joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026860
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400a6a50]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
cmp rcx, 4
jbe 0x140026914
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140026919
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, qword [rsp + 0x20]
cmp rax, rcx
jne 0x1400268d4
mov rcx, rbx
call fcn.140026a00
mov rcx, qword [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140038290
add rsp, 0x60
pop rbx
ret
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, rbx
call fcn.140026a00
lea rcx, [rsp + 0x28]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140038290
add rsp, 0x60
pop rbx
ret
mov eax, 0xc0000022
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140038290
add rsp, 0x60
pop rbx
ret

Function at 0x140026930
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400a6a50]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
cmp rcx, 4
jbe 0x1400269e4
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400269e9
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, qword [rsp + 0x20]
cmp rax, rcx
jne 0x1400269a4
mov rcx, rbx
call fcn.140026ae0
mov rcx, qword [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140038290
add rsp, 0x60
pop rbx
ret
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, rbx
call fcn.140026ae0
lea rcx, [rsp + 0x28]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140038290
add rsp, 0x60
pop rbx
ret
mov eax, 0xc0000022
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140038290
add rsp, 0x60
pop rbx
ret
Function at 0x140026bc0
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400a6a50]
xor rax, rsp
mov qword [rsp + 0x98], rax
xor ebx, ebx
mov rdi, r8
mov qword [rsp + 0x30], rbx
mov rsi, rdx
cmp rcx, 4
ja 0x140026bfa
mov eax, 0xc0000022
jmp 0x140026cba
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140026cba
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, qword [rsp + 0x30]
cmp rax, rcx
jne 0x140026c5b
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], 0x30
mov rdx, rsi
or rcx, 0xffffffffffffffff
call fcn.14002cb20
test eax, eax
js 0x140026c57
cmp dword [rsp + 0x60], 0x1000000
jne 0x140026c57
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
jmp 0x140026cad
mov ebx, eax
jmp 0x140026cad
lea rdx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], 0x30
mov rdx, rsi
or rcx, 0xffffffffffffffff
call fcn.14002cb20
test eax, eax
js 0x140026ca0
cmp dword [rsp + 0x60], 0x1000000
jne 0x140026ca0
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
jmp 0x140026ca2
mov ebx, eax
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140038290
add rsp, 0xa0
pop rdi
pop rsi
pop rbx
ret

Function at 0x140026ce0
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400a6a50]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, r8
mov rbx, rdx
cmp rcx, 4
ja 0x140026d0c
mov eax, 0xc0000022
jmp 0x140026d7b
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140026d7b
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, qword [rsp + 0x20]
cmp rax, rcx
jne 0x140026d47
mov r8, rdi
mov rdx, rbx
or rcx, 0xffffffffffffffff
call fcn.140026da0
mov ebx, eax
jmp 0x140026d6e
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r8, rdi
mov rdx, rbx
or rcx, 0xffffffffffffffff
call fcn.140026da0
lea rcx, [rsp + 0x28]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140038290
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x140027050
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rdi
sub rsp, 0x78
mov rax, qword [0x1400a6a50]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
mov rbx, rdx
cmp rcx, 4
ja 0x14002708b
mov word [rdx], di
mov rcx, rbx
lea rdx, [0x140039a50]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
mov eax, edi
jmp 0x14002716a
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x28], rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14002716a
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0xa0], rbp
xor bpl, bpl
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x20], rdi
call fcn.1400054b0
test eax, eax
js 0x14002710c
mov rcx, qword [rsp + 0x20]
mov rdx, rbx
call fcn.1400164e0
mov esi, eax
test eax, eax
js 0x1400270fc
cmp word [rbx], di
je 0x1400270fc
mov rdx, qword [rsp + 0x20]
mov r8, rbx
mov rcx, qword [0x1400a8f30]
call fcn.14000e260
mov bpl, 1
mov esi, edi
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test bpl, bpl
jne 0x140027150
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, qword [rsp + 0x28]
cmp rax, rcx
jne 0x14002712c
mov rdx, rbx
or rcx, 0xffffffffffffffff
call fcn.140026ef0
mov esi, eax
jmp 0x140027150
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rdx, rbx
or rcx, 0xffffffffffffffff
call fcn.140026ef0
lea rcx, [rsp + 0x30]
mov esi, eax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rbp, qword [rsp + 0xa0]
mov eax, esi
mov rsi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140038290
add rsp, 0x78
pop rdi
pop rbx
ret
Function at 0x140027540
Capabilities:
Attach user process memory

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [0x1400a6a50]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rax, r9
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], r8
mov r15, rdx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x90], rdx
mov rdx, qword [rsp + 0x200]
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0x80], rdx
xor r14d, r14d
mov dword [rsp + 0x38], r14d
mov rsi, r15
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x58], rax
mov r12, qword [rsp + 0x1f0]
mov rdi, r12
mov qword [rsp + 0x60], r12
mov rbx, r12
mov eax, 0xe000
cmp r12, rax
cmova rbx, rax
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x88], r14
mov dword [rsp + 0x40], r14d
movzx r13d, byte [rsp + 0x1f8]
test rdi, rdi
je 0x140027850
cmp rdi, rbx
cmovb rbx, rdi
lea rdx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x34], r14d
mov dword [rsp + 0x3c], r14d
cmp rsi, r15
jne 0x140027647
test r13b, r13b
je 0x140027647
mov dword [rsp + 0x30], 1
mov r8d, 1
mov rdx, r12
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0xd0], r14
mov rax, rsi
and eax, 0xfff
add rax, 0xfff
add rax, rbx
shr rax, 0xc
lea rax, [rax*8 + 0x30]
mov word [rsp + 0xd8], ax
mov word [rsp + 0xda], r14w
mov rax, rsi
and rax, 0xfffffffffffff000
mov qword [rsp + 0xf0], rax
mov rax, rsi
and eax, 0xfff
mov dword [rsp + 0xfc], eax
mov dword [rsp + 0xf8], ebx
xor r8d, r8d
movzx edx, r13b
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov r14, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x140027705
mov dword [rsp + 0x38], 1
mov ecx, 0xc000009a
call qword [sym.imp.ntoskrnl.exe_ExRaiseStatus]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
cmp rsi, r15
jne 0x140027754
test r13b, r13b
je 0x140027754
mov dword [rsp + 0x30], 1
mov r8d, 1
mov rdx, r12
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ProbeForWrite]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x3c], 1
mov r8, rbx
mov rdx, r14
mov rcx, qword [rsp + 0x48]
call fcn.140038440
nop
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
lea rdx, [rsp + 0xd0]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
sub rdi, rbx
mov qword [rsp + 0x60], rdi
add rsi, rbx
add qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x78]
xor r14d, r14d
jmp 0x1400275f1
mov rax, qword [rsp + 0x98]
mov qword [rax], r12
xor eax, eax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140038290
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140027d20
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
xor r13d, r13d
mov rdi, r9
mov r14d, r8d
mov r15, rdx
mov r12, rcx
test r9, r9
je 0x140027d5b
mov dword [r9], r13d
mov qword [rbp - 0x29], r13
mov rbx, r13
mov qword [rbp - 0x21], rbx
mov rsi, r13
test r14d, r14d
je 0x140027dab
call qword [sym.imp.ntoskrnl.exe_ExGetPreviousMode]
mov r9d, 1
mov edx, r14d
movzx r8d, al
mov rcx, r15
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
call fcn.1400266e0
test eax, eax
js 0x140027f02
mov rsi, qword [rbp - 0x29]
mov rbx, qword [rbp - 0x21]
xor eax, eax
mov qword [rbp + 0x27], r13
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
lea ecx, [rax + 0x20]
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0x2f], r13
call fcn.140002a20
test rax, rax
je 0x140027f23
lea rcx, [rax + 8]
mov qword [rax], rax
test rcx, rcx
je 0x140027df5
mov qword [rcx], rax
lea rcx, [rax + 0x10]
test rcx, rcx
je 0x140027e01
mov qword [rcx], rax
mov word [rax + 0x18], 0x101
mov edx, 0x400
mov ecx, 1
mov qword [rbp + 0x27], rax
mov r8d, 0x54585342
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], rsi
mov qword [rbp - 9], r13
mov dword [rbp - 1], r14d
mov qword [rbp + 7], rdi
mov dword [rbp + 0xf], r13d
mov dword [rbp + 0x1f], 0x400
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
lea rdx, [rbp + 0x7f]
mov rcx, r12
mov qword [rbp + 0x17], rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
js 0x140027eae
mov rcx, qword [rbp + 0x7f]
call fcn.140005210
test rax, rax
je 0x140027e9f
cmp dword [0x1400acae4], 0x620
lea rcx, [0x1400288b0]
lea rdx, [0x1400287c0]
cmovge rdx, rcx
lea r8, [rbp - 0x19]
xor r9d, r9d
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExEnumHandleTable]
mov rcx, qword [rbp + 0x7f]
mov edi, r13d
call fcn.140005430
jmp 0x140027ea4
mov edi, 0xc000010a
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp + 0x17]
test rcx, rcx
je 0x140027ec2
mov edx, 0x54585342
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test rsi, rsi
je 0x140027edb
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r9, qword [rbp + 0x27]
lea rdx, [rbp - 0x21]
mov ebx, dword [rbp + 0xf]
lea rcx, [rbp + 0x27]
test edi, edi
mov r8, qword [r9]
cmovne ebx, edi
call fcn.140024b70
mov rcx, qword [rbp + 0x27]
call fcn.140002a60
mov eax, ebx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140002a80
int3
Function at 0x14002a430
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, rdx
mov r14, rcx
mov edi, 0x40000
mov ecx, 1
mov edx, edi
mov r8d, 0x54585342
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x14002a522
mov qword [rsp + 0x30], rsi
nop dword [rax]
nop dword [rax + rax]
xor r9d, r9d
mov r8d, edi
mov rdx, rbx
lea ecx, [r9 + 0x42]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov esi, eax
test eax, eax
jns 0x14002a4d2
mov edx, 0x54585342
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp esi, 0xc0000004
jne 0x14002a51d
add edi, 0x40000
mov ecx, 1
mov edx, edi
mov r8d, 0x54585342
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
jne 0x14002a480
jmp 0x14002a51d
test rbx, rbx
je 0x14002a51d
xor edi, edi
cmp dword [rbx], edi
jbe 0x14002a50f
nop dword [rax]
lea rcx, [rdi + rdi*2]
mov r9, rbp
movzx r8d, byte [rbx + rcx*8 + 8]
lea rdx, [rbx + rcx*8]
mov rcx, qword [rbx + rcx*8 + 8]
and r8b, 1
mov rdx, qword [rdx + 0x10]
and rcx, 0xfffffffffffffffe
call r14
test al, al
jne 0x14002a50f
inc edi
cmp edi, dword [rbx]
jb 0x14002a4e0
mov edx, 0x54585342
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14002a7a0
Capabilities:
Find process by pid

Disassembly:
sub rsp, 0x28
cmp rcx, 4
ja 0x14002a7b4
mov eax, 0xc0000022
add rsp, 0x28
ret
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], 0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x14002a7ea
mov rcx, qword [rsp + 0x30]
call fcn.14002a800
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x1400b6020
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400a6a50]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov r13, rcx
cmp qword [0x1400aca98], 0
jne 0x1400b605d
xor al, al
jmp 0x1400b6111
xor bl, bl
mov byte [rsp + 0x20], bl
lea rdx, [rsp + 0x28]
mov rcx, qword [0x14003a2b0]
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rdi, qword [0x1400aca98]
movsxd rax, dword [rdi + 0x3c]
add rax, rdi
mov r11d, dword [rax + 0x78]
add r11, rdi
mov r14d, dword [r11 + 0x1c]
add r14, rdi
mov r15d, dword [r11 + 0x20]
add r15, rdi
mov r12d, dword [r11 + 0x24]
add r12, rdi
xor r9d, r9d
mov dword [rsp + 0x24], r9d
cmp r9d, dword [r11 + 0x14]
jae 0x1400b60fc
mov r8d, dword [r15 + r9*4]
add r8, rdi
movzx eax, word [r12 + r9*2]
mov r10d, dword [r14 + rax*4]
mov rax, r13
sub r8, r13
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400b60e3
inc rax
test ecx, ecx
jne 0x1400b60d0
test edx, edx
jne 0x1400b60f7
movzx eax, word [r10 + rdi + 1]
mov dword [rsi], eax
mov bl, 1
mov byte [rsp + 0x20], bl
jmp 0x1400b60fc
inc r9d
jmp 0x1400b60a5
jmp 0x1400b6103
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
movzx eax, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140038290
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400042cb
Capabilities:
Terminate process

Disassembly:
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x38]
call fcn.14055bab0
Function at 0x14001d75b
Capabilities:
Packed with generic packer

Disassembly:
jg 0x1404240a1
jge 0x14001d7e0
add word [rsi], ax
add al, byte [rax]
invalid

Function at 0x14001dc8d
Capabilities:
Hash data with crc32

Disassembly:
pushfq
add qword [rsp + 8], 0xffffffffffb6c9d7
push r10
movabs r10, 0xd38dafae1681eaa0
movabs rdx, 0xab9b64aab61ac13e
shl dx, 0x5f
push 0x4c187aa3
setne r10b
add dx, dx
add edx, r10d
js 0x140338bde
mov rdx, qword [rsp + 0x18]
Function at 0x140022f74
Capabilities:
Check os version
Encode data using base64
Execute anti-debugging instructions
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
pop rax
push rdx
pushfq
movabs rdx, 0xd69b71851c30f138
lea rdx, [rdx + rdx*8 - 0x18e43570]
sub dl, 0x1c
mov dl, 0x88
push r8
mov r8, rdx
xchg qword [rsp + 0x18], rax
shr rdx, 0x7f
setb dl
cmp r8b, dl
mov rdx, qword [rsp + rdx*4 + 0x10]
mov qword [rsp + 0x10], rax
call fcn.1400352ab
mov ebp, 0xe9cccc0c
push rax
push rsp
add byte fs:[rax + rbx + 0x18706f29], ch
jnp 0x140022fad
and cl, byte [rdx + rbx*4]
mov ah, 4
xchg dword [rax], ecx
xor dword [rcx], 0x8552c2f5
movabs al, byte [0xc72ca7e52198ed68]
cwde
and ebp, esp
cmpsd dword [rsi], dword [rdi]
sub al, 0xc7
movsb byte [rdi], byte cs:[rsi]
loop 0x140022f91
or r12b, byte [r11 + 0x75ab6b82]
iretd
pop rbp
sahf
psubusw mm5, mm5
fcom qword [rbp + 0x25]
push rdi
adc eax, 0x8db60c21
invalid

Function at 0x140024e16
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rbp, qword [rsp + rbp - 0x473000cd]
jae 0x1403ee17b
add dword [rax], eax
add byte [rax], al
jmp fcn.14066b677

Function at 0x140024e28
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rbp, qword [rsp + rbp - 0x473000cd]
jae 0x1403ee17b
add dword [rax], eax
add byte [rax], al
jmp fcn.14066b677

Function at 0x140026f11
Capabilities:
Encode data using base64

Disassembly:
pushfq
add qword [rsp + 8], 0xfffffffffff91bab
movabs rax, 0xa72775935ba8888a
add qword [rsp + 0x10], 0xfffffffffffaa334
push r13
movsx ax, al
push r11
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
movabs r13, 0x969dbb9b9db1362c
lea r13, [r13*2 + 0x5ea5e8b5]
shl r13d, 0xbf
movabs r11, 0xefb5da2cfab8522c
neg r13d
lea rax, [rax + 0x35207bb6]
jno 0x14046f752
shr r11, 0xff
add r13d, r13d
ja 0x14002c1f7
xchg qword [rsp + r11*4 + 0x2c], rax
mov r13, qword [rsp + r13*2 + 8]
jns 0x14009463a
setns r11b
shr r11d, 0x37
jb 0x1400619b6
test r11d, 0xce2ccbb4
push qword [rsp + r11 + 0x10]
add qword [rsp], 0xffffffffbfb442ad
or qword [rsp + 8], 0xffffffffdf282c18
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x28]
ret

Function at 0x14002b09d
Capabilities:
Hash data with crc32

Disassembly:
call fcn.140333819
test dword [rcx - 0x4f831634], edx
jmp fcn.140676119
push r8
mov r8, r14
add qword [rsp + 0x10], 0xfffffffffff45113
bswap r14
nop
mov rdx, r8
neg r14d
and r8b, r8b
call fcn.140029193

Function at 0x14002b0bd
Capabilities:
Hash data with crc32

Disassembly:
xchg qword [rsp + 0x58], rbp
mov rcx, qword [rsp + 0x50]
or dword [rsp + 0x48], 0x5b1f640e
shr dword [rsp + 0x40], 0x4f
setbe dil
and rdi, 0xffffffffd18ab53b
mov rdi, qword [rsp + 0x28]
call fcn.1400054a2
Function at 0x14002b130
Capabilities:
Hash data with crc32

Disassembly:
mov rbp, rbx
mov rbx, qword [rsp + 0x18]
push qword [rsp + 0x10]
popfq
mov r10, qword [rsp + 8]
mov rbp, qword [rsp]
lea rsp, [rsp + 0x20]
ret 8
sub r10b, 0x90
mov qword [rsp + 0x38], rcx
jge 0x14000821f
xor dword [rsp], 0x8125322d
xchg qword [rsp + 0x28], rdx
mov r10, qword [rsp + 8]
cmp qword [rsp], 0xffffffffd40fbc17
jo 0x14039760f
not byte [rsp]
sub dword [rsp], 0xddacb687
call fcn.14032637d
jno 0x1403edcc1
jmp fcn.140676264
push rbx
pushfq
add qword [rsp + 0x10], 0x383894
mov rcx, qword [rsp + 0x28]
movabs rbx, 0x18191a050faac223
neg bl
lea rbx, [rbx + rbx*2 + 0x1b13af0b]
or bl, 0x1f
shr bx, 0x29
lea rcx, [rcx + 1]
push r10
mov bx, 0xe526
push rbp
movabs r10, 0x18697a0bb87959c
sub r10w, 0x8b34
jno 0x1403f3460
ret
call fcn.14009558e
std
sub dword [rax], ecx
invalid
jg 0x14002b0e9
push rsi
jbe 0x1403f343c
adc byte [rdi], 0x1a
mov ecx, 0xeba10b3a
lea eax, [rsp + rsi*4]
invalid

Function at 0x14002c450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push r14
push r15
pushfq
movabs r15, 0x173d79234a9e2f14
test r15, r15
call fcn.1403921e7
add dword [rcx + rax], eax
add byte [rdx + rax*2], al
add byte [rax], al
jmp fcn.140677d6e

Function at 0x140037844
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs r9, 0xada37bac4b272c1e
test r14, 0x2d116ea1
call fcn.14004ab83
add cl, byte [rsi]
xor edx, 0x6e
add al, ch
call fcn.140060e1a
int3
int3
jmp fcn.14068a237
push r14
movabs rsi, 0xc22922c73b0c7b1
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
shr sil, 0x96
call fcn.14004fd70
sbb al, 0xe2
rol dword [rcx], 0xd
add al, byte [rax]
or eax, 0x227006f2
scasb al, byte [rdi]
jrcxz 0x140441539
xor ebp, ebx
invalid
fnstsw word [rdi]
sar dword [rsi], 1
sti
sbb eax, 0xc83355d3
and al, 0xf4
jnp 0x14044151b
call fcn.140358239
sbb al, 0x67
invalid
jle 0x1404414c1
pop rax
shr byte [0xd7ff6752], 1
mov eax, dword [rdi]
add dword [rsp + rdi*2 - 0x55], 0x766d44bd
cdqe
invalid
add qword [rsp], 0x12ae79
mov rax, r9
cmp ax, 0x4f39
jle 0x140037821
jle fcn.1403d2576
jo 0x140441494
mov rax, qword [rsp]
mov rax, qword [rax]
mov qword [rsp], r9
shr r9w, 0xb7
not r9d
call fcn.14039a97f

Function at 0x1400380f0
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push rbp
movabs rbp, 0xcfa80b1d25851b07
movabs rbp, 0x10bb7fac4fbdbd3b
call fcn.140064c41
nop
test ah, 0xe9
cmp ch, byte [rdi]
add byte gs:[rbx + 0x17], dh
invalid

Function at 0x140039c34
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov rsi, qword [rsp + 0x40]
mov qword [rsp + 0x40], rbx
cmp r13w, 0x8295
jo 0x14004a7b1
push rbp
js 0x14034e70e
call fcn.14004ade0
push 0x570070a7

Function at 0x14004270c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], 0x1fac45a9
call 0x140063ad4
call fcn.14031a090
jns 0x1400266b5
and ebp, ecx
push rcx
xchg edx, eax
add byte gs:[rsi + 0x51], dl
push rsi
push rcx
pushfq
movabs rcx, 0x71a76a1d93936201
add rcx, rcx
call fcn.140492690