joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003494
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x140
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x11c
xor ebx, ebx
call qword [0x140011f68]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
je 0x1400034d0
xor eax, eax
jmp 0x140003677
cmp dword [rsp + 0x24], 6
jne 0x140003541
cmp dword [rsp + 0x28], 1
jne 0x14000350a
cmp dword [rsp + 0x2c], 0x1db0
jne 0x1400034f2
mov ebx, 1
jmp 0x140003675
cmp dword [rsp + 0x2c], 0x1db1
jb 0x140003675
mov ebx, 2
jmp 0x140003675
cmp dword [rsp + 0x28], 3
jne 0x140003675
cmp dword [rsp + 0x2c], 0x23f0
jne 0x140003529
mov ebx, 3
jmp 0x140003675
cmp dword [rsp + 0x2c], 0x2580
jb 0x140003675
mov ebx, 4
jmp 0x140003675
cmp dword [rsp + 0x24], 0xa
jne 0x140003675
cmp dword [rsp + 0x28], ebx
jne 0x140003675
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0x2800
jne 0x14000356c
mov ebx, 5
jmp 0x140003675
cmp ecx, 0x295a
jne 0x14000357e
mov ebx, 6
jmp 0x140003675
cmp ecx, 0x3839
jne 0x140003590
mov ebx, 7
jmp 0x140003675
cmp ecx, 0x3ad7
jne 0x1400035a2
mov ebx, 8
jmp 0x140003675
cmp ecx, 0x3fab
jne 0x1400035b4
mov ebx, 9
jmp 0x140003675
cmp ecx, 0x42ee
jne 0x1400035c6
mov ebx, 0xa
jmp 0x140003675
cmp ecx, 0x4563
jne 0x1400035d8
mov ebx, 0xb
jmp 0x140003675
cmp ecx, 0x47ba
jne 0x1400035ea
mov ebx, 0xc
jmp 0x140003675
cmp ecx, 0x47bb
jne 0x1400035f9
mov ebx, 0xd
jmp 0x140003675
cmp ecx, 0x4a61
jne 0x140003608
mov ebx, 0xe
jmp 0x140003675
cmp ecx, 0x4a62
jne 0x140003617
mov ebx, 0xf
jmp 0x140003675
cmp ecx, 0x4a63
jne 0x140003626
mov ebx, 0x10
jmp 0x140003675
cmp ecx, 0x4a64
jne 0x140003635
mov ebx, 0x11
jmp 0x140003675
lea eax, [rcx - 0x4a65]
cmp eax, 0xb8a
ja 0x140003649
mov ebx, 0x12
jmp 0x140003675
cmp ecx, 0x55f0
jne 0x140003658
mov ebx, 0x13
jmp 0x140003675
cmp ecx, 0x5846
jne 0x140003667
mov ebx, 0x14
jmp 0x140003675
cmp ecx, 0x5867
mov eax, 0x15
cmovae ebx, eax
mov eax, ebx
add rsp, 0x140
pop rbx
ret
Function at 0x140003fa8
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
call fcn.140002038
test rax, rax
je 0x140003feb
cmp qword [rax + 0x68], 0
je 0x140003feb
test r14, r14
je 0x140003fe4
mov rax, qword [rax + 0x70]
mov qword [r14], rax
xor eax, eax
jmp 0x140004182
cmp qword [0x140011ce8], 0
lea r13, [0x140011ce8]
mov ebx, 0xc0000001
jne 0x14000400f
mov qword [0x140011cf0], r13
mov qword [0x140011ce8], r13
mov rcx, rsi
call fcn.140002f88
mov rdi, rax
test rax, rax
jne 0x140004029
mov eax, 0xc0000225
jmp 0x140004182
lea rcx, [0x14000d320]
call fcn.1400021e8
test rax, rax
je 0x140004180
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r15d, 0x20
lea r9, [0x14000d9a0]
mov edx, r15d
lea r8, [0x14000d9b0]
mov rcx, rdi
call fcn.140009ea0
test rax, rax
jne 0x140004098
lea r9, [0x14000d9a0]
mov edx, r15d
lea r8, [0x14000d9c0]
mov rcx, rdi
call fcn.140009ea0
test rax, rax
jne 0x140004098
mov ebx, 0xc0000225
jmp 0x140004175
mov edx, 3
mov rcx, rax
lea r8d, [rdx + 4]
call fcn.140007f4c
mov r15, rax
test rax, rax
je 0x140004175
mov ecx, 0x98
call fcn.140009e30
