9d, r9d
test r11d, r11d
jle 0x14000ad74
mov r10, rsi
mov r8, qword [r10]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ad64
add rax, 2
test ecx, ecx
jne 0x14000ad50
test edx, edx
je 0x14000ad97
inc r9d
add r10, 8
cmp r9d, r11d
jl 0x14000ad44
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14000ad80
cmp rax, 2
jne 0x14000ad9b
cmp word [rdi + 2], 0x3a
jne 0x14000ad9b
mov al, 1
jmp 0x14000adf8
xor edx, edx
mov qword [rsp + 0x2048], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x14000adc6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000aded
mov bl, 1
cmp dword [0x14002dd70], 0x400
jge 0x14000aded
mov rcx, rdi
call fcn.140013d4c
movsxd rdx, dword [0x14002dd70]
mov qword [rsi + rdx*8], rax
inc edx
mov dword [0x14002dd70], edx
movzx eax, bl
mov rbx, qword [rsp + 0x2048]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.14000b630
mov rsi, qword [rsp + 0x2050]
add rsp, 0x2030
pop rdi
ret
lea rcx, str._HOME_
call fcn.14000ab10
int3
Function at 0x14000af40
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002dd78]
test rcx, rcx
je 0x14000af7b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000af6e
mov rcx, qword [0x14002dd78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002dd78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14002dd88], 0
je 0x14000b06e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140028900]
mov qword [rsp + 0x80], rsi
lea rsi, [0x1400305b0]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b04f
test al, 0x10
je 0x14000b04f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000aff5
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000bf04
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000bf4e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000bf4e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000bf4e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000bf4e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000bf4e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000bf50
xor al, al
add rsp, 0x28
ret

Function at 0x14000f6fc
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000f55b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f55b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f55b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f55b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f55b
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f55b
cmp dword [rcx + 0xf8], 0
je 0x14000f55b
mov ecx, ebx
call fcn.14000f618
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000f3e8
nop
cmp dword [rbp + 0x20], 0
je 0x14000f5a9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000f5b4
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000f4ec
Function at 0x140018bb0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140018c37
mov rsi, rbx
cmp word [rax], bp
je 0x140018bf6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140018be0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140018bdc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400163f0
mov rdi, rax
test rax, rax
je 0x140018c24
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000d4d0
mov rbp, rdi
xor ecx, ecx
call fcn.140015424
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001f620
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001f648
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001f648
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001145
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x1400efbc4
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x1400efc52
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x1400efc52
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400efc52
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x1400efc39
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1400efc33
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x1400efc3b
add rdx, 0x28
jmp 0x1400efc18
xor edx, edx
test rdx, rdx
jne 0x1400efc44
xor al, al
jmp 0x1400efc58
cmp dword [rdx + 0x24], 0
jge 0x1400efc4e
xor al, al
jmp 0x1400efc58
mov al, 1
jmp 0x1400efc58
xor al, al
jmp 0x1400efc58
add rsp, 0x18
ret

Function at 0x140001172
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
jmp 0x1400eecc0
xor r8d, r8d
mov r9d, edx
mov r10, rcx
test edx, edx
jle 0x1400eed14
lea r11, str.rak8DbU:9zZ
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x2aaaaaab
lea r10, [r10 + 1]
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
inc r8d
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub eax, ecx
movsxd rcx, eax
movzx eax, byte [rcx + r11]
xor byte [r10 - 1], al
cmp r8d, r9d
jl 0x1400eece0
mov eax, r9d
ret

Function at 0x140001181
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400f01b4
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400f01ff
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400f01ff
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400f01ff
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400f01ff
cmp dword [rcx + 0x84], 0xe
jbe 0x1400f01ff
cmp dword [rcx + 0xf8], 0
je 0x1400f01ff
mov al, 1
jmp 0x1400f0201
xor al, al
add rsp, 0x28
ret
Function at 0x180001bd0
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jl 0x180001bff
mov rax, qword [rsp + 0x20]
jmp 0x180001c01
xor eax, eax
add rsp, 0x38
ret

Function at 0x180001cb0
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x70], 0
jne 0x180001cc8
jmp 0x180001d29
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
jne 0x180001cdc
jmp 0x180001d29
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r11, qword [rsp + 0x78]
mov qword [rsp + 0x20], r11
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x29], 0
xor r8d, r8d
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObSetHandleAttributes]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
add rsp, 0x68
ret
Function at 0x180002100
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jl 0x180002141
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
call fcn.180001cb0
add rsp, 0x38
ret

Function at 0x1800023f0
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x48]
call fcn.1800021d0
mov dword [rsp + 0x20], 0xc0000001
lea r8, [0x1800b3e90]
lea rdx, [0x18002d920]
mov rcx, qword [rsp + 0x40]
call sub.FLTMGR.SYS_FltRegisterFilter
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jl 0x180002456
mov rcx, qword [0x1800b3e90]
call sub.FLTMGR.SYS_FltStartFiltering
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x180002456
mov rcx, qword [0x1800b3e90]
call sub.FLTMGR.SYS_FltUnregisterFilter
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x180003d80
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x50], 0xc0000001
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x180003dc0
jmp 0x180003e18
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x10000000
xor r8d, r8d
mov edx, 0x200
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x180003dfe
jmp 0x180003e18
mov edx, 0xc000000d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwTerminateProcess]
mov dword [rsp + 0x50], eax
xor eax, eax
test eax, eax
jne 0x180003da3
cmp qword [rsp + 0x40], 0
je 0x180003e2b
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp qword [rsp + 0x48], 0
je 0x180003e3e
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [rsp + 0x50]
add rsp, 0x68
ret

Function at 0x180004090
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
lea rdi, [rsp + 0x3c]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rsp + 0x44], 0
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1800040fa
cmp qword [rsp + 0x30], 0
je 0x1800040fa
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x68], rax
je 0x180004101
mov byte [rsp + 0x40], 1
jmp 0x18000412f
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
test eax, eax
jne 0x180004129
mov byte [rsp + 0x40], 1
jmp 0x18000412f
xor eax, eax
test eax, eax
jne 0x1800040cb
cmp qword [rsp + 0x30], 0
je 0x180004142
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, byte [rsp + 0x40]
add rsp, 0x50
pop rdi
ret
Function at 0x1800049f0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax]
cmp eax, 0xe
jne 0x180004a73
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 8]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
mov r9d, dword [rsp + 0x24]
lea r8, [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
call fcn.180004ae0
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0x24]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x38], rcx
mov rcx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x20]
mov dword [rcx + 0x30], eax
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x18002af80
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x50]
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
add rsp, 0x38
ret

Function at 0x18002b390
Capabilities:
Create thread

Disassembly:
sub rsp, 0x58
movzx eax, byte [0x1800b3e84]
cmp eax, 1
jne 0x18002b3d4
mov qword [rsp + 0x30], 0
lea rax, [0x18002b420]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
add rsp, 0x58
ret