joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458e10
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
mov rbp, qword [0x004d1910]
cmp r8d, 0xfffffff8
mov r12, rcx
mov rax, qword [rbp]
mov qword [rsp + 0x70], rax
mov rax, qword [rbp + 8]
mov qword [rsp + 0x78], rax
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x80], rax
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x88], rax
jl 0x459024
lea eax, [r8*8]
lea rsi, [rsp + 0x70]
lea r15, [rsp + 0x30]
movsxd rbx, r8d
mov r13, rdx
xor r14d, r14d
mov dword [rsp + 0x2c], eax
cmp ebx, 0x3f
movsxd r8, ebx
jle 0x459033
cmp ebx, 0x40
je 0x459040
mov edx, 0x40
cmp edx, 8
mov ecx, edx
mov r11, r15
mov rax, r13
jae 0x459000
xor edx, edx
test cl, 4
je 0x458ebc
mov edx, dword [rax]
mov dword [r11], edx
mov edx, 4
test cl, 2
je 0x458ece
movzx edi, word [rax + rdx]
mov word [r11 + rdx], di
add rdx, 2
and ecx, 1
je 0x458edb
movzx eax, byte [rax + rdx]
mov byte [r11 + rdx], al
cmp ebx, 0x3f
ja 0x458ee5
mov byte [r15 + rbx], pe_nt_image_headers64
lea r11, [r15 + 0x40]
mov rcx, r15
nop dword [rax]
movzx eax, byte [rcx + 2]
movzx edx, byte [rcx + 3]
add rcx, 4
shl eax, 8
mov edi, eax
movzx eax, byte [rcx - 3]
shl eax, 0x10
add eax, edi
add edx, eax
movzx eax, byte [rcx - 4]
shl eax, 0x18
add eax, edx
mov dword [rcx - 4], eax
cmp r11, rcx
jne 0x458ef0
cmp r8d, 0x37
jle 0x45904f
xor r8d, r8d
mov rdx, r15
mov rcx, rsi
sub rbx, 0x40
add r13, 0x40
call dbg.sha256_transform
cmp ebx, 0xfffffff8
jge 0x458e80
mov rax, qword [0x004d1920]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rax + 0x20]
mov qword [rsp + 0x90], rcx
mov rcx, qword [rax + 0x28]
mov qword [rsi + 0x28], rcx
mov rcx, qword [rax + 0x30]
mov rax, qword [rax + 0x38]
mov qword [rsi + 0x30], rcx
mov rcx, r15
mov qword [rsi + 0x38], rax
mov rax, qword [rbp]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x48], rax
call dbg.sha256_transform
xor eax, eax
nop
nop word cs:[rax + rax]
mov edx, dword [r15 + rax]
mov ecx, edx
mov byte [r12 + rax + 3], dl
shr ecx, 8
mov byte [r12 + rax + 2], cl
mov ecx, edx
shr edx, 0x18
shr ecx, 0x10
mov byte [r12 + rax], dl
mov byte [r12 + rax + 1], cl
add rax, 4
cmp rax, 0x20
jne 0x458fb0
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
and edx, 0xfffffff8
xor eax, eax
mov r11d, eax
add eax, 8
mov rdi, qword [r13 + r11]
cmp eax, edx
mov qword [r15 + r11], rdi
jb 0x459005
lea r11, [r15 + rax]
add rax, r13
jmp 0x458eab
lea rsi, [rsp + 0x70]
lea r15, [rsp + 0x30]
jmp 0x458f46
mov ecx, 8
mov rdi, r15
xor eax, eax
rep stosq qword [rdi], rax
test r8d, r8d
movsxd rdx, r14d
cmovns rdx, r8
jmp 0x458e9a
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0x6c], eax
jmp 0x458f27
Function at 0x459060
Capabilities:
Hash data using sha256

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rax, qword [0x004d1910]
xor r8d, r8d
lea rsi, [rsp + 0x20]
mov rbx, rcx
mov rdi, rdx
mov r14, qword [rax]
mov r13, qword [rax + 8]
mov rcx, rsi
mov r12, qword [rax + 0x10]
mov rbp, qword [rax + 0x18]
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], rbp
call dbg.sha256_transform
lea rdx, [rdi + 0x40]
xor r8d, r8d
mov rcx, rsi
call dbg.sha256_transform
mov rax, qword [0x004d1920]
mov rdx, rsi
mov qword [rbx], r14