mov rdi, rax
test rax, rax
je 0x140004175
sub rax, rsi
mov cl, byte [rsi]
mov byte [rax + rsi], cl
inc rsi
test cl, cl
jne 0x1400040ce
mov qword [rdi + 0x68], r15
lea rbx, [rdi + 0x78]
mov rax, qword [r15]
mov qword [rdi + 0x70], rax
mov qword [rbx], rbp
test r14, r14
je 0x1400040f8
mov qword [r14], rax
mov r15, qword [rdi + 0x68]
and qword [rsp + 0x98], 0
lea rdx, [rsp + 0x98]
mov ebp, 8
mov rcx, r15
mov r8d, ebp
call fcn.14000708c
mov rcx, qword [rdi + 0x68]
mov r8d, ebp
mov rdx, rbx
call fcn.140007158
lea esi, [rbp - 3]
mov rcx, qword [rdi + 0x68]
mov r8, rbp
mov rdx, rbx
call fcn.140007158
mov ecx, 1
call fcn.140006c50
sub rsi, 1
jne 0x14000412b
mov rax, qword [0x140011cf0]
add rdi, 0x88
cmp qword [rax], r13
je 0x140004162
lea ecx, [rsi + 3]
int 0x29
mov qword [rdi], r13
xor ebx, ebx
mov qword [rdi + 8], rax
mov qword [rax], rdi
mov qword [0x140011cf0], rdi
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x140006a74
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
call fcn.140007c18
lea r8, [0x140011090]
mov rcx, rbx
lea rdx, [0x14000e340]
call sub.FLTMGR.SYS_FltRegisterFilter
mov ebx, eax
test eax, eax
js 0x140006b66
mov edx, 0x1f0001
lea rcx, [rbp + 0x18]
call sub.FLTMGR.SYS_FltBuildDefaultSecurityDescriptor
lea rdx, [0x14000dc00]
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [0x140011090]
lea rax, [rbp - 0x40]
and qword [rbp - 0x28], 0
lea r8, [rbp - 0x30]
and qword [rbp - 8], 0
lea rdx, [0x140011098]
mov qword [rbp - 0x20], rax
xor r9d, r9d
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x10], rax
lea rax, [0x1400072c4]
mov dword [rsp + 0x38], 5
mov qword [rsp + 0x30], rax
lea rax, [0x140007260]
mov qword [rsp + 0x28], rax
lea rax, [0x140007224]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x30], 0x30
mov dword [rbp - 0x18], 0x240
call sub.FLTMGR.SYS_FltCreateCommunicationPort
mov rcx, qword [rbp + 0x18]
mov ebx, eax
call sub.FLTMGR.SYS_FltFreeSecurityDescriptor
mov rcx, qword [0x140011090]
test ebx, ebx
js 0x140006b61
call sub.FLTMGR.SYS_FltStartFiltering
mov ebx, eax
test eax, eax
jns 0x140006b66
mov rcx, qword [0x140011090]
call sub.FLTMGR.SYS_FltUnregisterFilter
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x1400074ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov rbp, rcx
cmp dword [0x1400120e8], ebx
jne 0x1400073f6
call qword [0x140012060]
mov rcx, qword [sym.imp.ntoskrnl.exe_PsInitialSystemProcess]
mov r14, rax
mov rcx, qword [rcx]
call qword [0x140012060]
mov r15, rax
mov edi, ebx
mov esi, edi
add rsi, rbp
mov rcx, rsi
call qword [0x140011d08]
test al, al
je 0x1400073c5
mov rax, qword [rsi]
and rax, 0xfffffffffffffff0
cmp rax, r14
je 0x1400073d2
add edi, 8
cmp edi, 0xa80
jae 0x1400073d8
jmp 0x1400073a7
mov dword [0x1400120e8], edi
mov rcx, r14
call qword [0x140012068]
mov rcx, r15
call qword [0x140012068]
cmp dword [0x1400120e8], ebx
je 0x14000748f
mov eax, dword [0x14000f190]
lea r8, [rsp + 0x20]
movsd xmm0, qword [0x14000f188]
mov ecx, ebx
mov dword [rsp + 0x28], eax
mov al, byte [0x14000f194]
mov byte [rsp + 0x2c], al
movsd qword [rsp + 0x20], xmm0
mov eax, 0xcccccccd
mul ecx
shr edx, 3
mov al, dl
shl al, 2
add dl, al
mov al, cl
add dl, dl
inc ecx
sub al, dl
sub al, 0x66
xor byte [r8], al
inc r8
cmp ecx, 0xd
jl 0x14000741f
lea rcx, [rsp + 0x20]
call fcn.1400021e8
mov rcx, rax
mov eax, dword [0x1400120e8]
mov rdi, qword [rax + rcx]
mov rcx, rbp
and rdi, 0xfffffffffffffff0
call qword [0x140011d08]
test al, al
je 0x14000748f
mov eax, dword [0x1400120e8]
mov bl, 1
mov qword [rax + rbp], rdi
movabs rax, 0x1ff2ffffbc
mov qword [rdi + 0x50], rax
mov qword [rdi + 0x48], rax
mov qword [rdi + 0x40], rax
mov rbp, qword [rsp + 0x58]
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
sub rsp, 0x28
cmp rcx, 4
jl 0x1400074d5
cmp dword [0x140011180], 0
je 0x1400074d5
call fcn.140002164
test rax, rax
je 0x1400074d5
mov rcx, rax
add rsp, 0x28
jmp 0x140007364
xor al, al
add rsp, 0x28
ret
Function at 0x140007564
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rsi, r8
mov r13, rdx
mov ebx, 0xc0000001
test rcx, rcx
je 0x1400076c6
lea rax, [rdx - 1]
movabs rdx, 0x7ffffffffffe
cmp rax, rdx
ja 0x1400076c6
test r8, r8
je 0x1400076c6
cmp dword [0x140011180], 0
je 0x1400076c6
call fcn.140002164
mov r14, rax
mov qword [rsp + 0xd8], rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov r15, rax
mov qword [rsp + 0x38], rax
test r14, r14
je 0x1400076c6
mov ecx, 0x30
call fcn.140009e30
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400076c6
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
cmp r14, r15
je 0x140007623
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
xor ecx, ecx
call fcn.140001a48
mov r12b, al
mov byte [rsp + 0xc0], al
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x30
mov r9, rdi
xor r8d, r8d
mov rdx, r13
or rcx, 0xffffffffffffffff
call qword [0x140012070]
mov ebx, eax
mov dword [rsp + 0x30], eax
jmp 0x140007689
mov cl, r12b
call fcn.140001a48
cmp r14, r15
je 0x1400076a1
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
test ebx, ebx
js 0x1400076bb
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [rsi + 0x20], xmm0
xor edx, edx
mov rcx, rdi
call qword [0x140011d60]
mov eax, ebx
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140007c18
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x80
and dword [rbp + 0x28], 0
mov rdi, rcx
and qword [rbp - 0x40], 0
mov ecx, 0x1000
and qword [rbp + 0x38], 0
and dword [rbp - 0x34], 0
and dword [rbp - 0x1c], 0
call fcn.140009e74
mov rbx, rax
test rax, rax
je 0x140007e12
lea rdx, [0x14000dc20]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
mov rdx, qword [rdi + 0x30]
mov rcx, rbx
mov rdx, qword [rdx + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea rdx, [0x14000dc90]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
and qword [rbp - 0x30], 0
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x38]
xorps xmm0, xmm0
mov dword [rbp - 0x38], 0x30
mov edi, 1
mov dword [rbp - 0x20], 0x240
mov dword [rsp + 0x28], edi
lea rcx, [rbp - 0x40]
and qword [rsp + 0x20], 0
xor r9d, r9d
mov edx, 0xf003f
mov qword [rbp - 0x28], rbx
movdqu xmmword [rbp - 0x18], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
js 0x140007e07
lea rdx, [0x14000dcb0]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
and qword [rbp - 0x30], 0
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x38]
xorps xmm0, xmm0
mov dword [rsp + 0x28], edi
and qword [rsp + 0x20], 0
lea rcx, [rbp + 0x38]
xor r9d, r9d
mov dword [rbp - 0x38], 0x30
mov edx, 0xf003f
mov dword [rbp - 0x20], 0x240
mov qword [rbp - 0x28], rbx
movdqu xmmword [rbp - 0x18], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
js 0x140007dfd
and dword [rbp + 0x30], 0
lea rdx, [0x14000dcc0]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp - 0x40]
lea rax, [0x14000dce0]
mov dword [rsp + 0x28], 8
mov r9d, edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
lea rdx, [0x14000dcf0]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp + 0x38]
lea rax, [0x14000dd10]
mov dword [rsp + 0x28], 0xe
mov r9d, edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
lea rdx, [0x14000dd20]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp + 0x38]
lea r9d, [rdi + 3]
lea rax, [rbp + 0x30]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwFlushKey]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwFlushKey]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor edx, edx
mov rcx, rbx
call qword [0x140011d60]
mov rax, qword [rbp - 0x40]
neg rax
sbb eax, eax
not eax
and eax, 0xc0000001
add rsp, 0x80
pop rdi
pop rbx
pop rbp
ret
Function at 0x140008620
Capabilities:
Write file on windows

Disassembly:
cmp ecx, 0xb
jg 0x1400086ef
je 0x1400086e3
cmp ecx, 6
jg 0x14000869b
je 0x14000868f
sub ecx, 1
je 0x140008683
sub ecx, 1
je 0x140008677
sub ecx, 1
je 0x14000866b
sub ecx, 1
je 0x14000865f
cmp ecx, 1
jne 0x140008759
lea rcx, [0x14000d480]
jmp 0x140008784
lea rcx, [0x14000d450]
jmp 0x140008784
lea rcx, [0x14000d430]
jmp 0x140008784
lea rcx, [0x14000d410]
jmp 0x140008784
lea rcx, [0x14000d3f0]
jmp 0x140008784
lea rcx, [0x14000d4b0]
jmp 0x140008784
sub ecx, 7
je 0x1400086d7
sub ecx, 1
je 0x1400086cb
sub ecx, 1
je 0x1400086bf
cmp ecx, 1
jne 0x140008759
lea rcx, [0x14000d570]
jmp 0x140008784
lea rcx, [0x14000d540]
jmp 0x140008784
lea rcx, [0x14000d510]
jmp 0x140008784
lea rcx, [0x14000d4e0]
jmp 0x140008784
lea rcx, [0x14000d5a0]
jmp 0x140008784
cmp ecx, 0x11
jg 0x140008745
je 0x14000873c
sub ecx, 0xc
je 0x140008733
sub ecx, 1
je 0x14000872a
sub ecx, 1
je 0x140008721
sub ecx, 1
je 0x140008718
cmp ecx, 1
jne 0x140008759
lea rcx, [0x14000d690]
jmp 0x140008784
lea rcx, [0x14000d660]
jmp 0x140008784
lea rcx, [0x14000d630]
jmp 0x140008784
lea rcx, [0x14000d600]
jmp 0x140008784
lea rcx, [0x14000d5d0]
jmp 0x140008784
lea rcx, [0x14000d6c0]
jmp 0x140008784
sub ecx, 0x12
je 0x14000877d
sub ecx, 1
je 0x140008774
sub ecx, 1
je 0x14000876b
cmp ecx, 1
je 0x140008762
lea rcx, [0x14000d7b0]
jmp 0x140008784
lea rcx, [0x14000d780]
jmp 0x140008784
lea rcx, [0x14000d750]
jmp 0x140008784
lea rcx, [0x14000d720]
jmp 0x140008784
lea rcx, [0x14000d6f0]
