joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011912c
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 0x10], r12
xchg r12, rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov dword [rsp - 0x28], esi
push rbp
xchg rsp, r9
mov rbp, r9
xchg r9, rsp
sub rsp, 0x80
mov rsi, rsi
xor esi, esi
mov dword [rbp - 0x50], 0x767614b3
sub dword [rbp - 0x50], 0x5908efdf
add dword [rbp - 0x50], 0x25a9a39b
xor dword [rbp - 0x50], 0x107ca6da
sub dword [rbp - 0x50], 0x53516e83
mov dword [rbp - 0x4c], 0x670609b1
sub dword [rbp - 0x4c], 0x1ce26f51
add dword [rbp - 0x4c], 0x5ac537b
sub dword [rbp - 0x4c], 0x4fb4ed4a
mov dword [rbp - 0x48], 0x2d697090
add dword [rbp - 0x48], 0x5e9aa09
sub dword [rbp - 0x48], 0xc165358
xor dword [rbp - 0x48], 0x74c5be2e
sub dword [rbp - 0x48], 0x53e67948
mov dword [rbp - 0x44], 0x663ff21f
add dword [rbp - 0x44], 0x149d524b
xor dword [rbp - 0x44], 0x25a2e973
xor dword [rbp - 0x44], 0xc34702d
sub dword [rbp - 0x44], 0x5337dca6
mov qword [rbp + 0x10], rsi
mov r14, r14
lea ebx, [rsi + 1]
xchg r11, rax
mov r11, qword [rbp + 0x10]
xchg r11, rax
xchg rcx, r14
mov r14, qword [rbp + 0x10]
xchg rcx, r14
xchg r9, rax
mov r9, qword [rbp + 0x10]
xchg r9, rax
and cl, 3
mov r15, r15
shl cl, 3
movzx edx, word [rbp + rax*2 - 0x50]
mov eax, 0x44dfbc71
sub eax, 0xf4b5dfc
sub eax, 0xf7a7f56
xor eax, 0x279a893c
xor eax, 0x595d1d41
shr eax, cl
movzx ecx, al
mov rsp, rsp
xchg rdx, rax
mov rdx, qword [rbp + 0x10]
xchg rdx, rax
xor cx, dx
mov dword [rsp - 0x44], 0x2c3bc02b
mov word [rbp + rax*2 - 0x20], cx
xchg r8, rax
mov r8, qword [rbp + 0x10]
xchg r8, rax
add rax, rbx
mov dword [rsp - 0x1c], 0x7c956ec7
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
cmp rax, 8
jb 0x1401191f2
mov dword [rsp - 0x2c], 0x1fe90b5a
lea rax, [rbp - 0x20]
mov word [rbp - 0x10], si
xorps xmm0, xmm0
mov dword [rsp - 0x1c], ebp
xchg r8, rax
mov qword [rbp - 0x38], r8
xchg r8, rax
lea r9, [rbp - 0x30]
mov dword [rbp - 0x40], 0x35e951f2
sub dword [rbp - 0x40], 0x19f2616d
add dword [rbp - 0x40], 0x4e43a189
add dword [rbp - 0x40], 0x873523e
sub dword [rbp - 0x40], 0x729be43c
lea r8, [rbp - 0x40]
mov dword [rsp - 0x24], 0x607e81da
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
xchg r11, rbp
movups xmmword [r11 - 0x30], xmm0
xchg r11, rbp
call fcn.140133e90
mov dword [rsp - 0x28], 0x6fef279f
xchg r15, rax
mov rdi, r15
xchg r15, rax
test rax, rax
je 0x14011932e
xchg r15, rax
mov rcx, r15
xchg r15, rax
call fcn.14010f794
mov rdi, rdi
test al, al
je 0x14011932e
lea rdx, [rbp - 0x40]
mov dword [rsp - 0x10], 0x74eeeb80
xchg r8, rdi
mov rcx, r8
xchg rdi, r8
call fcn.14010e668
xchg rbp, rbp
test al, al
jne 0x140119331
mov bl, sil
xor eax, eax
mov dword [rsp - 0x1c], 0x7bd15769
lea r11, [rsp + 0x80]
mov rsi, qword [r11 + 0x20]
lea rdi, [rbp - 0x20]
xchg r9, r9
lea ecx, [rax + 8]
rep stosb byte [rdi], al
mov rdi, qword [r11 + 0x28]
mov dword [rsp - 0x18], 0x2c76e4a0
mov al, bl
mov rbx, qword [r11 + 0x18]
xchg rsp, rsi
mov rsi, r11
xchg rsp, rsi
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x14011d7d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r8, r8
sub rsp, 0x230
mov rax, qword [0x140142450]
xchg r13, rcx
mov rbx, r13
xchg rcx, r13
ror rax, 0x25
mov dword [rsp - 0x44], esi
movabs rcx, 0x23d18c3103dfb8a4
add rcx, 0x58696626
sub rcx, 0x3555dfc8
add rcx, 0x322c99ff
add rcx, 0x6e08e338
not rax
mov dword [rsp - 0x44], 0x74b78870
mov edx, 0x77639d04
sub edx, 0x5f15820
sub edx, 0x67f909e4
sub edx, 0x97939fc
add rax, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x34], esp
not rax
call rax
lea rax, [rbx + 8]
mov r10, r10
xorps xmm0, xmm0
mov qword [rbx], rax
nop
movabs rdx, 0xffffffff0a9a226e
xor rdx, 0x693c832d
sub rdx, 0x2bb16db9
sub rdx, 0x31e2ed56
add rdx, 0x7fffffff
add rdx, 0x79edb9cc
xchg rsi, rax
movups xmmword [rsi], xmm0
xchg rsi, rax
movups xmmword [rax + 0x10], xmm0
mov rcx, rcx
movups xmmword [rax + 0x20], xmm0
lea rax, [rsp + 0x20]
nop word [rax + rax]
inc rdx
mov dword [rsp - 0xc], ebx
cmp word [rax + rdx*2], 0
jne 0x14011d8a8
xchg rcx, r10
mov r10, rbx
xchg r10, rcx
xchg r13, rdx
mov qword [rbx + 0x38], r13
xchg r13, rdx
call fcn.140017a38
xor r8d, r8d
mov dword [rsp - 0x2c], esi
mov edx, 0x719e772
add edx, 0x47425c2d
sub edx, 0x268a3299
add edx, 0x50cadd0d
sub edx, 0x1fbea2b1
cmp qword [rbx + 0x38], r8
jbe 0x14011d95e
mov rsi, rsi
lea r9, [rsp + 0x20]
mov r10d, 0x25edd563
xor r10d, 0x50d2dad
add r10d, 0x2b6bedb7
sub r10d, 0x4c4ce586
sub r9, rax
movzx ecx, dx
lea rax, [rax + 2]
mov dword [rsp - 0x28], 0x37a23e66
and cx, r10w
ror edx, 6
ror edx, 1
ror edx, 1
xor cx, word [r9 + rax - 2]
inc r8
mov dword [rsp - 0x20], edx
mov word [rax - 2], cx
cmp r8, qword [rbx + 0x38]
jb 0x14011d926
mov r14, r14
mov rax, rbx
add rsp, 0x230
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
Function at 0x140133e90
Capabilities:
Execute syscall

Disassembly:
xchg r10, rdi
mov rdi, rcx
xchg rdi, r10
mov eax, dword [0x140143004]
cmp qword [0x140143018], 0
jne 0x14008d000
mov dword [rsp - 0x34], ebx
syscall
ret
jmp 0x14008db4a
Function at 0x140136544
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
xchg r10, r10
xchg r10, rdi
mov qword [rsp + 0x18], r10
xchg rdi, r10
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push r12
push r8
mov qword [rsp], r14
mov rbp, rsp
mov dword [rsp - 0x20], ecx
sub rsp, 0x70
xchg r8, rdx
mov rdi, rdx
xchg r8, rdx
xchg rdx, r15
mov r14, r15
xchg rdx, r15
xchg rbp, rcx
mov rsi, rbp
xchg rbp, rcx
movabs r12, 0x42a81dbb3bf7aec5
sub r12, 0x2268fbe5
xor r12, 0x11ecde7c
add r12, 0x715a9dd3
cmp r9d, 0x60001
jne 0x14013675a
mov dword [rsp - 0x38], 0x7afbb66b
mov dword [rbp - 0x40], 0x2c96aa00
xor dword [rbp - 0x40], 0x4030f579
xor dword [rbp - 0x40], 0x1f6b2bb6
sub dword [rbp - 0x40], 0xa6d8215
add dword [rbp - 0x40], 0x39b11ddb
xor edx, edx
mov dword [rbp - 0x3c], 0x756de88
add dword [rbp - 0x3c], 0x63a8d5fd
sub dword [rbp - 0x3c], 0x36253bb2
sub dword [rbp - 0x3c], 0x1bc5c20f
xor dword [rbp - 0x3c], 0xa9413883
mov dword [rbp - 0x38], 0x373c24b7
sub dword [rbp - 0x38], 0x13b9757f
add dword [rbp - 0x38], 0x3f59da7e
xor dword [rbp - 0x38], 0x11bc2fb8
add dword [rbp - 0x38], 0x7f1fe95
mov ecx, edx
mov eax, 0x49ef4d1a
xor eax, 0x3800eff2
sub eax, 0x608d80b9
xor eax, 0x5a145df7
add eax, 0x2af1e9fc
rol eax, cl
xor al, byte [rbp + rdx - 0x40]
mov dword [rsp - 0x10], ebx
mov byte [rbp + rdx - 0x34], al
inc rdx
cmp rdx, 0xc
xchg rcx, rcx
jb 0x140136633
mov r9d, 0xd8fadc4
sub r9d, 0x53766a2
add r9d, 0x6e580e95
sub r9d, 0x76b045b8
mov qword [rsp + 0x20], 0x1fa4e404
add qword [rsp + 0x20], 0x53f3a98f
sub qword [rsp + 0x20], 0x21315a6e
sub qword [rsp + 0x20], 0x1d448928
xor qword [rsp + 0x20], 0x3522a9f1
lea r8, [rbp - 0x34]
xchg rsp, rdx
mov rsp, rdi
xchg rdx, rsp
xchg r14, rbp
mov rcx, rbp
xchg rbp, r14
call fcn.140133ad4
xchg r10, rbx
mov r10, rax
xchg rbx, r10
lea rdi, [rbp - 0x34]
mov dword [rsp - 0x38], ebx
xor eax, eax
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
mov rdi, rdi
test rbx, rbx
je 0x140136797
lea rdx, [rbp - 0x28]
lea rcx, [rbx + 0xc]
mov dword [rsp - 0x14], ebx
call fcn.14008f3c0
test dword [rbp - 7], 0x1000
jne 0x140136797
mov r10, r10
cmp byte [rbp - 0x1d], 0xe8
jne 0x140136797
lea rdx, [rbx + 0xc]
xchg r14, rcx
mov r14, rcx
xchg rcx, r14
call fcn.140084bf0
movzx edx, byte [rbp - 0x28]
xchg r11, r11
add edx, dword [rbp - 0x13]
add edx, eax
mov rax, qword [rsi + 8]
mov dword [rsp - 0x30], ebp
xor rax, r12
add rdx, rax
xor rdx, r12
xchg r8, r8
xchg rdi, rdx
mov qword [rsi + 0x20], rdi
xchg rdi, rdx
cmp qword [rsi + 0x20], r12
setne al
mov dword [rsp - 0x44], 0x166d2d0b
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
xchg r15, r15
xchg rdi, rsi
mov rsi, qword [r11 + 0x30]
xchg rsi, rdi
mov rsp, r11
mov r13, r13
pop r14
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rbp
ret
xor al, al
jmp 0x140136769
Function at 0x140679058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406791df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140679089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14067906f
add dl, dl
jne 0x140679096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406790f6
xor eax, eax
add dl, dl
jne 0x1406790a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406791ad
add dl, dl
jne 0x1406790b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406790c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406790d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406790dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406790ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14067907e
mov eax, 1
add dl, dl
jne 0x140679106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140679113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406790fb
sub eax, ebx
mov ebx, 1
jne 0x14067914c
mov ecx, 1
add dl, dl
jne 0x14067912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14067913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140679123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14067907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140679168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140679175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14067915d
cmp eax, 0x7d00
jae 0x14067919b
cmp eax, 0x500
jb 0x140679196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14067907e
cmp eax, 0x7f
ja 0x14067919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14067907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406791d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14067907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002c90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x80
xor r13d, r13d
mov r14, rcx
mov ebp, r13d
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
mov dl, 1
lea rcx, [r14 + 0x38]
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
xor eax, eax
lea rcx, [r14 + 0x30]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
mov rax, qword [r14 + 0x10]
mov r15, qword [r14]
cmp r15, rax
jne 0x140002cf0
mov rax, qword [r14 + 0x18]
mov qword [r14], rax
lea rcx, [rsp + 0x60]
mov byte [rax], bpl
mov rax, qword [r14]
mov qword [r14 + 8], rax
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
xor eax, eax
mov rbx, r15
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
cmp byte [r15], al
je 0x140002dd6
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], rdi
movsx eax, byte [rbx]
mov esi, eax
and al, 0x7f
shr esi, 7
and sil, 1
mov byte [rbx], al
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], r13b
jne 0x140002d44
mov rcx, qword [r14 + 0x28]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r13
xor r9d, r9d
mov qword [rsp + 0x38], r13
xor r8d, r8d
mov dword [rsp + 0x30], edi
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov ebp, eax
test sil, sil
jne 0x140002db7
or rcx, 0xffffffffffffffff
nop word [rax + rax]
cmp byte [rbx + rcx + 1], r13b
lea rcx, [rcx + 1]
jne 0x140002d90
xor edx, edx
mov word [rcx + rbx - 2], 0xa
mov r9, rbx
lea r8, [0x1400388b0]
lea ecx, [rdx + 0x65]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
inc rbx
add rbx, rdi
cmp byte [rbx], r13b
jne 0x140002d30
mov rdi, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xb0]
lea rcx, [r14 + 0x38]
mov byte [r15], r13b
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
mov rbx, qword [rsp + 0xc0]
mov eax, ebp
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140003120
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
xor ebp, ebp
mov rdi, rcx
and edx, 1
jne 0x14000314b
mov rax, cr8
cmp al, 0xd
jae 0x14000314b
mov sil, 1
jmp 0x14000314e
xor sil, sil
or rbx, 0xffffffffffffffff
cmp qword [0x1400a8ad0], rbp
je 0x14000320d
test edx, edx
jne 0x1400031f4
mov rax, cr8
test al, al
jne 0x1400031f4
movzx eax, byte [0x1400a8b61]
test al, al
je 0x1400031f4
call fcn.140004af0
test al, al
jne 0x14000320d
lea rcx, [0x1400a8ac0]
call fcn.140002c90
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov rax, rbx
inc rax
cmp byte [rdi + rax], bpl
jne 0x1400031a6
mov rcx, qword [0x1400a8ae8]
xor r9d, r9d
mov qword [rsp + 0x40], rbp
xor r8d, r8d
mov qword [rsp + 0x38], rbp
xor edx, edx
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov rcx, qword [0x1400a8ae8]
lea rdx, [rsp + 0x50]
call fcn.14002ca20
jmp 0x14000320b
test sil, sil
je 0x1400031fc
or byte [rcx], 0x80
lea rdx, [0x1400a8ac0]
call fcn.140002bb0
and byte [rdi], 0x7f
mov ebp, eax
test sil, sil
je 0x140003239
cmp byte [rdi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140003212
xor edx, edx
mov word [rbx + rdi - 2], 0xa
mov r9, rdi
lea r8, [0x1400388b0]
lea ecx, [rdx + 0x65]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rbx, qword [rsp + 0x70]
mov eax, ebp
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140005070
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1400a6a50]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, cr3
mov cr3, rcx
xor eax, eax
lea rbx, [r11 - 0x38]
mov qword [r11 - 0x38], rax
xor edi, edi
mov qword [r11 - 0x30], rax
movabs r14, 0x1ffffffffff000
mov qword [r11 - 0x28], rax
lea esi, [rax + 4]
mov qword [r11 - 0x20], rax
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [0x1400a8d48]
add rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
xor rax, qword [rbx]
add rdi, 0x1000
and rax, r14
xor rax, qword [rbx]
lea rbx, [rbx + 8]
or rax, 1
mov qword [rbx - 8], rax
sub rsi, 1
jne 0x1400050d0
mov cr3, rbp
mov ecx, 0x280a
vmwrite rcx, qword [rsp + 0x20]
mov ecx, 0x280c
vmwrite rcx, qword [rsp + 0x28]
mov ecx, 0x280e
vmwrite rcx, qword [rsp + 0x30]
mov ecx, 0x2810
vmwrite rcx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140038290
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x1400147e0
Capabilities:
Map section object

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rdi, r9
mov rsi, r8
mov r12, rdx
mov r14, rcx
xor r13d, r13d
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x78], r13
test r9, r9
je 0x14001482c
mov qword [r9], r13
call qword [sym.imp.ntoskrnl.exe_ObfReferenceObject]
lea rdx, [rsp + 0x50]
mov rcx, r14
call sub.ntoskrnl.exe_FsRtlGetFileSize
mov ebx, eax
test eax, eax
js 0x1400149a9
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x1400149a4
cmp rsi, rax
jg 0x1400149a4
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], r13
mov dword [rsp + 0x98], 0x240
mov qword [rsp + 0x90], r13
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], 0x8000000
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], r13
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xf001f
mov r9, r14
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_FsRtlCreateSectionForDataScan]
mov ebx, eax
test eax, eax
js 0x1400149a9
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], 0x100000
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rsp + 0x60]
or rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov ebx, eax
test eax, eax
js 0x14001498c
mov r8, rsi
mov r15, qword [rsp + 0x60]
mov rdx, r15
mov rcx, r12
call fcn.140038440
mov ebx, r13d
mov dword [rsp + 0x58], ebx
jmp 0x14001496b
test rdi, rdi
je 0x14001497f
mov rax, qword [rsp + 0x50]
cmp rsi, rax
cmovb rax, rsi
mov qword [rdi], rax
mov rdx, r15
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1400149a9
mov ebx, 0xc000011e
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400149d0
Capabilities:
Get file attributes
Map section object

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov rax, qword [0x1400a6a50]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov rsi, r9
mov r14, r8
mov r12, rdx
mov qword [rsp + 0xb0], r8
mov qword [rsp + 0xb8], r9
xor r13d, r13d
mov qword [rsp + 0x60], r13
mov qword [rsp + 0xa0], r13
test r9, r9
je 0x140014a26
mov qword [r9], r13
mov dword [rsp + 0x70], 0x30
mov qword [rsp + 0x78], r13
mov dword [rsp + 0x88], 0x240
mov qword [rsp + 0x80], rcx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x90], xmm0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 3
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0x70]
mov edx, 0x80100000
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov edi, eax
cmp eax, 0xc0000043
jne 0x140014ab7
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0x70]
mov edx, 0x80100000
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov edi, eax
test edi, edi
js 0x140014c45
mov dword [rsp + 0x20], 5
mov r9d, 0x18
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov edi, eax
test eax, eax
js 0x140014c3a
mov rbx, qword [rsp + 0xe8]
mov qword [rsp + 0xa8], rbx
test rbx, rbx
je 0x140014c35
cmp r14, rbx
jg 0x140014c35
mov dword [rsp + 0x70], 0x30
mov qword [rsp + 0x78], r13
mov dword [rsp + 0x88], 0x240
mov qword [rsp + 0x80], r13
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x90], xmm0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 2
xor r9d, r9d
lea r8, [rsp + 0x70]
mov edx, 0xf001f
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwCreateSection]
mov edi, eax
test eax, eax
js 0x140014c3a
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], 0x100000
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rsp + 0x60]
or rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov edi, eax
test eax, eax
js 0x140014c28
mov r8, r14
mov r15, qword [rsp + 0x60]
mov rdx, r15
mov rcx, r12
call fcn.140038440
mov edi, r13d
mov dword [rsp + 0x58], r13d
jmp 0x140014c08
test edi, edi
jne 0x140014c1b
test rsi, rsi
je 0x140014c1b
cmp r14, rbx
cmovb rbx, r14
mov qword [rsi], rbx
mov rdx, r15
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x140014c3a
mov edi, 0xc000011e
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.140038290
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140015b20
Capabilities:
Find process by pid

Disassembly:
push rdi
sub rsp, 0x40
cmp byte [0x1400aca40], 0
mov edi, ecx
jne 0x140015c51
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
call fcn.140004a20
mov rcx, qword [0x1400aca10]
xor r13d, r13d
mov r14d, r13d
mov r12, rax
xor bpl, bpl
call sub.ntoskrnl.exe_ExAcquireFastMutex
mov rcx, qword [0x1400aca10]
mov rbx, qword [rcx + 0x38]
cmp rbx, qword [rcx + 0x40]
je 0x140015c2e
mov qword [rsp + 0x68], rsi
lea rsi, [rbx + 0x18]
mov qword [rsp + 0x20], r15
mov r15d, edi
mov rax, r12
sub rax, qword [rsi - 8]
cmp rax, r15
jbe 0x140015c09
mov rcx, qword [rbx]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], r13
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140015be2
mov rcx, qword [rsp + 0x58]
cmp rcx, qword [rsi - 0x10]
jne 0x140015bd7
call qword [sym.imp.ntoskrnl.exe_PsGetProcessExitStatus]
mov rcx, qword [rsp + 0x58]
cmp eax, 0x103
jne 0x140015bd7
mov r14, qword [rbx]
mov bpl, 1
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test bpl, bpl
jne 0x140015c1d
mov rdi, qword [0x1400aca10]
mov rdx, rsi
mov rcx, rbx
mov r8, qword [rdi + 0x40]
sub r8, rsi
call fcn.140038440
add qword [rdi + 0x40], 0xffffffffffffffe8
mov rcx, qword [0x1400aca10]
jmp 0x140015c11
add rbx, 0x18
add rsi, 0x18
cmp rbx, qword [rcx + 0x40]
jne 0x140015b91
jmp 0x140015c24
mov rcx, qword [0x1400aca10]
mov rsi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x20]
call sub.ntoskrnl.exe_ExReleaseFastMutex
mov r13, qword [rsp + 0x30]
test bpl, bpl
mov rbp, qword [rsp + 0x60]
mov r12, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x50]
jne 0x140015c57
mov r14, qword [rsp + 0x28]
add rsp, 0x40
pop rdi
ret
mov edx, r14d
mov ecx, 1
call fcn.140015ff0
int3

Function at 0x140016580
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
mov r8, rcx
cmp word [rcx], ax
jne 0x1400165d1
movsxd r9, dword [rcx + 0x3c]
mov ecx, edx
lea rax, [r9 + 4]
cmp rax, rcx
jae 0x1400165d1
cmp dword [r9 + r8], 0x4550
jne 0x1400165d1
mov eax, 0x8664
cmp word [r9 + r8 + 4], ax
jne 0x1400165d1
lea rax, [r8 + 0xf8]
add rcx, r8
add rax, r9
cmp rax, rcx
jae 0x1400165d1
cmp word [r9 + r8 + 0x5c], 1
jne 0x1400165d1
mov al, 1
ret
xor al, al
ret

Function at 0x14001e690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rdx, rcx
mov eax, 0xf5
mov r8, rcx
mov r9d, 0x18
lea r10, [rdx - 0xa4d9bc]
nop dword [rax + rax]
movzx edx, byte [r10 + r8]
xor dl, al
inc eax
mov byte [r8], dl
and eax, 0x800000ff
jge 0x14001e6cc
dec eax
or eax, 0xffffff00
inc eax
inc r8
sub r9, 1
jne 0x14001e6b0
mov byte [rcx + 0x18], r9b
mov rax, rcx
ret