mov qword [rbx + 8], r13
mov qword [rbx + 0x10], r12
xor r8d, r8d
mov qword [rbx + 0x18], rbp
mov rcx, qword [rax + 0x20]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rax + 0x28]
mov qword [rsi + 0x28], rcx
mov rcx, qword [rax + 0x30]
mov rax, qword [rax + 0x38]
mov qword [rsi + 0x30], rcx
mov rcx, rbx
mov qword [rsi + 0x38], rax
call dbg.sha256_transform
lea rdx, [rbx + 0x20]
mov rcx, rbx
nop dword [rax]
mov eax, dword [rcx]
add rcx, 4
bswap eax
mov dword [rcx - 4], eax
cmp rcx, rdx
jne 0x459110
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x459240
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x258
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x30], edx
add ecx, 1
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x34], 0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
setg al
add rsp, 0x258
ret

Function at 0x459290
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x268
mov rdi, rcx
mov rcx, rdx
mov rbp, rdx
call sym.strlen
lea rbx, [rax + 1]
mov byte [rbp + rax], 0xa
test rbx, rbx
jle 0x459380
lea rax, [rsp + 0x50]
lea r14d, [rdi + 1]
xor esi, esi
lea r13, [rsp + 0x40]
mov r12, qword [sym.imp.WS2_32.dll_select]
mov r15, qword [sym.imp.WS2_32.dll_send]
mov qword [rsp + 0x38], rax
jmp 0x4592ff
sub rbx, rax
add rsi, rax
test rbx, rbx
jle 0x459380
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x58], rdi
mov ecx, r14d
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x20], r13
mov r8, qword [rsp + 0x38]
call r12
test eax, eax
jle 0x459360
xor r9d, r9d
lea rdx, [rbp + rsi]
mov r8d, ebx
mov rcx, rdi
call r15
cdqe
test rax, rax
jns 0x4592f0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4592ff
nop word [rax + rax]
xor eax, eax
add rsp, 0x268
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, 1
jmp 0x459362
Function at 0x464d60
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rdx, qword [rcx]
lea rdi, [0x004d0308]
lea r12, [0x004d03c0]
lea rsi, [rcx + 0xc8]
lea r11, [0x004d05e0]
lea r10, [0x004d0580]
mov r9, rcx
mov ebp, 1
mov ebx, 0x66666667
nop dword [rax]
nop word cs:[rax + rax]
mov rax, qword [r9 + 0x28]
xor rax, qword [r9 + 0x50]
mov r8, r9
xor rax, qword [r9 + 0x78]
mov r14, qword [r9 + 0x20]
mov rcx, r9
xor rax, qword [r9 + 0xa0]
xor r14, qword [r9 + 0x48]
mov r13d, 5
xor r14, qword [r9 + 0x70]
xor r14, qword [r9 + 0x98]
xor r14, qword [r9 + 0xc0]
xor rax, rdx
mov rdx, qword [r9 + 0x10]
xor rdx, qword [r9 + 0x38]
xor rdx, qword [r9 + 0x60]
mov qword [rsp], rax
xor rdx, qword [r9 + 0x88]
mov rax, qword [r9 + 8]
xor rdx, qword [r9 + 0xb0]
xor rax, qword [r9 + 0x30]
xor rax, qword [r9 + 0x58]
mov qword [rsp + 0x20], r14
xor rax, qword [r9 + 0x80]
xor rax, qword [r9 + 0xa8]
mov qword [rsp + 0x10], rdx
mov rdx, qword [r9 + 0x18]
xor rdx, qword [r9 + 0x40]
xor rdx, qword [r9 + 0x68]
xor rdx, qword [r9 + 0x90]
mov qword [rsp + 8], rax
xor rdx, qword [r9 + 0xb8]
mov qword [rsp + 0x18], rdx
rol rax, 1
xor rax, r14
xor qword [rcx], rax
xor qword [rcx + 0x28], rax
xor qword [rcx + 0x50], rax
xor qword [rcx + 0x78], rax
xor qword [rcx + 0xa0], rax
add rcx, 8
cmp r13d, 9
je 0x464ec0
mov eax, r13d
lea r15d, [r13 - 3]
imul ebx
mov eax, r13d
sar eax, 0x1f
sar edx, 1
sub edx, eax
lea eax, [rdx + rdx*4]
mov edx, r13d
add r13d, 1
sub edx, eax
movsxd rax, edx
mov r14, qword [rsp + rax*8]
mov eax, r15d
imul ebx
mov eax, r15d
sar eax, 0x1f
sar edx, 1
sub edx, eax
lea eax, [rdx + rdx*4]
sub r15d, eax
movsxd r15, r15d
mov rax, qword [rsp + r15*8]
jmp 0x464e52
mov r13, qword [r9 + 8]
xor eax, eax
mov ecx, 1
mov edx, 0xa
jmp 0x464eeb
movsxd rdx, dword [r11 + rax]
mov ecx, dword [r10 + rax]
mov r13, r14
lea rdx, [r9 + rdx*8]
add rax, 4
rol r13, cl
cmp rax, 0x60
mov r14, qword [rdx]
mov qword [rdx], r13
jne 0x464ee0
mov r13, qword [r8 + 8]
mov r15, qword [r8 + 0x10]
add r8, 0x28
mov rax, qword [r8 - 0x28]
mov r14, qword [r8 - 0x10]
mov rcx, qword [r8 - 8]
mov rdx, r13
not rdx
and rdx, r15
xor rdx, rax
mov qword [r8 - 0x28], rdx
mov rdx, r15
not rdx
and rdx, r14
xor rdx, r13
mov qword [r8 - 0x20], rdx
mov rdx, r14
not rdx
and rdx, rcx
xor rdx, r15
mov qword [r8 - 0x18], rdx
mov rdx, rcx
not rdx
and rdx, rax
not rax
and rax, r13
xor rdx, r14
xor rax, rcx
mov qword [r8 - 0x10], rdx
mov qword [r8 - 8], rax
cmp rsi, r8
jne 0x464f02
mov rdx, rbp
xor rdx, qword [r9]
cmp rdi, r12
mov qword [r9], rdx
je 0x464f86
mov rbp, qword [rdi]
add rdi, 8
jmp 0x464db0
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x464fa0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp qword [rcx], 0
mov rbx, rcx
mov rbp, rdx
je 0x464fbd
call dbg.oaes_key_destroy.lto_priv.80
mov edx, 1
mov ecx, 0x30
call sym.calloc
mov edx, 1
mov rdi, rax
mov ecx, 0x20
mov qword [rbx], rax
mov qword [rax], 0x20
call sym.calloc
mov rsi, rax
mov qword [rdi + 8], rax
mov rax, qword [rbp]
mov qword [rdi + 0x28], 8
mov qword [rdi + 0x20], 0xf
mov edx, 1
mov qword [rdi + 0x10], 0xf0
mov ecx, 0xf0
mov qword [rsi], rax
mov rax, qword [rbp + 8]
mov qword [rsi + 8], rax
mov rax, qword [rbp + 0x10]
mov qword [rsi + 0x10], rax
mov rax, qword [rbp + 0x18]
lea rbp, [0x004d0470]
mov qword [rsi + 0x18], rax
call sym.calloc
mov rdx, qword [rsi]
mov qword [rdi + 0x18], rax
mov rcx, rdi
lea r11, [rsp + 0x20]
lea rdi, str.cw
mov r8d, 8
mov r9d, 8
mov qword [rax], rdx
mov rdx, qword [rsi + 8]
mov qword [rax + 8], rdx
mov rdx, qword [rsi + 0x10]
mov qword [rax + 0x10], rdx
mov rdx, qword [rsi + 0x18]
mov esi, 0x1c
mov qword [rax + 0x18], rdx
nop
mov eax, dword [rax + rsi]
xor edx, edx
lea r10, [r9*4]
mov dword [rsp + 0x20], eax
mov rax, r9
div r8
test rdx, rdx
je 0x465120
cmp r8, 6
jbe 0x4650b0
cmp rdx, 4
je 0x4651a0
movzx eax, byte [rsp + 0x20]
xor edx, edx
nop word [rax + rax]
mov r13, r9
sub r13, qword [rcx + 0x28]
mov r8, qword [rcx + 0x18]
lea r12, [r8 + rdx]
lea rcx, [r8 + r13*4]
xor al, byte [rcx + rdx]
add rdx, 1
cmp rdx, 4
mov byte [r12 + r10], al
je 0x4650f0
mov rcx, qword [rbx]
movzx eax, byte [rdx + r11]
jmp 0x4650c0
mov rcx, qword [rbx]
add r9, 1
add rsi, 4
mov rax, qword [rcx + 0x20]
shl rax, 2
cmp r9, rax
jae 0x4651e0
mov rax, qword [rcx + 0x18]
mov r8, qword [rcx + 0x28]
jmp 0x465080
movzx eax, word [r11 + 1]
lea r12, [r11 + 4]
mov rdx, r11
mov word [rsp + 0x30], ax
movzx eax, byte [r11 + 3]
mov byte [rsp + 0x32], al
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x33], al
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
test rdx, rdx
je 0x46516f
movzx r13d, byte [rdx]
mov eax, r13d
and r13d, 0xf
shr al, 4
movzx eax, al
shl rax, 4
add rax, rdi
movzx eax, byte [rax + r13]
mov byte [rdx], al
add rdx, 1
cmp r12, rdx
jne 0x46514b
mov rax, r9
xor edx, edx
div r8
movzx eax, byte [rbp + rax - 1]
xor al, byte [rsp + 0x20]
mov byte [rsp + 0x20], al
jmp 0x4650b5
lea rdx, [rsp + 0x20]
lea r12, [rdx + 4]
test rdx, rdx
je 0x4651cd
movzx r8d, byte [rdx]
mov eax, r8d
and r8d, 0xf
shr al, 4
movzx eax, al
shl rax, 4
add rax, rdi
movzx eax, byte [rax + r8]
mov byte [rdx], al
add rdx, 1
cmp r12, rdx
jne 0x4651a9
jmp 0x4650b0
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x494090
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov r9, r8
movsxd rdx, edx
mov r8d, 1
call sym.fwrite
cmp rax, 1
setne al
movzx eax, al
neg eax
add rsp, 0x28
ret

Function at 0x496310
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
lea r8, [rcx + 4]
movsx ecx, byte [rcx + 4]
test ecx, ecx
je 0x496338
mov edx, eax
add r8, 1
shl edx, 5
add edx, ecx
movsx ecx, byte [r8]
add eax, edx
test ecx, ecx
jne 0x496321
repz ret
repz ret

Function at 0x4983a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x004d7704]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x4984b8
mov rax, qword [0x004d7708]
xor ebx, ebx
add rax, 8
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x4983ec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x49849e
add ebx, 1
add rax, 0x18
cmp ebx, ecx
jne 0x4983d0
mov rcx, rsi
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x4984f0
movsxd rbx, ebx
lea rbx, [rbx + rbx*2]
shl rbx, 3
mov r13, rbx
add r13, qword [0x004d7708]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x004d7708]
mov rcx, qword [rax + rbx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4984d3
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x498497
sub eax, 4
and eax, 0xfffffffb
je 0x498497
add rbx, qword [0x004d7708]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4984bf
add dword [0x004d7704], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebx, ebx
jmp 0x4983f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x004d7708]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call dbg.__report_error
nop

Function at 0x498c70
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004d79e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004d79c0]
test rbx, rbx
je 0x498cc4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x498cbb
test rsi, rsi
je 0x498cbb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x498ca0
lea rcx, [0x004d79e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x498f00
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x498f10
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0
Function at 0x498f20
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x498f61
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x498f58
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x498f63
add rax, 0x28
cmp rax, r9
jne 0x498f44
xor eax, eax
repz ret

Function at 0x499000
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x004d1490]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x499020
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x499018
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x49907d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x499074
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x499018
add rdx, 0x28
cmp rdx, r9
jne 0x499060
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x499190
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004d1490]
xor eax, eax
mov rdx, rcx
cmp word [r8], 0x5a4d
je 0x4991b0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4991a8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x49920d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x499204
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x499214
add rax, 0x28
cmp rax, r9
jne 0x4991f0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x499230
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x004d1490]
xor r9d, r9d
mov r8d, ecx
cmp word [r11], 0x5a4d
je 0x499251
mov rax, r9
add rsp, 0x28
ret
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x499249
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x499249
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x499249
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov rcx, r9
jb 0x4992a4
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x4992c0
add rdx, 0x28
cmp rdx, r10
jne 0x499290
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jne 0x4992d8
jmp 0x4992ad
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x4992e6
mov edx, dword [rax + 0xc]
test edx, edx
je 0x4992ad
test r8d, r8d
jg 0x4992d0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x140001304
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
xorps xmm0, xmm0
lea rdx, [rcx + 0x8d0]
mov rbx, rcx
xorps xmm1, xmm1
lea rcx, [rbp - 0x40]
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x20], xmm1
movups xmmword [rbp - 0x30], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rbx + 0x60]
lea rcx, [rbp - 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x140009c10]
lea rcx, [rbp - 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
cmp byte [rbx + 0x20], 0
jne 0x1400013e0
cmp dword [rbx + 0x58], 5
je 0x1400013e0
xor r9d, r9d
lea rdx, [rbp - 0x40]
mov r8b, 1
lea rcx, [rbp - 0x30]
call qword [sym.imp.ntoskrnl.exe_FsRtlIsNameInExpression]
test al, al
je 0x1400013e0
xorps xmm0, xmm0
lea rdx, [0x140009c30]
lea rcx, [rbp - 0x10]
movups xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r9d, r9d
lea rdx, [rbp - 0x20]
mov r8b, 1
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_FsRtlIsNameInExpression]
test al, al
jne 0x1400013e0
lea r9, [rbx + 0x60]
mov r8d, 0xaa
lea rdx, [0x140009c50]
lea rcx, [0x140009c60]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rbx + 0x10]
mov ecx, 5
mov r8d, 0xe60
call fcn.1400020dc
mov rbx, qword [rsp + 0x70]
xor al, al
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x140001df8
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
and qword [rbp + 0x10], 0
lea rdx, [0x14000a060]
lea rcx, [rbp - 0x40]
xor bl, bl
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edx, 0x1f0001
lea rcx, [rbp + 0x10]
call sub.FLTMGR.SYS_FltBuildDefaultSecurityDescriptor
test eax, eax
js 0x140001ebd
mov rcx, qword [0x14000edb8]
lea rax, [rbp - 0x40]
and qword [rbp - 0x28], 0
lea r8, [rbp - 0x30]
and qword [rbp - 8], 0
lea rdx, [0x14000edc0]
mov qword [rbp - 0x20], rax
xor r9d, r9d
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
lea rax, [0x1400022a0]
mov dword [rsp + 0x38], 1
and qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
lea rax, [0x140002240]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x30], 0x30
mov dword [rbp - 0x18], 0x240
call sub.FLTMGR.SYS_FltCreateCommunicationPort
test eax, eax
js 0x140001ebd
mov r8d, 0xc4
lea rdx, [0x14000a090]
lea rcx, [0x14000a0b0]
mov bl, 1
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x140001ecb
call sub.FLTMGR.SYS_FltFreeSecurityDescriptor
mov al, bl
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rbp
ret

Function at 0x140001ee0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
xor ebx, ebx
lea rdx, [0x140009fb0]
lea rcx, [0x140009fd0]
mov qword [rbp + 0x10], rbx
lea r8d, [rbx + 0x75]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x14000a000]
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edx, 0x1f0001
lea rcx, [rbp + 0x10]
call sub.FLTMGR.SYS_FltBuildDefaultSecurityDescriptor
test eax, eax
js 0x140001fbf
mov rcx, qword [0x14000edb8]
lea rax, [rbp - 0x40]
mov qword [rbp - 0x20], rax
lea r8, [rbp - 0x30]
mov rax, qword [rbp + 0x10]
lea rdx, [0x14000edc8]
mov qword [rbp - 0x10], rax
xor r9d, r9d
mov dword [rsp + 0x38], 1
lea rax, [0x140002300]
mov qword [rsp + 0x30], rax
lea rax, [0x1400022d0]
mov qword [rsp + 0x28], rax
lea rax, [0x140002270]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x30], 0x30
mov qword [rbp - 0x28], rbx
mov dword [rbp - 0x18], 0x240
mov qword [rbp - 8], rbx
call sub.FLTMGR.SYS_FltCreateCommunicationPort
test eax, eax
js 0x140001fbf
mov r8d, 0x9a
lea rdx, [0x140009fb0]
lea rcx, [0x14000a030]
mov bl, 1
call sub.ntoskrnl.exe_DbgPrint
mov al, bl
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rbp
ret
Function at 0x1400020dc
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp qword [0x14000edc8], 0
mov rbp, rdx
mov esi, r8d
mov r15d, ecx
mov ebx, 0xc0000001
je 0x140002221
cmp qword [0x14000ede0], 0
je 0x140002221
test rdx, rdx
je 0x140002208
lea rax, [rsi + 0x14]
mov edx, 0x100000
cmp rax, rdx
jae 0x140002208
xor ecx, ecx
mov r8d, 0x64706d73
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x140002221
lea rcx, [rax + 0x14]
xor edx, edx
mov r8d, 0xfffec
call fcn.1400099c0
and dword [rdi + 0x10], 0
lea rcx, [rdi + 0x14]
mov eax, 0x14
mov dword [rdi + 4], r15d
mov r8d, esi
mov dword [rdi], eax
mov rdx, rbp
mov dword [rdi + 0xc], eax
mov dword [rdi + 8], esi
call fcn.140009700
mov edx, 0xbb8
lea rcx, [rsp + 0x78]
call fcn.140006678
mov rcx, qword [0x14000edb8]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9d, [rsi + 0x14]
and qword [rsp + 0x28], 0
lea rdx, [0x14000ede0]
and qword [rsp + 0x20], 0
mov r8, rdi
call sub.FLTMGR.SYS_FltSendMessage
mov ebx, eax
mov r9d, eax
test eax, eax
jns 0x1400021df
lea rcx, [0x14000a140]
mov r8d, 0x14f
jmp 0x1400021ec
lea rcx, [0x14000a170]
mov r8d, 0x153
lea rdx, [0x14000a0e0]
call sub.ntoskrnl.exe_DbgPrint
mov edx, 0x64706d73
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140002221
mov r8d, 0x131
lea rdx, [0x14000a0e0]
lea rcx, [0x14000a100]
call sub.ntoskrnl.exe_DbgPrint
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret