joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008a7b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14048ee00]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14008a7d0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14008a7d8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14008a7d0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x14008a825
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14008a81c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14008a7d0
add rax, 0x28
cmp rax, r9
jne 0x14008a808
xor eax, eax
ret

Function at 0x14008a830
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14048ee00]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14008a850
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14008a858
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x14008a850
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x14008a8e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14048ee00]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14008a900
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x14008a908
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x14008c290
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x14048ee80]
mov rax, qword [rsi]
test rax, rax
je 0x14008c320
cmp qword [rax + 0x30], 0
jne 0x14008c340
lea rbx, [0x1400a21e8]
mov qword [rax + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [rsi]
test rax, rax
je 0x14008c2f0
cmp qword [rax + 0x30], 0
jne 0x14008c310
lea rdx, [0x1400a21e8]
mov qword [rax + 0x30], rdx
mov rax, rdx
cmp dword [rax], 0xffffffff
je 0x140095100
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140091190
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x14008c2d2
test rax, rax
jne 0x14008c310
call fcn.140091190
nop dword [rax]
mov rax, qword [rax + 0x30]
jmp 0x14008c2e0
call fcn.140091190
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x14008c2b0
test rax, rax
jne 0x14008c340
call fcn.140091190
nop dword [rax]
mov rbx, qword [rax + 0x30]
jmp 0x14008c2bb
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
mov rax, qword [pe_dos_header]
ud2
Function at 0x14008c350
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x14008c462
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x14008c43a
add rax, 1
cmp rax, 0x6b
je 0x14008c457
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x14008c430
cmp edx, 0x6a
je 0x14008c457
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x14008c44b
Function at 0x14008ce70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [0x14048ee80]
mov rax, qword [rsi]
test rax, rax
je 0x14008d060
cmp qword [rax + 0x28], 0
jne 0x14008d048
lea rcx, [0x1404eded8]
cmp dword [rcx], 1
mov qword [rax + 0x28], rcx
je 0x14008d055
call fcn.14008c480
mov rax, qword [rsi]
test rax, rax
je 0x14008cef0
cmp qword [rax + 0x30], 0
jne 0x14008cf10
lea rdx, [0x1400a21e8]
mov qword [rax + 0x30], rdx
mov rax, rdx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x14008cf24
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.140091190
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x14008cec0
test rax, rax
jne 0x14008cf10
call fcn.140091190
nop dword [rax]
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
jne 0x14008cede
call fcn.14008bfc0
cmp qword [0x1404f2050], 0
mov rbx, rax
je 0x14008cede
test rax, rax
je 0x14008cede
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.140093030
cmp eax, 1
je 0x14008d0cd
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rbp
mov dword [rsp + 0x30], 2
mov r8, rdi
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140095106
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [rsi]
test rax, rax
je 0x14008d0a8
cmp qword [rax + 0x30], 0
je 0x14008d090
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140095106
mov r12, rbx
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x14008ceac
mov rax, qword [rsi]
jmp 0x14008ceb9
call fcn.140091190
cmp qword [rax + 0x28], 0
mov rax, qword [rsi]
je 0x14008ce98
test rax, rax
jne 0x14008d048
call fcn.140091190
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x14008ceac
jmp 0x14008ceb1
lea rdx, [0x1400a21e8]
mov qword [rax + 0x30], rdx
mov rax, rdx
jmp 0x14008d01e
call fcn.140091190
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x14008d090
test rax, rax
jne 0x14008d01a
call fcn.140091190
jmp 0x14008d01a
call fcn.14008c350
nop word cs:[rax + rax]
nop dword [rax]
mov rax, qword [0x14048ee80]
mov rdx, qword [rax]
lea rax, [0x1404edee8]
mov qword [rdx + 0x10], rax
ret
Function at 0x140091010
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140091030
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140091078
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140091024
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140091065
Function at 0x140091190
Capabilities:
Check mutex on windows

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x1404edfc0]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x2c]
lea r9, [rsp + 0x30]
movzx eax, byte [rcx]
add rcx, 1
add rdx, 2
mov r8d, eax
and eax, 0xf
shr r8b, 4
add eax, 0x61
add r8d, 0x41
mov byte [rdx - 1], al
mov byte [rdx - 2], r8b
cmp rcx, r9
jne 0x1400911b3
lea rax, [0x1404edfc8]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x1a]
jmp 0x1400911fb
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x1400911f8
lea rax, [0x1404ee000]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x19]
jmp 0x14009122b
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x140091228
xor ecx, ecx
mov byte [0x1404ee019], 0x2d
movabs rax, 0x6161616161616161
movabs rdx, 0x6161616161616161
mov qword [0x1404ee022], rdx
lea r8, [0x1404edfc0]
lea rbx, [0x1404ee01a]
mov qword [0x1404ee032], rdx
mov qword [0x1404ee042], rdx
mov qword [0x1404ee052], rdx
xor edx, edx
mov qword [0x1404ee01a], rax
mov qword [0x1404ee02a], rax
mov qword [0x1404ee03a], rax
mov qword [0x1404ee04a], rax
mov byte [0x1404ee05a], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140091406
lea rcx, [0x1404ee000]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x140091351
lea rsi, [0x1404edf00]
lea r8, [0x1404ee05a]
mov rax, rbx
lea ecx, [rbx + 0x40]
nop dword [rax]
mov edx, ecx
sub edx, eax
bt rsi, rdx
jae 0x1400912fd
mov byte [rax], 0x41
add rax, 1
cmp r8, rax
jne 0x1400912f0
lea rcx, [0x1404ee000]
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x1400913f3
lea rcx, [0x1400910a0]
mov qword [0x1404edf00], rsi
call sub.msvcrt.dll__onexit
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x1404edf00]
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov r8d, 0x5b
lea rdx, [0x1404ee000]
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea r8, [0x1404ee05a]
xor edx, edx
lea r10d, [rbx + 0x40]
mov r11d, eax
mov r9d, 1
mov rax, rbx
test r11d, r11d
je 0x140091426
nop dword [rax]
cmp byte [rax], 0x41
jne 0x1400913a3
mov ecx, r10d
mov rbx, r9
sub ecx, eax
shl rbx, cl
or rdx, rbx
add rax, 1
cmp r8, rax
jne 0x140091390
mov rax, rdx
mov qword [0x1404edf00], rax
lea rsi, [0x1404edf00]
jmp 0x1400913c9
cmp rdx, rsi
je 0x14009132f
mov rdx, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x1400913c0
cmp rdx, rsi
je 0x14009132f
mov qword [rdx + 8], rsi
lea rcx, [0x1400910a0]
call sub.msvcrt.dll__onexit
jmp 0x14009132f
lea rcx, str.failed_to_add_string_to_atom_table_n
call fcn.140091010
xor eax, eax
jmp 0x140091348
lea rcx, str.failed_to_to_lock_creation_mutex_n
call fcn.140091010
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, str.failed_to_get_string_from_atom_n
call fcn.140091010
xor eax, eax
jmp 0x1400913af
Function at 0x140005690
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r14
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor r14d, r14d
xor eax, eax
lock cmpxchg qword [0x1400085e0], rbx
je 0x1400056e2
cmp rax, rbx
jne 0x1400056d5
mov ebx, 1
mov r14d, ebx
jmp 0x1400056e7
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400056b9
mov ebx, 1
mov eax, dword [0x1400085e8]
cmp eax, ebx
jne 0x1400056fd
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x140005766
mov eax, dword [0x1400085e8]
test eax, eax
jne 0x140005760
mov dword [0x1400085e8], ebx
lea r12, [0x1400062e0]
lea rdi, [0x1400062c8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r12
jae 0x140005752
test eax, eax
jne 0x140005756
mov rsi, qword [rdi]
test rsi, rsi
je 0x140005747
mov rcx, rsi
mov rax, qword [0x1400062a0]
call rax
call rsi
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x140005724
test eax, eax
je 0x140005766
mov eax, 0xff
jmp 0x140005847
mov dword [0x140008024], ebx
mov eax, dword [0x1400085e8]
cmp eax, ebx
jne 0x14000578d
lea rdx, [0x1400062c0]
lea rcx, [0x1400062b0]
call sub.msvcrt.dll__initterm
mov dword [0x1400085e8], 2
test r14d, r14d
jne 0x14000579b
xor eax, eax
xchg qword [0x1400085e0], rax
cmp qword [0x140008600], 0
je 0x1400057d3
lea rcx, [0x140008600]
call fcn.140005ab0
test eax, eax
je 0x1400057d3
mov rbx, qword [0x140008600]
mov rcx, rbx
mov rax, qword [0x1400062a0]
call rax
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call rbx
mov r8, qword [0x140008038]
mov rdx, qword [0x140008030]
mov ecx, dword [0x140008028]
call fcn.140001008
mov dword [0x140008020], eax
cmp dword [0x140008040], 0
jne 0x140005803
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140008024], 0
jne 0x140005818
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140008020]
jmp 0x140005847
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
sub rsp, 0x28
call fcn.14012e000
add rsp, 0x28
jmp 0x140005690

Function at 0x1400059ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400059f8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400059f0
cmp dword [rcx + 0x3c], edx
jl 0x1400059f0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400059f0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400059f8
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14003936f
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
push r12
push r13
push r14
push r15
push rbx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov r12, 3
mov r13, 1
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r12
call fcn.1400394e1
add rsp, 0x20
rol eax, 8
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x18]
call fcn.140039505
add rsp, 0x20
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x20]
mov r8, r13
call fcn.1400394b6
add rsp, 0x20
inc r13
mov rbx, rax
mov r14, r12
sub r14, 3
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r14
call fcn.1400394e1
add rsp, 0x20
xor rax, rbx
inc r12
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x10]
mov r8, r12
call fcn.14003948a
add rsp, 0x20
mov r15, 3
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r12
call fcn.1400394e1
add rsp, 0x20
mov rbx, rax
mov r14, r12
sub r14, 3
sub rsp, 0x20
mov rcx, qword [rbp + 0x10]
mov rdx, r14
call fcn.1400394e1
add rsp, 0x20
xor rax, rbx
inc r12
sub rsp, 0x20
mov rcx, rax
mov rdx, qword [rbp + 0x10]
mov r8, r12
call fcn.14003948a
add rsp, 0x20
dec r15
jne 0x140039421
cmp r12, 0x2b
jne 0x14003939a
pop rbx
pop r15
pop r14
pop r13
pop r12
leave
ret

Function at 0x140039704
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
push r12
push rbx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rdx, qword [rbp + 0x10]
mov r12, 4
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x18]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x28]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x20]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x30]
xlatb
xor cl, al
mov dword [rbp - 0x10], ecx
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x28]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x20]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x30]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x18]
xlatb
xor cl, al
mov eax, dword [rbp - 0x10]
shl eax, 8
mov al, cl
mov dword [rbp - 0x10], eax
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x20]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x30]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x18]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x28]
xlatb
xor cl, al
mov eax, dword [rbp - 0x10]
shl eax, 8
mov al, cl
mov dword [rbp - 0x10], eax
mov eax, dword [rdx]
bswap eax
mov rbx, qword [rbp + 0x30]
xlatb
mov cl, al
shr eax, 8
mov rbx, qword [rbp + 0x18]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x28]
xlatb
xor cl, al
shr eax, 8
mov rbx, qword [rbp + 0x20]
xlatb
xor cl, al
mov eax, dword [rbp - 0x10]
shl eax, 8
mov al, cl
bswap eax
mov dword [rdx], eax
add rdx, 4
dec r12
jne 0x14003972a
pop rbx
pop r12
leave
ret
Function at 0x14003a451
Capabilities:
Inspect section memory permissions

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x110
push rbx
push r12
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rdx, qword [rbp + 0x10]
mov ebx, dword [rdx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x14003a490
mov rax, 0x40
mov qword [rbp - 0x110], rax
jmp 0x14003a501
mov ebx, dword [rdx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x14003a4b1
mov rax, 0x20
mov qword [rbp - 0x110], rax
jmp 0x14003a501
mov ebx, dword [rdx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x14003a4d2
mov rax, 4
mov qword [rbp - 0x110], rax
jmp 0x14003a501
mov ebx, dword [rdx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x14003a4f3
mov rax, 2
mov qword [rbp - 0x110], rax
jmp 0x14003a501
mov rax, 1
mov qword [rbp - 0x110], rax
mov eax, dword [rdx + 0xc]
add rax, qword [rbp + 0x18]
mov ebx, dword [rdx + 8]
lea r12, [rbp - 0x108]
sub rsp, 0x20
mov rcx, rax
mov rdx, rbx
mov r8, qword [rbp - 0x110]
mov r9, r12
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
add rsp, 0x20
test rax, rax
je 0x14003a549
mov rdx, qword [rbp + 0x10]
mov eax, dword [rdx + 0xc]
add rax, qword [rbp + 0x18]
mov rax, 1
jmp 0x14003a54c
sub rax, rax
pop r12
pop rbx
leave
ret

Function at 0x14003a551
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
mov qword [rbp + 0x10], rcx
mov rcx, qword [rbp + 0x10]
mov ax, word [rcx]
cmp ax, 0x5a4d
jne 0x14003a57e
mov eax, dword [rcx + 0x3c]
add rcx, rax
mov eax, dword [rcx]
cmp eax, 0x4550
jne 0x14003a57e
add rcx, 4
mov rax, rcx
leave
ret
sub rax, rax
leave
ret

Function at 0x14003a5c6
Capabilities:
Terminate process

Disassembly:
sub rsp, 8
sub rsp, 0x20
call fcn.14003a5f7
add rsp, 0x20
test rax, rax
je 0x14003a5e2
add rsp, 8
jmp rax
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x140001000
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
lea rdx, [0x140002030]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov r9d, 0x22
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0x30]
or eax, 4
mov rcx, qword [rsp + 0x48]
mov dword [rcx + 0x30], eax
lea rdx, [0x140002000]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov dword [rsp + 0x40], eax
xor eax, eax
add rsp, 0x78
ret
Function at 0x1400012f0
Capabilities:
Attach user process memory
Delete file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x130
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov qword [rsp + 0xa0], rsp
mov qword [rsp + 0x98], 0
lea rax, [rsp + 0xf0]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x84], 0xc0000001
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0x90], 0
call qword [sym.imp.ntoskrnl.exe_KeGetCurrentIrql]
movzx eax, al
test eax, eax
jle 0x14000137a
xor al, al
jmp 0x1400015f5
mov rax, qword [rsp + 0x140]
cmp qword [rax + 8], 0
je 0x140001398
mov rax, qword [rsp + 0x140]
movzx eax, word [rax]
test eax, eax
jg 0x14000139f
xor al, al
jmp 0x1400015f5
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov qword [rsp + 0x98], rax
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov dword [rsp + 0xb0], 0x30
mov qword [rsp + 0xb8], 0
mov dword [rsp + 0xc8], 0x240
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], 0x800
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xe0]
lea r8, [rsp + 0xb0]
mov edx, 0x100181
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0
jge 0x1400014bd
mov byte [rsp + 0x80], 0
lea rdx, [0x1400015d9]
mov rcx, qword [rsp + 0xa0]
call sub.ntoskrnl.exe__local_unwind
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0
jge 0x140001516
mov byte [rsp + 0x81], 0
lea rdx, [0x1400015e3]
mov rcx, qword [rsp + 0xa0]
call sub.ntoskrnl.exe__local_unwind
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x28]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x90]
mov byte [rax + 0x4c], 1
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0
jge 0x140001572
mov byte [rsp + 0x82], 0
lea rdx, [0x1400015ed]
mov rcx, qword [rsp + 0xa0]
call sub.ntoskrnl.exe__local_unwind
nop
cmp qword [rsp + 0x90], 0
je 0x140001597
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov qword [rsp + 0x90], 0
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
cmp qword [rsp + 0x88], 0
jne 0x1400015bb
cmp qword [rsp + 0x88], 0xffffffffffffffff
je 0x1400015d5
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0x88], 0xffffffffffffffff
mov al, 1
jmp 0x1400015f5
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1400018f0
add rsp, 0x130
pop rdi
ret
Function at 0x140001610
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xc0000001
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jl 0x14000164c
mov rax, qword [rsp + 0x28]
jmp 0x14000164e
xor eax, eax
add rsp, 0x38
ret

Function at 0x140001680
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x24], 0xc0000001
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp qword [rsp + 0x28], 0
jne 0x1400016c0
jmp 0x140001769
mov r8d, 0x31313131
mov edx, 8
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400016ed
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x140001769
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov dword [rsp + 0x20], 0x10000
jmp 0x140001714
mov eax, dword [rsp + 0x20]
add eax, 0x1000
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x20000000
jge 0x14000173a
lfence
movsxd rax, dword [rsp + 0x20]
mov r8d, 0x1000
xor edx, edx
mov rcx, rax
call fcn.140001e00
jmp 0x140001738
jmp 0x140001707
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x140001769
add rsp, 0x48
ret