jmp fcn.140001af0

Function at 0x140008a14
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140011ce8]
test rax, rax
je 0x140008b0f
lea rbp, [0x140011ce8]
cmp rax, rbp
je 0x140008b0f
lea rcx, [0x14000d320]
call fcn.1400021e8
test rax, rax
jne 0x140008a63
mov eax, 0xc0000225
jmp 0x140008b11
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rbx, qword [0x140011ce8]
cmp rbx, rbp
je 0x140008b04
lea rdi, [rbx - 0x88]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x140008ae8
mov eax, dword [rdi + 0x80]
test eax, eax
jne 0x140008aae
lea r8d, [rax + 8]
lea rdx, [rdi + 0x70]
call fcn.140007158
mov eax, dword [rdi + 0x80]
cmp eax, 1
jne 0x140008ac4
mov rcx, qword [rdi + 0x68]
lea r8d, [rax + 3]
lea rdx, [rdi + 0x70]
call fcn.140007158
mov rax, qword [rbx]
cmp qword [rax + 8], rbx
jne 0x140008afd
mov rdx, qword [rbx + 8]
cmp qword [rdx], rbx
jne 0x140008afd
mov qword [rdx], rax
mov rcx, rdi
mov qword [rax + 8], rdx
xor edx, edx
call qword [0x140011d60]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140008b04
mov rbx, qword [rbx]
jmp 0x140008a78
mov ecx, 3
int 0x29
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140009f70
Capabilities:
Attach user process memory
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov r12, rcx
lea rcx, [0x14000d320]
call fcn.1400021e8
test rax, rax
je 0x14000a138
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
cmp qword [0x1400111a8], 0
je 0x140009fc1
cmp qword [0x1400111b0], 0
jne 0x14000a0e8
and qword [rsp + 0xb0], 0
and dword [rsp + 0xa8], 0
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0xb0]
lea rcx, [0x14000d330]
call fcn.140001c90
test eax, eax
js 0x14000a0de
mov rdi, qword [rsp + 0xb0]
xor esi, esi
test rdi, rdi
je 0x14000a0de
movsxd rax, dword [rdi + 0x3c]
mov r15d, dword [rax + rdi + 0x88]
add r15, rdi
je 0x14000a0de
mov r13d, dword [r15 + 0x1c]
add r13, rdi
mov r8d, dword [r15 + 0x20]
add r8, rdi
mov qword [rsp + 0xb8], r8
mov eax, dword [r15 + 0x24]
add rax, rdi
mov qword [rsp + 0x28], rax
xor r14d, r14d
mov dword [rsp + 0x20], r14d
cmp r14d, dword [r15 + 0x18]
jae 0x14000a094
movzx eax, word [rax + r14*2]
mov eax, dword [r13 + rax*4]
mov dword [rsp + 0xb0], eax
mov ecx, dword [r8 + r14*4]
add rcx, rdi
lea rdx, [0x14000d340]
call sub.ntoskrnl.exe__stricmp
test eax, eax
jne 0x14000a082
mov esi, dword [rsp + 0xb0]
add rsi, rdi
jmp 0x14000a094
inc r14d
mov r8, qword [rsp + 0xb8]
mov rax, qword [rsp + 0x28]
jmp 0x14000a043
test rsi, rsi
je 0x14000a0de
lea r9, [0x14000d350]
lea r8, [0x14000d370]
mov edx, dword [rsp + 0xa8]
mov rcx, rdi
call fcn.140001dd8
test rax, rax
je 0x14000a0de
mov edx, 9
lea r8d, [rdx + 4]
mov rcx, rax
call fcn.140007f4c
mov qword [0x1400111a8], rax
add rax, 8
mov qword [0x1400111b0], rax
jmp 0x14000a0e8
mov rdx, qword [0x1400111a8]
test rdx, rdx
je 0x14000a12d
mov rax, qword [0x1400111b0]
test rax, rax
je 0x14000a12d
movzx ecx, r12w
mov eax, dword [rax]
imul rcx, rax
add rcx, qword [rdx]
and qword [rsp + 0xa8], 0
add rcx, 0x10
mov r8d, 8
lea rdx, [rsp + 0xa8]
call fcn.140007158
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, 0xc0000225
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14000b4ec
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor eax, eax
mov r11, rdx
mov r10, rcx
test r8, r8
je 0x14000b52e
mov rbx, rcx
sub r11, rcx
mov rdi, r8
cmp rax, qword [rsp + 0x28]
mov cl, byte [r11 + rbx]
sbb rdx, rdx
and rdx, rax
xor cl, byte [rdx + r9]
lea rax, [rdx + 1]
mov byte [rbx], cl
inc rbx
sub rdi, 1
jne 0x14000b50c
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov byte [r10 + r8], 0
ret

Function at 0x14000b540
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x140011060]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbp, r8
movsxd r15, r9d
mov rsi, rdx
mov r14, rcx
mov ebx, 0x104
lea rcx, [rsp + 0x150]
mov r8d, ebx
xor edx, edx
call fcn.14000ce00
mov r8d, ebx
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.14000ce00
xor ebx, ebx
or rdi, 0xffffffffffffffff
mov byte [rsp + 0x32], bl
mov rdx, rdi
mov r8d, ebx
inc rdx
cmp byte [r14 + rdx], bl
jne 0x14000b5a7
test rdx, rdx
je 0x14000b5d5
lea rax, [rsp + 0x40]
sub rsi, rax
mov al, r8b
lea rcx, [rsp + 0x40]
add rcx, r8
inc r8
xor al, byte [rsi + rcx]
mov byte [rcx], al
cmp r8, rdx
jb 0x14000b5bd
inc rdi
cmp byte [r14 + rdi], bl
jne 0x14000b5d5
test rdi, rdi
je 0x14000b60d
lea rsi, [rsp + 0x150]
movzx eax, word [r14 + rbx]
lea rcx, [rsp + 0x30]
mov word [rsp + 0x30], ax
call fcn.14000b988
mov byte [rsi], al
add rbx, 2
inc rsi
cmp rbx, rdi
jb 0x14000b5eb
mov r8, r15
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x150]
mov rcx, rbp
lea rdx, [rsp + 0x40]
call fcn.14000b4ec
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14000cc20
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x270
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000b988
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140011060]
xor rax, rsp
mov qword [rbp + 0x47], rax
and dword [rbp - 0x35], 0
xor r8d, r8d
or rax, 0xffffffffffffffff
mov byte [rbp - 0x39], 0x30
mov rdx, rcx
mov byte [rbp - 0x31], 0x31
mov dword [rbp - 0x2d], 1
mov byte [rbp - 0x29], 0x32
mov dword [rbp - 0x25], 2
mov byte [rbp - 0x21], 0x33
mov dword [rbp - 0x1d], 3
mov byte [rbp - 0x19], 0x34
mov dword [rbp - 0x15], 4
mov byte [rbp - 0x11], 0x35
mov dword [rbp - 0xd], 5
mov byte [rbp - 9], 0x36
mov dword [rbp - 5], 6
mov byte [rbp - 1], 0x37
mov dword [rbp + 3], 7
mov byte [rbp + 7], 0x38
mov dword [rbp + 0xb], 8
mov byte [rbp + 0xf], 0x39
mov dword [rbp + 0x13], 9
mov byte [rbp + 0x17], 0x41
mov dword [rbp + 0x1b], 0xa
mov byte [rbp + 0x1f], 0x42
mov dword [rbp + 0x23], 0xb
mov byte [rbp + 0x27], 0x43
mov dword [rbp + 0x2b], 0xc
mov byte [rbp + 0x2f], 0x44
mov dword [rbp + 0x33], 0xd
mov byte [rbp + 0x37], 0x45
mov dword [rbp + 0x3b], 0xe
mov byte [rbp + 0x3f], 0x46
mov dword [rbp + 0x43], 0xf
inc rax
cmp byte [rcx + rax], r8b
jne 0x14000ba5b
cmp rax, 2
jbe 0x14000ba7c
cmp byte [rcx], 0x30
jne 0x14000ba7c
mov al, byte [rcx + 1]
sub al, 0x58
test al, 0xdf
jne 0x14000ba7c
add rdx, 2
mov r9b, 1
jmp 0x14000bab0
mov r10, r8
xor eax, eax
cmp cl, byte [rbp + rax*8 - 0x39]
je 0x14000ba97
inc rax
cmp rax, 0x10
jge 0x14000bab6
jmp 0x14000ba86
movsxd rcx, dword [rbp + rax*8 - 0x35]
shl r8, 4
test r9b, r9b
cmovne r8, r10
inc rdx
or r8, rcx
xor r9b, r9b
mov cl, byte [rdx]
test cl, cl
jne 0x14000ba81
mov eax, r8d
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14000cc20
add rsp, 0x90
pop rbp
ret
Function at 0x14000bad0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
push rbx
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x118]
sub rsp, 0x218
mov rax, qword [0x140011060]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov r15, qword [rbp + 0x170]
mov rbx, r9
mov r12, r8
mov rdi, rdx
mov r14, rcx
test rcx, rcx
je 0x14000bcdc
test rdx, rdx
je 0x14000bcdc
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x50], rax
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x40], xmm0
test rbx, rbx
je 0x14000bb38
and qword [r9], rax
mov r8, qword [rbp + 0x178]
lea rcx, [rbp + 0x58]
mov eax, 0x21
mov rdx, r15
cmp r8, rax
cmova r8, rax
call fcn.14000d000
xor edx, edx
lea rcx, [rbp + 0x80]
mov r8d, 0x80
call fcn.14000ce00
xor r9d, r9d
xor r11d, r11d
xor eax, eax
xor r10d, r10d
movsxd rdx, r9d
cmp rdx, qword [rbp + 0x178]
sbb r8, r8
inc r11d
and r8, rax
lea rax, [0x14000f500]
mov al, byte [r10 + rax]
mov cl, byte [r8 + r15]
xor cl, al
mov byte [rbp + r10 + 0x80], cl
inc r10
cmp rdx, qword [rbp + 0x178]
sbb eax, eax
and r9d, eax
lea rax, [r8 + 1]
inc r9d
cmp r11d, 0x80
jb 0x14000bb76
movzx ecx, byte [rbp + 0x58]
lea rax, [rbp + 0x80]
shr rcx, 3
lea rdx, [rbp + 0x80]
add rax, rcx
cmp rcx, 0x10
lea rcx, [rbp + 0x30]
cmovae rdx, rax
lea rax, [rdx + 0xf]
cmp rcx, rax
ja 0x14000bc02
lea rax, [rbp + 0x3f]
cmp rax, rdx
jb 0x14000bc02
movups xmm0, xmmword [rdx]
movdqu xmmword [rbp + 0x30], xmm0
jmp 0x14000bc0a
movups xmm0, xmmword [rdx]
movdqu xmmword [rbp + 0x30], xmm0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x110
call fcn.14000ce00
and dword [rsp + 0x28], 0
lea rax, [rbp + 0x80]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
lea rax, [rbp + 0x30]
mov dword [rsp + 0x24], 0x100
mov qword [rsp + 0x38], rax
call fcn.14000c730
mov r9d, 0x10
lea rdx, [rbp + 0x40]
mov r8, r14
lea rcx, [rsp + 0x20]
call fcn.14000c43c
xor r9d, r9d
lea r10, [rbp + 0x80]
xor eax, eax
xor ecx, ecx
cmp rax, 8
cmovl rcx, rax
inc r9d
mov al, byte [rbp + rcx + 0x40]
mov byte [r10], al
inc r10
lea rax, [rcx + 1]
cmp r9d, 0x80
jb 0x14000bc6b
and dword [rsp + 0x28], 0
lea rax, [rbp + 0x80]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
lea rax, [rbp + 0x30]
mov dword [rsp + 0x24], 0x80
mov qword [rsp + 0x38], rax
call fcn.14000c730
lea r9d, [rdi - 0x10]
mov rdx, r12
lea r8, [r14 + 0x10]
lea rcx, [rsp + 0x20]
call fcn.14000c524
mov eax, eax
test rbx, rbx
je 0x14000bce5
mov qword [rbx], rax
jmp 0x14000bce5
test rbx, rbx
je 0x14000bce5
and qword [r9], 0
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.14000cc20
add rsp, 0x218
pop r15
pop r14
pop r12
pop rdi
pop rbx
pop rbp
ret