joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7fff25da3b50
Capabilities:
Map section object

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov r15, r8
mov r12, rdx
mov rdi, rcx
xor esi, esi
xor r14d, r14d
xor ebx, ebx
call qword [sym.imp.ntdll.dll_RtlIsCurrentProcess]
nop dword [rax + rax]
test al, al
je 0x7fff25da3bcd
mov rcx, rbx
test rbx, rbx
jne 0x7fff25da3bf2
mov rax, rbx
neg rax
sbb rdi, rdi
and rdi, rcx
test rbx, rbx
jne 0x7fff25df4710
lea r11, [rsp + 0xa0]
mov eax, 1
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
lea r8, [rbp + 7]
mov rcx, rdi
lea rdx, [rbp + 0x7f]
call qword [sym.imp.ntdll.dll_RtlWow64GetSharedInfoProcess]
nop dword [rax + rax]
test eax, eax
js 0x7fff25da3b8e
cmp byte [rbp + 0x7f], bl
je 0x7fff25da3b8e
jmp 0x7fff25df462c
lea rsi, [rbx + 8]
jmp 0x7fff25da3b96
test byte [rbp + 0xb], 2
jne 0x7fff25df4639
xor ecx, ecx
jmp 0x7fff25da3b96
mov rdx, qword [rbp + 0x17]
test rdx, rdx
je 0x7fff25da3b8e
and qword [rbp - 0x19], rbx
lea r9, [rbp - 0x19]
and qword [rbp - 0x11], rbx
or r8, 0xffffffffffffffff
and qword [rbp - 9], rbx
mov rcx, rdi
mov dword [rsp + 0x30], 6
and dword [rsp + 0x28], ebx
and dword [rsp + 0x20], ebx
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
nop dword [rax + rax]
test eax, eax
js 0x7fff25df46d8
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 9]
mov dword [rsp + 0x48], 4
lea r8, [rbp - 0x11]
mov dword [rsp + 0x40], 0x100000
xor r9d, r9d
mov dword [rsp + 0x38], 2
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0x4000
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
nop dword [rax + rax]
test eax, eax
js 0x7fff25df46d8
mov r14, qword [rbp - 0x19]
mov rbx, qword [rbp - 0x11]
jmp 0x7fff25da3b8e
mov rdx, qword [rbp - 0x11]
test rdx, rdx
je 0x7fff25df46f1
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x7fff25da3b8e
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
nop
jmp 0x7fff25da3b8e
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlWow64PopCrossProcessWorkFromFreeList]
nop dword [rax + rax]
mov rcx, rsi
test rax, rax
jne 0x7fff25df4735
call qword [sym.imp.ntdll.dll_RtlWow64RequestCrossProcessHeavyFlush]
nop dword [rax + rax]
jmp 0x7fff25df476f
lea r8, [rbp - 1]
mov dword [rax + 4], 6
mov rdx, rax
mov qword [rax + 8], r12
mov qword [rax + 0x10], r15
call qword [sym.imp.ntdll.dll_RtlWow64PushCrossProcessWorkOntoWorkList]
nop dword [rax + rax]
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x7fff25df476f
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlWow64PushCrossProcessWorkOntoFreeList]
nop dword [rax + rax]
mov rdx, rbx
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
nop dword [rax + rax]
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
nop
jmp 0x7fff25da3bab
Function at 0x7fff25da40a0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov r12, rcx
mov ebp, 0x530
xor ecx, ecx
mov edx, ebp
call sym.KERNELBASE.dll_LocalAlloc
xor edi, edi
mov rbx, rax
test rax, rax
je 0x7fff25df487f
lea r9, [rsp + 0x60]
mov r8d, ebp
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov r14d, dword [rbx]
mov r15d, eax
test eax, eax
js 0x7fff25da4122
test r14d, r14d
je 0x7fff25df4870
lea rax, [rbx + 0x18]
cmp qword [rax], r12
je 0x7fff25da4159
inc edi
add rax, 0x128
cmp edi, r14d
jb 0x7fff25da410b
jmp 0x7fff25df4870
mov rcx, rbx
call sym.KERNELBASE.dll_LocalFree
cmp r15d, 0xc0000004
jne 0x7fff25df485d
imul eax, r14d, 0x128
add eax, 8
cmp eax, ebp
jbe 0x7fff25df4856
mov edx, eax
xor ecx, ecx
mov ebp, eax
call sym.KERNELBASE.dll_LocalAlloc
jmp 0x7fff25da40cc
mov eax, edi
mov edx, 2
imul rcx, rax, 0x128
lea eax, [rdx + 0x7e]
add rcx, 8
add rcx, rbx
movups xmm0, xmmword [rcx]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rsi + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rsi + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rsi + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rsi + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rsi + 0x60], xmm0
add rsi, rax
movups xmm1, xmmword [rcx + 0x70]
add rcx, rax
movups xmmword [rsi - 0x10], xmm1
sub rdx, 1
jne 0x7fff25da4171
movups xmm0, xmmword [rcx]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov rcx, qword [rcx + 0x20]
mov qword [rsi + 0x20], rcx
mov rcx, rbx
call sym.KERNELBASE.dll_LocalFree
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xc0000004
jmp 0x7fff25df4860
mov ecx, r15d
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
jmp 0x7fff25df4884
mov rcx, rbx
call sym.KERNELBASE.dll_LocalFree
mov ecx, 6
jmp 0x7fff25df4884
mov ecx, 0x5aa
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor eax, eax
jmp 0x7fff25da41de
Function at 0x7fff25da4300
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test r9d, r9d
jne 0x7fff25da4398
mov qword [rbp - 0x40], rdx
mov rcx, rdx
test rcx, rcx
js 0x7fff25df48b7
mov r9d, 8
mov dword [rsp + 0x20], 0xe
lea r8, [rbp - 0x40]
mov rcx, rsi
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25da440a
test rdi, rdi
jne 0x7fff25da438f
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.7fff25dce640
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rbp - 0x40]
mov qword [rdi], rax
jmp 0x7fff25da436d
sub r9d, 1
jne 0x7fff25da43d4
mov r9d, 8
mov dword [rsp + 0x20], 0xe
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25da440a
mov rcx, qword [rbp - 0x40]
add rcx, rbx
mov qword [rbp - 0x40], rcx
jmp 0x7fff25da4332
cmp r9d, 1
jne 0x7fff25df48b0
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x38]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25da440a
mov rcx, qword [rbp - 0x20]
jmp 0x7fff25da43c8
mov ecx, eax
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25da4372
mov ecx, 0x57
jmp 0x7fff25df48bc
mov ecx, 0x83
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
nop
jmp 0x7fff25da4411
Function at 0x7fff25da46d0
Capabilities:
Map section object

Disassembly:
push rbx
sub rsp, 0x70
mov r10d, dword [rsp + 0xb0]
mov r11d, edx
mov rbx, rcx
lea eax, [r10 - 0x40]
cmp eax, 0xffffffbe
jbe 0x7fff25df492c
mov rax, qword [rsp + 0xa0]
mov ecx, edx
btr ecx, 0x1f
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xa8]
test edx, edx
mov qword [rsp + 0x58], rax
cmovns ecx, edx
mov dword [rsp + 0x54], r8d
sar r11d, 0x1f
mov edx, ecx
and r11d, 0x2000
mov dword [rsp + 0x50], r9d
btr edx, 0x1d
mov eax, ecx
mov r9d, 0x20000000
mov r8d, r11d
and eax, r9d
cmove edx, ecx
or r8d, r9d
test eax, eax
mov ecx, edx
mov eax, edx
mov r9d, 0x40000000
cmove r8d, r11d
btr ecx, 0x1e
and eax, r9d
cmove ecx, edx
cmp ecx, 0x21
je 0x7fff25df4943
cmp ecx, 1
je 0x7fff25da4825
test cl, 2
jne 0x7fff25da47fb
test cl, 4
je 0x7fff25da480c
test cl, 0x20
jne 0x7fff25df4952
neg eax
sbb edx, edx
and edx, r9d
add edx, 2
mov dword [rsp + 0x48], edx
lea eax, [r10 + 1]
xor ecx, ecx
cmp r10d, 0xffffffff
cmovne ecx, eax
lea rax, [rsp + 0x60]
or ecx, r8d
xor r9d, r9d
mov dword [rsp + 0x40], ecx
lea r8, [rsp + 0x58]
mov dword [rsp + 0x38], 1
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
mov rcx, rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
nop dword [rax + rax]
test eax, eax
js 0x7fff25da481a
mov rax, qword [rsp + 0x58]
add rsp, 0x70
pop rbx
ret
test cl, 0x20
jne 0x7fff25da4834
neg eax
sbb edx, edx
and edx, r9d
add edx, 4
jmp 0x7fff25da4796
neg eax
sbb edx, edx
and edx, r9d
inc edx
jmp 0x7fff25da4796
mov ecx, eax
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25da47f4
neg eax
sbb edx, edx
and edx, r9d
add edx, 8
jmp 0x7fff25da4796
neg eax
sbb edx, edx
and edx, r9d
add edx, 0x40
jmp 0x7fff25da4796
mov ecx, 0x57
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
nop
jmp 0x7fff25da4821
neg eax
sbb edx, edx
and edx, r9d
sub edx, 0xffffff80
jmp 0x7fff25da4796
neg eax
sbb edx, edx
and edx, r9d
add edx, 0x20
jmp 0x7fff25da4796
Function at 0x7fff25da4acc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x80
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov edx, dword [0x7fff25fd0c80]
mov rsi, rcx
xorps xmm0, xmm0
or edx, 8
movups xmmword [rsp + 0x60], xmm0
mov rcx, qword gs:[0x60]
mov r8d, 0x10
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x7fff25df49dc
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
xor edx, edx
mov r9d, 0x30
lea r15, [rdx - 2]
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x7fff25da4bf3
mov eax, dword [rsp + 0x5c]
lea r8, [rbx + 8]
or dword [rbx], 2
lea edx, [r15 + 0x1a]
and qword [rsp + 0x20], 0
lea r9d, [r15 + 6]
mov rcx, r15
mov dword [rbx + 4], eax
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x7fff25da4bf3
or dword [rbx], 4
lea r8, [rbx + 0xc]
and qword [rsp + 0x20], 0
lea edx, [r15 + 0x18]
lea r9d, [r15 + 6]
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x7fff25da4bf3
or dword [rbx], 8
lea rcx, [rsp + 0x60]
and dword [rsp + 0x6c], 0
xor edx, edx
or dword [rsp + 0x60], 0xd
mov dword [rsp + 0x64], 4
mov dword [rsp + 0x68], 1
call fcn.7fff25da4c2c
mov edi, eax
test eax, eax
js 0x7fff25da4bf3
mov qword [rsi], rbx
xor ebx, ebx
xor edi, edi
test rbx, rbx
jne 0x7fff25df49e6
mov eax, edi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.7fff25dce640
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
mov edi, 0xc0000017
jmp 0x7fff25da4bfc
test byte [rsp + 0x60], 7
je 0x7fff25df49f7
mov dl, 1
mov rcx, rbx
call fcn.7fff25da4c2c
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
nop
jmp 0x7fff25da4bfc
Function at 0x7fff25da58c0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov rdi, r8
mov rcx, qword gs:[0x60]
mov r15, rdx
movzx r8d, word [r8 + 2]
xor edx, edx
mov r14d, r9d
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x7fff25df4d72
mov qword [rbp - 0x48], rax
lea r8, [rbp + 0x30]
movzx eax, word [rdi + 2]
lea rdx, [rbp - 0x50]
mov word [rbp - 0x4e], ax
mov rcx, rbx
test r14d, r14d
je 0x7fff25df4d7c
call fcn.7fff25da7688
mov ebx, eax
test eax, eax
js 0x7fff25da5a06
mov rax, qword [rbp - 0x48]
lea r8, [rbp - 0x30]
and qword [rbp - 0x28], 0
xorps xmm0, xmm0
movzx ebx, word [rbp + 0x30]
mov edx, 0x2000000
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x40]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp + 0x40]
neg rax
mov word [rbp - 0x40], bx
mov dword [rbp - 0x30], 0x30
sbb rcx, rcx
mov dword [rbp - 0x18], 0x40
and rcx, qword [rbp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rcx, r15
movdqu xmmword [rbp - 0x10], xmm0
call fcn.7fff25d72648
mov r14d, eax
test eax, eax
js 0x7fff25da5a03
mov rcx, qword [rbp - 0x48]
mov edx, ebx
movzx eax, word [rbp - 0x4e]
shr rdx, 1
sub ax, bx
mov word [rbp - 0x4e], ax
lea r8, [rcx + rdx*2]
movzx ecx, word [rbp - 0x50]
sub cx, bx
mov qword [rbp - 0x48], r8
mov edx, 0x5c
mov word [rbp - 0x50], cx
cmp dx, word [r8]
jne 0x7fff25da59f0
sub cx, 2
sub ax, 2
mov word [rbp - 0x50], cx
mov word [rbp - 0x4e], ax
lea rax, [r8 + 2]
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlCopyUnicodeString]
nop dword [rax + rax]
mov ebx, r14d
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov eax, 0xc000009a
jmp 0x7fff25da5a26
call fcn.7fff25da56bc
nop
jmp 0x7fff25da593b
Function at 0x7fff25da5c30
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [rcx + 0x10]
mov rdi, rcx
mov r14, r8
mov ecx, 0x16a
mov r15, rdx
mov rsi, r9
xor edx, edx
movzx ebp, word [rax]
add bp, cx
mov rcx, qword gs:[0x60]
movzx r8d, bp
add r8, 0x10
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor r12d, r12d
mov rbx, rax
test rax, rax
je 0x7fff25df4df0
mov word [rax + 2], bp
lea r8, [rsp + 0x70]
add rax, 0x10
mov rdx, rbx
mov qword [rbx + 8], rax
mov rcx, rdi
test byte [rdi], 1
je 0x7fff25da5d5e
call fcn.7fff25da7688
mov qword [rsi + 0x10], rbx
mov edi, eax
test eax, eax
js 0x7fff25da5ce5
mov dword [rsi], 0x30
mov qword [rsi + 8], r12
mov dword [rsi + 0x18], 0x40
mov qword [rsi + 0x20], r12
mov qword [rsi + 0x28], r12
test r15, r15
je 0x7fff25da5d01
test r14, r14
je 0x7fff25da5d01
mov eax, edi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
movzx ebp, word [rsp + 0x70]
mov rcx, qword [rbx + 8]
mov edx, 0x5c
call sub.ntdll.dll_wcsrchr
mov rcx, rbx
mov word [rax], r12w
mov rdx, qword [rbx + 8]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x7fff25da5ce5
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov r8, rsi
lea rcx, [rsp + 0x30]
lea edx, [r9 + 0x10]
call fcn.7fff25d72648
mov edi, eax
test eax, eax
jns 0x7fff25da5d68
cmp eax, 0xc0000034
jne 0x7fff25da5ce5
cmp word [rbx], bp
ja 0x7fff25da5d06
jmp 0x7fff25da5ce5
call fcn.7fff25da56bc
jmp 0x7fff25da5cb8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
jmp 0x7fff25da5ce5
mov eax, 0xc0000017
jmp 0x7fff25da5ce7

Function at 0x7fff25da6ed4
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
lea rbx, [rdx + 0x18]
mov rdi, rdx
lea rsi, [rdx + 8]
mov r9, rbx
mov edx, dword [rdx + 0xc]
mov r8d, 1
mov qword [rax - 0x10], rsi
mov rbp, rcx
mov dword [rax - 0x18], 0x120
call qword [sym.imp.ntdll.dll_NtEnumerateKey]
nop dword [rax + rax]
cmp eax, 0x80000005
je 0x7fff25df53fe
test eax, eax
js 0x7fff25da6f2d
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, dword [rsi]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x7fff25df542e
mov eax, 0xc0000017
jmp 0x7fff25da6f2d
mov eax, dword [rsi]
mov r9, rbx
mov edx, dword [rdi + 0xc]
mov r8d, 1
mov qword [rsp + 0x28], rsi
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtEnumerateKey]
nop dword [rax + rax]
nop
jmp 0x7fff25da6f24
Function at 0x7fff25da7c80
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov r9d, 8
mov dword [rsp + 0x20], 0xe
lea r8, [rsp + 0x58]
mov rbx, rcx
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25da7d27
mov rax, qword [rsp + 0x58]
lea r8, [rsp + 0x60]
mov r9d, 8
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x14
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25da7d27
mov rax, qword [rsp + 0x58]
lea r8, [rsp + 0x68]
mov r9d, 8
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x13
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25da7d27
mov eax, 1
add rsp, 0x40
pop rbx
ret
mov ecx, eax
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25da7d20

Function at 0x7fff25da7d40
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x30]
mov r9d, 0x18
lea r8, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25df5830
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
test rbx, rbx
jne 0x7fff25da7db8
or ecx, 0xffffffff
cmp eax, ecx
je 0x7fff25df583f
mov ecx, dword [rsp + 0x30]
mov eax, ecx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0x60
pop rbx
ret
mov rcx, rax
shr rcx, 0x20
mov dword [rbx], ecx
jmp 0x7fff25da7d93
mov ecx, eax
call fcn.7fff25d6b370
or ecx, 0xffffffff
jmp 0x7fff25da7da2
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
nop
jmp 0x7fff25da7d9e

Function at 0x7fff25da8820
Capabilities:
Map section object

Disassembly:
mov qword [rsp + 0x20], r9
sub rsp, 0x68
mov r9d, dword [rsp + 0x98]
test r9d, 0xdf6fdfff
jne 0x7fff25df58d3
mov eax, dword [rsp + 0xa8]
cmp eax, 0xffffffff
jne 0x7fff25df58be
xor eax, eax
or r9d, eax
mov qword [rsp + 0x50], r8
mov eax, dword [rsp + 0xa0]
lea r8, [rsp + 0x88]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x90]
mov dword [rsp + 0x40], r9d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
nop dword [rax + rax]
test eax, eax
js 0x7fff25df58ca
mov rax, qword [rsp + 0x88]
add rsp, 0x68
ret
cmp eax, 0x40
jae 0x7fff25df58d3
inc eax
jmp 0x7fff25da8850
mov ecx, eax
call fcn.7fff25d6b370
jmp 0x7fff25df58e4
mov ecx, 0x57
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor eax, eax
jmp 0x7fff25da88b4
Function at 0x7fff25da9ef0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x20]
call qword [sym.imp.ntdll.dll_RtlAcquirePebLock]
nop dword [rax + rax]
mov rsi, qword [rbx + 0x80]
xor ebp, ebp
mov rbx, rsi
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], bp
jne 0x7fff25da9f2d
inc eax
lea rbx, [rbx + rax*2]
cmp word [rbx], bp
jne 0x7fff25da9f29
sub ebx, esi
lea rcx, [rsp + 0x40]
add ebx, 2
mov rdx, rsi
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlUnicodeToMultiByteSize]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x7fff25df6126
mov rcx, qword gs:[0x60]
mov edx, dword [0x7fff25fd0c80]
mov r8d, dword [rsp + 0x40]
add edx, 0x180000
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x7fff25df616e
mov edx, dword [rsp + 0x40]
mov r9, rsi
xor r8d, r8d
mov dword [rsp + 0x20], ebx
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlUnicodeToOemN]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25df6136
call qword [sym.imp.ntdll.dll_RtlReleasePebLock]
nop dword [rax + rax]
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al