joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a49c
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r15, r8
mov sil, dl
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor ebx, ebx
test dl, dl
lea ecx, [rbx + 0x2b]
je 0x14001a4da
mov ecx, 0x810
call fcn.140029ab4
cmp eax, 0xffffffff
je 0x14001a662
mov r14d, eax
add r14, rdi
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x14001a662
mov rcx, qword [r14]
mov qword [rsp + 0x28], rcx
test sil, sil
je 0x14001a526
lea rdx, [rsp + 0x28]
call fcn.14007a820
mov rcx, qword [rsp + 0x28]
test al, al
cmove rcx, rbx
mov qword [rsp + 0x28], rcx
test rcx, rcx
je 0x14001a662
xor edx, edx
mov rcx, rdi
call fcn.14004a18c
cmp al, 1
jne 0x14001a662
mov rcx, rdi
call fcn.140077928
mov r14b, al
mov byte [rsp + 0x21], al
lea rdx, [rsp + 0x38]
mov rcx, rdi
call sub.ntoskrnl.exe_KeStackAttachProcess
nop
test sil, sil
jne 0x14001a5d4
mov rcx, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov rdx, qword [rcx]
mov rcx, qword [rsp + 0x28]
cmp rcx, rdx
jae 0x14001a638
lea rax, [rcx + 0x60]
cmp rax, rdx
jae 0x14001a638
mov rsi, qword [rcx + 0x18]
cmp rsi, rdx
jae 0x14001a638
lea rax, [rsi + 0x48]
cmp rax, rdx
jae 0x14001a638
lea rcx, [rsi + 0x10]
mov r8, r15
xor edx, edx
call fcn.14001a71c
lea rcx, [rsi + 0x20]
mov r8, r15
mov edx, 0x10
call fcn.14001a71c
lea rcx, [rsi + 0x30]
mov r8, r15
mov edx, 0x20
call fcn.14001a71c
jmp 0x14001a632
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov rcx, qword [rax]
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jae 0x14001a638
lea rax, [rdx + 0x30]
cmp rax, rcx
jae 0x14001a638
mov esi, dword [rdx + 0xc]
cmp rsi, rcx
jae 0x14001a638
lea rax, [rsi + 0x28]
cmp rax, rcx
jae 0x14001a638
lea rcx, [rsi + 0xc]
mov r8, r15
xor edx, edx
call fcn.14001a688
lea rcx, [rsi + 0x14]
mov r8, r15
mov edx, 8
call fcn.14001a688
lea rcx, [rsi + 0x1c]
mov r8, r15
mov edx, 0x10
call fcn.14001a688
mov bl, 1
mov byte [rsp + 0x20], bl
jmp 0x14001a64a
lea rcx, [rsp + 0x38]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
cmp r14b, 1
jne 0x14001a662
mov rcx, rdi
call fcn.140077a00
mov al, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14001ae90
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edi, edi
lea ecx, [rdi + 0x61]
call fcn.140029ab4
mov rsi, rax
test rax, rax
je 0x14001aed6
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.ntoskrnl.exe_KeStackAttachProcess
mov ecx, 0x20
call fcn.140029ab4
mov ecx, 0x21
mov rbx, rax
call fcn.140029ab4
mov ecx, 3
mov r14, rax
call fcn.140029ab4
mov ecx, 0x41e6
mov r15, rax
call fcn.14007a1f0
mov ecx, 0x42
mov ebp, eax
call fcn.140029ab4
test rbx, rbx
je 0x14001af46
test r14d, r14d
je 0x14001af46
test r15, r15
je 0x14001af46
test ebp, ebp
je 0x14001af46
cmp ebp, eax
jae 0x14001af46
mov ecx, ebp
call fcn.14007a130
test eax, eax
je 0x14001af46
cmp eax, r14d
jae 0x14001af46
mov edi, eax
mov ecx, eax
add rdi, r15
call fcn.14001a7b4
test rsi, rsi
je 0x14001af55
lea rcx, [rsp + 0x20]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x14001b12c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x46005c
mov dword [rsp + 0x24], 0x6c0069
mov dword [rsp + 0x28], 0x530065
mov dword [rsp + 0x2c], 0x730079
mov dword [rsp + 0x30], 0x650074
mov dword [rsp + 0x34], 0x5c006d
mov dword [rsp + 0x38], 0x410052
mov dword [rsp + 0x3c], 0x57
call fcn.14001af80
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret

Function at 0x14001b410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, rcx
xor ebx, ebx
mov ecx, 0x7f8
mov dword [rbp - 0x40], ebx
mov edi, edx
call fcn.140029ab4
mov rsi, rax
test rax, rax
je 0x14001b4cd
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x38]
mov edx, edi
mov rcx, r14
mov dword [rbp - 0x38], 0x73707746
mov dword [rbp - 0x34], 0x6944324c
mov dword [rbp - 0x30], 0x74617073
mov dword [rbp - 0x2c], 0x61546863
mov dword [rbp - 0x28], 0x41656c62
mov dword [rbp - 0x24], 0x6c47646e
mov dword [rbp - 0x20], 0x6c61626f
mov dword [rbp - 0x1c], 0x74655373
mov dword [rbp - 0x18], 0x30
call fcn.140005ac8
cmp al, 1
jne 0x14001b4cd
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x14001b4cd
cmp eax, edi
jae 0x14001b4cd
mov edx, eax
mov ecx, 0x7fe
call fcn.140029bac
mov edx, dword [rbp - 0x40]
mov ecx, 0x7ff
add rdx, rsi
call fcn.140029bac
mov bl, 1
mov al, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14001b4f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, rcx
xor ebx, ebx
mov ecx, 0x7f8
mov dword [rbp - 0x40], ebx
mov edi, edx
call fcn.140029ab4
mov rsi, rax
test rax, rax
je 0x14001b5f9
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x38]
mov edx, edi
mov rcx, r14
mov dword [rbp - 0x38], 0x73707746
mov dword [rbp - 0x34], 0x49706354
mov dword [rbp - 0x30], 0x73694470
mov dword [rbp - 0x2c], 0x63746170
mov dword [rbp - 0x28], 0x62615468
mov dword [rbp - 0x24], 0x6e41656c
mov dword [rbp - 0x20], 0x6f6c4764
mov dword [rbp - 0x1c], 0x736c6162
mov qword [rbp - 0x18], 0x30746553
call fcn.140005ac8
cmp al, 1
je 0x14001b5d0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x38]
mov edx, edi
mov rcx, r14
mov dword [rbp - 0x38], 0x73707746
mov dword [rbp - 0x34], 0x49706354
mov dword [rbp - 0x30], 0x73694470
mov dword [rbp - 0x2c], 0x63746170
mov dword [rbp - 0x28], 0x62615468
mov dword [rbp - 0x24], 0x6553656c
mov dword [rbp - 0x20], 0x3074
call fcn.140005ac8
cmp al, 1
jne 0x14001b5f9
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x14001b5f9
cmp eax, edi
jae 0x14001b5f9
mov edx, eax
mov ecx, 0x7fa
call fcn.140029bac
mov edx, dword [rbp - 0x40]
mov ecx, 0x7fb
add rdx, rsi
call fcn.140029bac
mov bl, 1
mov al, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x14001be0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov eax, 0x790073
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x31]
lea r14d, [rbx + 1]
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x53005c
mov r9b, r14b
mov dword [rbp - 0x25], 0x730079
mov dword [rbp - 0x21], 0x650074
mov dword [rbp - 0x1d], 0x52006d
mov dword [rbp - 0x19], 0x6f006f
mov dword [rbp - 0x15], 0x5c0074
mov dword [rbp - 0x11], eax
mov dword [rbp - 0xd], 0x740073
mov dword [rbp - 9], 0x6d0065
mov dword [rbp - 5], 0x320033
mov dword [rbp - 1], 0x64005c
mov dword [rbp + 3], 0x690072
mov dword [rbp + 7], 0x650076
mov dword [rbp + 0xb], 0x730072
mov dword [rbp + 0xf], 0x66005c
mov dword [rbp + 0x13], 0x700077
mov dword [rbp + 0x17], 0x63006b
mov dword [rbp + 0x1b], 0x6e006c
mov dword [rbp + 0x1f], 0x2e0074
mov dword [rbp + 0x23], eax
mov dword [rbp + 0x27], 0x73
call fcn.14002f234
test eax, eax
jne 0x14001bf11
mov edx, dword [rbp - 0x39]
mov rcx, qword [rbp - 0x31]
mov r9, rsi
mov r8, rdi
mov dword [rsp + 0x20], ebx
call fcn.140005d4c
mov rcx, qword [rbp - 0x31]
movzx ebx, bl
cmp al, r14b
cmove ebx, r14d
call fcn.140077564
mov al, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14002837c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ebx, ebx
mov rsi, r8
mov edi, edx
mov dword [rsp + 0x20], ebx
test rcx, rcx
je 0x14002840a
test edx, edx
je 0x14002840a
test r8, r8
je 0x14002840a
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
mov dword [rsp + 0x28], 0x496c6148
mov dword [rsp + 0x2c], 0x5374696e
mov dword [rsp + 0x30], 0x65747379
mov dword [rsp + 0x34], 0x6d
call fcn.140005ac8
cmp al, 1
jne 0x14002840a
mov eax, dword [rsp + 0x20]
test eax, eax
je 0x14002840a
cmp eax, edi
jae 0x14002840a
mov edx, eax
mov ecx, 0x86a
call fcn.140029bac
mov edx, dword [rsp + 0x20]
mov ecx, 0x86b
add rdx, rsi
call fcn.140029bac
mov bl, 1
mov al, bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x140028424
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebx, ebx
mov rbp, rcx
mov edi, edx
lea ecx, [rbx + 0x56]
mov dword [rsp + 0x20], ebx
call fcn.140029ab4
mov rsi, rax
test rax, rax
je 0x1400284cd
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
mov edx, edi
mov rcx, rbp
mov dword [rsp + 0x28], 0x496c6148
mov dword [rsp + 0x2c], 0x6974696e
mov dword [rsp + 0x30], 0x7a696c61
mov dword [rsp + 0x34], 0x6f725065
mov dword [rsp + 0x38], 0x73736563
mov dword [rsp + 0x3c], 0x726f
call fcn.140005ac8
cmp al, 1
jne 0x1400284cd
mov eax, dword [rsp + 0x20]
test eax, eax
je 0x1400284cd
cmp eax, edi
jae 0x1400284cd
mov edx, eax
mov ecx, 0x82f
call fcn.140029bac
mov edx, dword [rsp + 0x20]
mov ecx, 0x830
add rdx, rsi
call fcn.140029bac
mov bl, 1
mov al, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14008c320
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002b0b4
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor r13d, r13d
mov rbx, rcx
mov r12, r8
lea ecx, [r13 + 0x61]
mov esi, edx
mov r15b, r13b
mov qword [r8], r13
call fcn.140029ab4
mov r14, rax
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rax, r14
cmove r14, r13
test r14, r14
je 0x14002b113
lea rdx, [rsp + 0x28]
mov rcx, r14
call sub.ntoskrnl.exe_KeStackAttachProcess
test rbx, rbx
je 0x14002b203
test esi, esi
je 0x14002b203
mov ecx, 0x4c
call fcn.140029ab4
mov ecx, 0x21
mov rbp, rax
call fcn.140029ab4
mov ecx, 3
mov rdi, rax
call fcn.140029ab4
test rbp, rbp
je 0x14002b203
test edi, edi
je 0x14002b203
test rax, rax
je 0x14002b203
mov ecx, ebx
sub ecx, eax
je 0x14002b203
add rax, rcx
cmp rbx, rax
jne 0x14002b203
mov edi, r13d
test esi, esi
je 0x14002b203
sub rcx, rbx
lea r13, [rcx + rbp]
lea rbp, [rbx + r13]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14002b203
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14002b203
mov al, byte [rbx]
cmp byte [rbp], al
jne 0x14002b1ba
inc edi
inc rbx
cmp edi, esi
jb 0x14002b18a
jmp 0x14002b203
xor r13d, r13d
mov edi, r13d
mov ecx, edi
add rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14002b1d6
inc edi
cmp edi, 0x10
jb 0x14002b1c0
test edi, edi
je 0x14002b1fb
lea r9, [rsp + 0x20]
mov r8, rbx
mov edx, edi
mov rcx, rbx
call fcn.1400776fc
cmp al, 1
jne 0x14002b1fb
mov rax, qword [rsp + 0x20]
mov qword [r12], rax
jmp 0x14002b200
or qword [r12], 0xffffffffffffffff
mov r15b, 1
test r14, r14
je 0x14002b212
lea rcx, [rsp + 0x28]
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov al, r15b
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14008c320
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002d6c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov esi, 0x208
xor r14d, r14d
xor ecx, ecx
mov edx, esi
mov edi, r14d
call fcn.140077530
mov rbx, rax
test rax, rax
je 0x14002d856
mov dl, 1
movabs rcx, 0xfffff78000000030
call fcn.14005976c
lea r15d, [r14 + 0x5c]
cmp al, 1
jne 0x14002d76b
lea ecx, [r14 + 0x3a]
movabs rax, 0xfffff78000000032
cmp cx, word [rax]
jne 0x14002d76b
movabs rdx, 0xfffff78000000034
cmp r15w, word [rdx]
jne 0x14002d76b
mov r8d, 0x103
mov rcx, rbx
call fcn.14007d514
mov word [rbx + 0x206], r14w
mov rdi, rbx
jmp 0x14002d856
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x31]
mov dword [rbp + 0xf], 0x53005c
mov dword [rbp + 0x13], 0x730079
mov dword [rbp + 0x17], 0x650074
mov dword [rbp + 0x1b], 0x52006d
mov dword [rbp + 0x1f], 0x6f006f
mov dword [rbp + 0x23], 0x74
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xorps xmm0, xmm0
lea rax, [rbp - 0x31]
lea r8, [rbp - 0x21]
lea rcx, [rbp - 0x49]
movdqu xmmword [rbp - 1], xmm0
mov edx, 1
mov dword [rbp - 0x21], 0x30
mov qword [rbp - 0x19], r14
mov qword [rbp - 0x11], rax
mov dword [rbp - 9], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenSymbolicLinkObject]
test eax, eax
js 0x14002d84e
mov rcx, qword [rbp - 0x49]
lea rdx, [rbp - 0x41]
xor r8d, r8d
mov dword [rbp - 0x41], 0x2080000
mov qword [rbp - 0x39], rbx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySymbolicLinkObject]
test eax, eax
js 0x14002d83f
movzx eax, word [rbp - 0x41]
mov edx, r15d
mov rcx, rbx
shr rax, 1
mov word [rbx + rax*2], r14w
call fcn.14007d5ac
mov rsi, rax
test rax, rax
je 0x14002d83f
cmp r14w, word [rax + 2]
je 0x14002d83f
mov rcx, rax
call fcn.14007d45c
mov rdx, rsi
mov rcx, rbx
lea r8d, [rax + 1]
add r8, r8
call fcn.1400010a0
mov rdi, rbx
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test rdi, rdi
jne 0x14002d856
mov rcx, rbx
call fcn.140077564
mov rax, rdi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14002d92c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x2f], rax
movzx eax, word [rcx]
xor ebx, ebx
mov rsi, r8
lea r12d, [rbx + 0x5c]
mov rdi, rdx
mov dword [rbp + 7], 0x44005c
mov dword [rbp + 0xb], 0x73006f
mov dword [rbp + 0xf], 0x650044
mov dword [rbp + 0x13], 0x690076
mov dword [rbp + 0x17], 0x650063
mov dword [rbp + 0x1b], 0x5c0073
mov dword [rbp + 0x1f], 0x3a0041
mov dword [rbp + 0x23], r12d
lea r14d, [rbx + 1]
cmp r12w, ax
jne 0x14002da17
movabs r15, 0xfffff78000000030
mov dl, r14b
mov rcx, r15
call fcn.14005976c
cmp al, r14b
jne 0x14002d9eb
movzx eax, word [r15]
cmp bx, ax
je 0x14002d9eb
lea edx, [rbx + 0x3a]
movabs rcx, 0xfffff78000000032
cmp dx, word [rcx]
jne 0x14002d9eb
movabs rcx, 0xfffff78000000034
cmp r12w, word [rcx]
je 0x14002da17
mov dword [rbp + 7], 0x53005c
mov dword [rbp + 0xb], 0x730079
mov dword [rbp + 0xf], 0x650074
mov dword [rbp + 0x13], 0x52006d
mov dword [rbp + 0x17], 0x6f006f
mov dword [rbp + 0x1b], 0x74
jmp 0x14002da1b
mov word [rbp + 0x1f], ax
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x49]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x68], pe_nt_image_headers64
mov qword [rsp + 0x60], rbx
xorps xmm0, xmm0
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x48], rbx
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rsp + 0x40], 0x21
mov dword [rsp + 0x38], r14d
lea rax, [rbp - 0x49]
mov dword [rsp + 0x30], 3
lea r9, [rbp - 9]
lea r8, [rbp - 0x39]
lea rcx, [rbp - 0x51]
mov edx, 0x100000
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov dword [rbp - 0x39], 0x30
mov qword [rbp - 0x31], rbx
mov dword [rbp - 0x21], 0x240
mov qword [rbp - 0x29], rax
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
test eax, eax
jne 0x14002daf7
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov rcx, qword [rbp - 0x51]
lea rax, [rbp - 0x59]
mov r8, qword [r8]
xor r9d, r9d
mov edx, r14d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jne 0x14002daed
mov rcx, qword [rbp - 0x59]
mov r8, rdi
mov rdx, rsi
call fcn.14002d884
mov rcx, qword [rbp - 0x59]
movzx ebx, bl
cmp al, r14b
cmove ebx, r14d
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140031064
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x40], rax
and dword [rsp + 0x38], 0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x630041
mov dword [rsp + 0x34], 0x690070
call fcn.140078a80
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret

Function at 0x1400310c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov ecx, 0x2fd
call fcn.140029ab4
mov rbx, rax
test rax, rax
je 0x14003120d
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x48]
call fcn.140031384
cmp al, 1
jne 0x14003120d
mov edx, dword [rbp - 0x50]
mov rcx, qword [rbp - 0x48]
and dword [rbp - 0x2c], 0
lea rax, [rbp - 0x40]
lea r9, [rbp - 0x28]
lea r8, [rbp - 0x38]
mov dword [rbp - 0x38], 0x736f746e
mov dword [rbp - 0x34], 0x6c6e726b
mov dword [rbp - 0x30], 0x6578652e
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x28], 0x43666f49
mov dword [rbp - 0x24], 0x6c706d6f
mov dword [rbp - 0x20], 0x52657465
mov dword [rbp - 0x1c], 0x65757165
mov dword [rbp - 0x18], 0x7473
call fcn.1400058a4
cmp al, 1
jne 0x140031183
mov edx, dword [rbp - 0x40]
mov ecx, 0x300
add rdx, rbx
call fcn.140029bac
mov ecx, 0x1076
call fcn.140029aa4
mov edx, dword [rbp - 0x50]
mov rcx, qword [rbp - 0x48]
mov r8, rax
mov rdi, rax
call fcn.140030d98
cmp al, 1
jne 0x140031204
mov edx, dword [rbp - 0x50]
mov rcx, qword [rbp - 0x48]
xor r9d, r9d
mov r8, rbx
call fcn.140006008
cmp al, 1
jne 0x140031204
lea r8, [rdi + 4]
mov r9d, 0x1c
mov ecx, dword [r8]
and dword [r8 - 4], 0
test ecx, ecx
je 0x1400311ed
lea eax, [rcx + 0x10]
cmp eax, dword [rbp - 0x50]
ja 0x1400311ed
mov dword [r8 - 4], 1
mov rax, qword [rbp - 0x48]
movups xmm0, xmmword [rcx + rax]
movdqu xmmword [r8 + 0xc], xmm0
add r8, 0x30
dec r9
jne 0x1400311c3
lea edx, [r9 + 1]
mov ecx, 0x2ff
call fcn.140029bac
mov rcx, qword [rbp - 0x48]
call fcn.140077564
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x140031ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x460041
mov dword [rsp + 0x34], 0x44
call fcn.140078a80
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x48
ret
Function at 0x140032680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x44005c
mov dword [rsp + 0x24], 0x690072
mov dword [rsp + 0x28], 0x650076
mov dword [rsp + 0x2c], 0x5c0072
mov dword [rsp + 0x30], 0x740041
mov dword [rsp + 0x34], 0x700061
mov dword [rsp + 0x38], 0x69
call fcn.140078a80
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x58
ret

Function at 0x1400329f4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rcx
mov r14d, 0x730079
mov ecx, 0x914
mov rsi, rdx
xor ebx, ebx
mov dword [rbp - 0x29], 0x53005c
mov dword [rbp - 0x25], r14d
mov dword [rbp - 0x21], 0x650074
mov dword [rbp - 0x1d], 0x52006d
mov dword [rbp - 0x19], 0x6f006f
mov dword [rbp - 0x15], 0x5c0074
mov dword [rbp - 0x11], 0x790073
mov dword [rbp - 0xd], 0x740073
mov dword [rbp - 9], 0x6d0065
mov dword [rbp - 5], 0x320033
mov dword [rbp - 1], 0x64005c
mov dword [rbp + 3], 0x690072
mov dword [rbp + 7], 0x650076
mov dword [rbp + 0xb], 0x730072
call fcn.140029ab4
mov dword [rbp + 0xf], 0x61005c
mov dword [rbp + 0x13], 0x610074
cmp eax, 0x1770
jae 0x140032abc
mov dword [rbp + 0x17], 0x690070
mov dword [rbp + 0x1b], 0x73002e
mov qword [rbp + 0x1f], r14
jmp 0x140032ad5
mov dword [rbp + 0x17], 0x6f0070
mov dword [rbp + 0x1b], 0x740072
mov dword [rbp + 0x1f], 0x73002e
mov qword [rbp + 0x23], r14
mov r14d, 1
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x29]
mov r9b, r14b
call fcn.14002f234
test eax, eax
jne 0x140032b1c
mov edx, dword [rbp - 0x39]
mov rcx, qword [rbp - 0x31]
mov r9, rsi
mov r8, rdi
mov dword [rsp + 0x20], ebx
call fcn.140005d4c
mov rcx, qword [rbp - 0x31]
movzx ebx, bl
cmp al, r14b
cmove ebx, r14d
call fcn.140077564
mov al, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret