joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
and dword [rax + 8], 0
mov r12, r8
mov r14, rdx
mov r15, rcx
test rcx, rcx
je 0x140001112
test rdx, rdx
je 0x140001112
xor edx, edx
lea r9, [rax + 8]
xor r8d, r8d
lea edi, [rdx + 0xb]
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x140001065
cmp eax, 0xc0000004
je 0x140001065
lfence
jmp 0x140001117
mov edx, dword [rsp + 0x50]
xor ecx, ecx
mov r8d, 0x656e6f4e
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
jne 0x140001089
mov eax, 0xc0000017
jmp 0x140001117
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x50]
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov edi, eax
test eax, eax
js 0x140001100
lfence
xor esi, esi
mov edi, 0xc0000135
cmp dword [rbx], esi
jbe 0x140001100
xor ebp, ebp
movzx eax, word [rbx + rbp + 0x2e]
lea rcx, [rbx + 0x30]
add rax, rbp
mov rdx, r15
add rcx, rax
call fcn.140007364
test eax, eax
je 0x1400010e7
mov eax, dword ds:[rbx]
inc rsi
add rbp, 0x128
cmp rsi, rax
jb 0x1400010b4
jmp 0x140001100
imul rcx, rsi, 0x128
xor edi, edi
mov rax, qword [rcx + rbx + 0x18]
mov qword [r14], rax
mov eax, dword [rcx + rbx + 0x20]
mov qword [r12], rax
mov edx, 0x656e6f4e
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
jmp 0x140001117
mov eax, 0xc000000d
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x140001140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
push r15
movsxd rax, dword [rcx + 0x3c]
xor r9d, r9d
mov r10, rcx
mov r15, rdx
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov ebx, dword [r8 + 0x1c]
mov ebp, dword [r8 + 0x24]
add rbx, rcx
mov r14d, dword [r8 + 0x20]
add rbp, rcx
mov esi, dword [r8 + 0x18]
add r14, rcx
mov ecx, r9d
test rsi, rsi
je 0x1400011ce
mov eax, dword [r14 + rcx*4]
mov r11, r15
movsx rdi, word [rbp + rcx*2]
add rax, r10
sub r11, rax
movzx edx, byte [rax]
movzx r8d, byte [rax + r11]
sub edx, r8d
jne 0x1400011b8
inc rax
test r8d, r8d
jne 0x1400011a3
test edx, edx
je 0x1400011c7
inc rcx
cmp rcx, rsi
jb 0x140001190
jmp 0x1400011ce
mov r9d, dword [rbx + rdi*4]
add r9, r10
mov rbx, qword [rsp + 0x18]
mov rax, r9
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
Function at 0x140001a20
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
and dword [rax + 8], 0
xor esi, esi
test rcx, rcx
je 0x140001b17
mov rdx, rcx
lea rcx, [rax - 0x18]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea ebx, [rsi + 5]
xor r8d, r8d
mov ecx, ebx
lea r9, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov ecx, 0x80000000
mov edx, eax
add eax, ecx
test ecx, eax
jne 0x140001a8c
nop dword [rax + rax]
cmp edx, 0xc0000004
jne 0x140001b17
mov edx, dword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
test rax, rax
je 0x140001b17
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rax
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov ebp, eax
test eax, eax
js 0x140001aff
mov rbx, rdi
cmp dword [rbx], esi
je 0x140001aff
lea rcx, [rbx + 0x38]
xor r8d, r8d
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
nop dword [rax]
test al, al
je 0x140001af3
mov rax, qword [rbx + 0x50]
test rax, rax
je 0x140001af3
cmp dword [rbx + 0x64], 1
jae 0x140001afc
mov eax, dword [rbx]
add rbx, rax
je 0x140001aff
jmp 0x140001ac7
mov rsi, rax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test rsi, rsi
je 0x140001b17
test ebp, ebp
js 0x140001b17
mov eax, esi
jmp 0x140001b19
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140001b40
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
xor edi, edi
cmp qword [0x14000d828], rdi
mov qword [rsp + 0x60], rdi
jne 0x140001b76
lea r8, [0x1400099d0]
xor edx, edx
lea ecx, [rdi + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, 0x80
jmp 0x140001c0f
mov rcx, qword [0x14000d7e0]
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jne 0x140001bfb
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [0x14000d7f0]
lea r8d, [rbx + 8]
lea rdx, [0x14000d828]
call fcn.140001200
lea r8, [0x1400099f0]
xor edx, edx
lea ecx, [rbx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
cmp dword [0x14000d830], edi
jne 0x140001c0d
mov rdi, qword [0x14000d838]
xor eax, eax
mov rcx, qword [0x14000d540]
rep stosb byte [rdi], al
mov rcx, qword [0x14000d838]
call qword [sym.imp.ntoskrnl.exe_MmFreeContiguousMemory]
jmp 0x140001c0d
xor edx, edx
lea r8, [0x140009a00]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140002e60
Capabilities:
Access pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15, r9
mov rbp, r8
mov r12, rdx
mov rsi, rcx
test r8, r8
je 0x140002f4d
test r9, r9
je 0x140002f4d
nop dword [rax + rax]
test rcx, rcx
je 0x140002f32
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov rdi, rax
test rax, rax
jne 0x140002ec5
mov eax, 0xc000007b
jmp 0x140002f52
lea r14, ds:[rax + 0x108]
movzx eax, word [rax + 6]
mov rbx, r14
lea rcx, [rax + rax*4]
lea rax, [r14 + rcx*8]
cmp r14, rax
jae 0x140002f32
mov rdx, r12
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlCompareString]
test eax, eax
je 0x140002f39
movzx eax, word [rdi + 6]
add rbx, 0x28
lea rcx, [rax + rax*4]
lea rax, [r14 + rcx*8]
cmp rbx, rax
jb 0x140002ee5
mov eax, 0xc0000225
jmp 0x140002f52
mov eax, dword [rbx + 0xc]
add rax, rsi
mov qword [rbp], rax
mov eax, dword [rbx + 8]
mov qword [r15], rax
xor eax, eax
jmp 0x140002f52
mov eax, 0xc000000d
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret

Function at 0x140003320
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x60
xor r9d, r9d
lea rdx, [rax - 0x30]
xorps xmm0, xmm0
movups xmmword [rax - 0x30], xmm0
lea r8d, [r9 + 0x20]
lea ecx, [r9 + 0x42]
movups xmmword [rax - 0x20], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov ebx, dword ds:[rsp + 0x38]
xor ecx, ecx
inc ebx
shl ebx, 5
lea edx, [rbx + 4]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov ecx, ebx
xor r9d, r9d
mov rsi, rax
mov rdi, rax
xor eax, eax
mov r8d, ebx
rep stosb byte [rdi], al
lea ecx, [rax + 0x42]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
xor edi, edi
cmp dword [rsi], edi
jbe 0x14000340c
lea rbx, [0x14000dd40]
lea rcx, [rdi + rdi*2]
movups xmm0, xmmword [rsi + rcx*8 + 8]
movsd xmm1, qword [rsi + rcx*8 + 0x18]
movsd qword [rsp + 0x30], xmm1
cmp dword [rsp + 0x30], 0x42777445
movups xmmword [rsp + 0x20], xmm0
jne 0x140003406
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x140003406
movsxd r9, dword [0x14000d85c]
mov rax, qword [rsp + 0x20]
mov rcx, r9
add rcx, rcx
inc r9d
mov dword [0x14000d85c], r9d
mov qword [rbx + rcx*8], rax
mov qword [rbx + rcx*8 + 8], rdx
cmp r9d, 0x2710
jl 0x140003406
xor edx, edx
lea r8, [0x140009b00]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
inc edi
cmp edi, dword [rsi]
jb 0x140003397
mov rcx, rsi
call fcn.140003300
mov rbx, qword [rsp + 0x70]
xor eax, eax
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140003440
Capabilities:
Delete file
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x550
lea r8, [0x14000d840]
lea rdx, [0x1400356a0]
lea rcx, [0x140009a20]
call fcn.140002f74
and dword ss:[rsp + 0x50], 0
lea r9, [rsp + 0x60]
and qword [rsp + 0x48], 0
lea r8, [0x1400356a0]
and qword [rsp + 0x560], 0
lea rcx, [rsp + 0x560]
mov dword [rsp + 0x40], 0x1020
mov r14d, 0x80
mov dword [rsp + 0x38], 1
mov edx, 0x80010000
and dword [rsp + 0x30], 0
mov dword [rsp + 0x28], r14d
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
xor edx, edx
lea r8, [0x140009a40]
mov r9d, eax
mov ebx, eax
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
nop dword [rax]
test ebx, ebx
js 0x14000360c
xor edx, edx
lea r8, [0x140009a50]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x568]
mov rcx, qword [rsp + 0x560]
xor r9d, r9d
and dword [rsp + 0x56c], 0
xor r8d, r8d
and dword [rsp + 0x568], 0
xor edx, edx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], 0x4e0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
js 0x1400035fe
xor edx, edx
lea r8, [0x140009a60]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea rax, [0x14000d860]
lea rdx, [rsp + 0x70]
lea ecx, [r14 - 0x77]
movups xmm0, xmmword ds:[rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rax + 0x30], xmm1
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rax + 0x50], xmm1
movups xmm1, xmmword [rdx + 0x70]
add rdx, r14
movups xmmword [rax + 0x60], xmm0
add rax, r14
movups xmmword [rax - 0x10], xmm1
sub rcx, 1
jne 0x140003579
movups xmm0, xmmword [rdx]
mov dword [0x14000d858], 1
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rax + 0x30], xmm1
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm1
mov rcx, qword [rsp + 0x560]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rcx, [0x1400356a0]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov rbx, qword [rsp + 0x570]
add rsp, 0x550
pop r14
ret
Function at 0x140003640
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
xor esi, esi
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
lea r8, [0x140009b20]
xor edx, edx
lea ecx, [rsi + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov r14, qword [0x14000d890]
mov qword ds:[rsp + 0x28], r14
test r14, r14
je 0x1400037d9
xor r9d, r9d
lea r8d, [rsi + 0x20]
lea rdx, [rsp + 0x48]
lea r15d, [rsi + 0x42]
mov ecx, r15d
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov ebx, dword [rsp + 0x48]
inc ebx
shl ebx, 5
lea edx, [rbx + 4]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
mov qword [rsp + 0x20], rax
mov ecx, ebx
mov rdi, rax
xor eax, eax
rep stosb byte [rdi], al
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
mov ecx, r15d
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov r9, r14
lea r8, [0x140009b30]
xor edx, edx
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
xor ebx, ebx
mov dword ds:[rsp + 0xb0], ebx
cmp ebx, dword [rsi]
jae 0x1400037d9
lea rcx, [rbx + rbx*2]
movups xmm0, xmmword [rsi + rcx*8 + 8]
movups xmmword [rsp + 0x30], xmm0
movsd xmm1, qword [rsi + rcx*8 + 0x18]
movsd qword [rsp + 0x40], xmm1
cmp dword [rsp + 0x40], 0x74706354
jne 0x1400037d2
cmp qword [rsp + 0x38], 0
je 0x1400037d2
xor edi, edi
mov dword [rsp + 0xa8], edi
cmp edi, 0x23fff8
jae 0x1400037d2
and qword [rsp + 0xb8], 0
mov r15d, edi
add r15, qword [rsp + 0x30]
mov r8d, 8
lea rdx, [rsp + 0xb8]
lea rcx, [r15 - 0x120000]
call fcn.140003140
nop dword [rax]
cmp qword [rsp + 0xb8], r14
jne 0x1400037b1
mov rax, qword [0x14000d880]
add qword [r15 - 0x120000], rax
lea r9, [r15 - 0x120000]
lea r8, [0x140009b50]
xor edx, edx
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x1400037cb
inc edi
jmp 0x14000373e
inc ebx
jmp 0x1400036f4
mov rcx, rsi
call fcn.140003300
xor eax, eax
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400043a0
Capabilities:
Access pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
and dword [rax - 0x28], 0
mov r14d, r9d
mov ebx, r8d
mov r15, rdx
mov rbp, rcx
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov rdi, rax
test rax, rax
jne 0x1400043df
mov ebx, dword [rsp + 0x70]
jmp 0x140004467
movzx eax, word [rax + 0x18]
mov ecx, 0x10b
cmp ax, cx
je 0x1400043fd
mov ecx, 0x20b
cmp ax, cx
jne 0x1400043d6
mov rsi, qword [rdi + 0x30]
jmp 0x140004400
mov esi, dword [rdi + 0x34]
mov r8d, 5
lea r9, [rsp + 0x20]
mov dl, 1
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlImageDirectoryEntryToData]
test rax, rax
je 0x14000445f
mov ecx, dword ds:[rsp + 0x20]
test ecx, ecx
je 0x14000445f
mov rdi, rbp
sub rdi, rsi
add rdi, r15
mov edx, dword [rax + 4]
test edx, edx
je 0x1400043d6
sub ecx, edx
lea r8, [rax + 8]
mov dword [rsp + 0x20], ecx
add edx, 0xfffffff8
mov ecx, dword [rax]
mov r9, rdi
add rcx, rbp
shr edx, 1
call fcn.140004260
test rax, rax
je 0x1400043d6
mov ecx, dword [rsp + 0x20]
test ecx, ecx
jne 0x14000442d
jmp 0x140004467
test byte [rdi + 0x16], 1
cmovne ebx, r14d
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140005000
Capabilities:
Map section object

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov eax, dword [0x14000a358]
mov rbx, rcx
movups xmm0, xmmword [0x14000a330]
and qword [rbp + 0x17], 0
movups xmm1, xmmword [0x14000a340]
mov dword [rbp + 7], eax
movzx eax, word [0x14000a35c]
movups xmmword [rbp - 0x21], xmm0
mov word [rbp + 0xb], ax
lea rax, [rbp - 0x21]
movsd xmm0, qword [0x14000a350]
movsd qword [rbp - 1], xmm0
xorps xmm0, xmm0
mov qword [rbp - 0x29], rax
lea rax, [rbp - 0x31]
mov qword [rbp + 0x1f], rax
movdqu xmmword [rbp + 0x2f], xmm0
mov dword [rbp - 0x31], 0x2e002c
movups xmmword [rbp - 0x11], xmm1
mov dword [rbp + 0xf], 0x30
mov dword [rbp + 0x27], 0x240
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalMemoryRanges]
xor edx, edx
lea r8, [rax + 8]
jmp 0x1400050a4
add rcx, qword [r8 - 8]
lea r8, [r8 + 0x10]
cmp rdx, rcx
cmovbe rdx, rcx
mov qword [rbp - 0x39], rdx
mov rcx, qword [r8]
test rcx, rcx
jne 0x140005095
and qword [rbp + 0x7f], rcx
lea r8, [rbp + 0xf]
lea rcx, [rbp + 0x7f]
mov edx, 0xf001f
call qword [sym.imp.ntoskrnl.exe_ZwOpenSection]
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp - 0x39]
and qword [rbp + 0x77], 0
lea r8, [rbp + 0x77]
mov dword [rsp + 0x48], 4
xor r9d, r9d
and dword [rsp + 0x40], 0
or rdx, 0xffffffffffffffff
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov r8, qword [rbp + 0x77]
xor edx, edx
xor r11d, r11d
xor r9d, r9d
xor edi, edi
movabs r14, 0xffffffffff000
xor r10d, r10d
mov r15d, 0x1ff
mov rax, cr3
test r14, rax
je 0x140005152
and rax, r14
mov rdx, rbx
shr rdx, 0x27
and rdx, r15
lea rcx, [r8 + rax]
lea rdx, [rcx + rdx*8]
test byte [rdx], 1
je 0x140005206
test rdx, rdx
je 0x140005178
mov rax, qword [rdx]
mov rcx, rbx
shr rcx, 0x1e
and rax, r14
and rcx, r15
add rax, r8
lea r11, [rax + rcx*8]
test byte [r11], 1
je 0x140005206
test r11, r11
je 0x14000519f
mov rax, qword [r11]
mov rcx, rbx
and rax, r14
shr rcx, 0x15
add rax, r8
and rcx, r15
lea rdi, [rax + rcx*8]
mov rax, qword [rdi]
test al, 1
je 0x140005206
test al, al
js 0x140005206
nop
test rdi, rdi
je 0x1400051c2
mov rax, qword [rdi]
mov rcx, rbx
shr rcx, 0xc
and rax, r14
and rcx, r15
add rax, r8
lea r9, [rax + rcx*8]
test byte [r9], 1
je 0x140005206
test r9, r9
je 0x1400051d8
movabs rax, 0x7fffffffffffffff
and qword [r9], rax
mov r8, qword [rbp + 0x77]
inc r10
add rbx, 0x1000
cmp r10, 1
jb 0x14000512c
mov rdx, r8
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov rcx, qword ds:[rbp + 0x7f]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140006500
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x150
and dword [rax + 0x18], 0
lea r9, [rax + 0x18]
xor r8d, r8d
mov r14, rdx
mov rbp, rcx
lea rdx, [rax + 0x18]
lea edi, [r8 + 0xb]
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov edx, dword [rsp + 0x180]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
je 0x14000663a
mov r8d, dword [rsp + 0x180]
xor r9d, r9d
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
xor esi, esi
xor edi, edi
cmp qword [rbx], rsi
jbe 0x14000662c
xor eax, eax
imul rdx, rax, 0x128
lea rax, [rbx + 8]
mov r8d, 2
add rax, rdx
lea rcx, [rsp + 0x20]
movups xmm0, xmmword ds:[rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x10], xmm1
sub r8, 1
jne 0x140006590
mov rsi, qword [rdx + rbx + 0x18]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
test r14, r14
je 0x14000660d
mov eax, dword [rdx + rbx + 0x20]
mov qword [r14], rax
mov rdx, rbp
lea rcx, [rsp + 0x48]
call fcn.140007850
test rax, rax
jne 0x14000662c
inc edi
mov eax, edi
cmp rax, qword [rbx]
jb 0x140006577
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rsi
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400376c0
Capabilities:
Create thread

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x4f]
sub rsp, 0xb8
and qword [rbp + 0x6f], 0
xorps xmm0, xmm0
and dword [rbp - 0x15], 0
xor r9d, r9d
and dword [rbp + 3], 0
and qword [rbp + 0x77], 0
and qword [rbp + 0x7f], 0
and qword [rbp - 0x11], 0
and qword [rbp - 9], 0
mov dword [rbp - 0x19], 0x30
mov dword [rbp - 1], 0x200
movups xmmword [rbp - 0x29], xmm0
movdqu xmmword [rbp + 7], xmm0
test rcx, rcx
jne 0x140037736
mov r8d, 0x479
lea rdx, [0x14003b1f0]
lea rcx, [0x14003b660]
call qword [sym.imp.ntoskrnl.exe_RtlAssert]
mov eax, 0xc000000d
jmp 0x140037828
mov qword ss:[rsp + 0x30], rcx
lea rax, [0x140037840]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x19]
lea rax, [rbp - 0x29]
mov edx, 0x1fffff
lea rcx, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov ebx, eax
test eax, eax
jns 0x140037791
lfence
xor edx, edx
mov dword [rsp + 0x20], eax
lea r9, [0x14003b670]
lea r8, [0x14003b680]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x140037826
mov r8, qword [sym.imp.ntoskrnl.exe_PsThreadType]
lea rax, [rbp + 0x7f]
mov rcx, qword [rbp + 0x6f]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov edx, 0x1fffff
lea rax, [rbp + 0x77]
mov r8, qword [r8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov ebx, eax
test eax, eax
js 0x140037812
mov rcx, qword [rbp + 0x77]
xorps xmm0, xmm0
and dword [rbp + 0x67], 0
mov r9b, 1
and qword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x37], xmm0
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp + 0x67]
mov r9d, 0x30
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x17]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationThread]
mov ebx, dword [rbp + 0x17]
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x140037826
nop dword [rax + rax]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
add rsp, 0xb8
pop rbx
pop rbp
ret
Function at 0x140038300
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
xor ebx, ebx
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov rbp, rax
test rax, rax
je 0x140038399
lea r8d, [rbx + 0xa]
mov dword [rsp + 0x48], ebx
lea r9, [rsp + 0x48]
mov dl, 1
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlImageDirectoryEntryToData]
mov rdi, rax
test rax, rax
je 0x14003839e
mov r14d, 0x20b
cmp word [rbp + 0x18], r14w
jne 0x140038358
mov rax, qword [rax + 0x58]
jmp 0x14003835b
mov eax, dword [rax + 0x3c]
nop dword [rax + rax]
test rax, rax
je 0x14003839e
mov rax, rsi
lea rcx, [rsp + 0x50]
shr rax, 0x20
xor eax, esi
mov dword [rsp + 0x50], eax
call qword [sym.imp.ntoskrnl.exe_RtlRandomEx]
mov ecx, eax
xor rcx, rsi
cmp word [rbp + 0x18], r14w
jne 0x140038392
mov rax, qword [rdi + 0x58]
mov qword [rax], rcx
jmp 0x14003839e
mov eax, dword [rdi + 0x3c]
mov dword [rax], ecx
jmp 0x14003839e
mov ebx, 0xc000007b
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret