joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a4490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x1400a450a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1400a4500
cmp r11, r10
ja 0x1400a45a3
cmp r10, rdx
ja 0x1400a45b7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x1400a4502
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1400a44e0
jmp 0x1400a4577
ja 0x1400a450a
mov r11, r10
cmp rax, r8
jne 0x1400a44b2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1400a457b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1400a4550
mov r8, r10
sub ecx, r9d
jns 0x1400a456e
jmp 0x1400a457d
cmp r10, rdx
je 0x1400a4589
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1400a457d
xor al, 1
cmp r8, rdx
jne 0x1400a4530
jmp 0x1400a457d
xor eax, eax
jmp 0x1400a457d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valueassertion_failed:__buf.is_empty__
lea r8, [0x1400e4218]
mov edx, 0x2b
call dbg.panic
ud2
lea r8, [0x1400e4230]
mov rcx, r11
mov rdx, r10
call dbg.slice_index_order_fail
ud2
lea r8, [0x1400e4230]
mov rcx, r10
call dbg.slice_end_index_len_fail
ud2
Function at 0x1400b3610
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov r13, rdx
movzx eax, byte [rcx + 0x28]
cmp al, 0x82
jne 0x1400b3633
jmp 0x1400b3767
movzx r8d, byte [rcx + 0x40]
cmp r8b, 0x82
je 0x1400b3689
cmp r8b, 0x81
je 0x1400b3676
cmp r8b, 0x80
je 0x1400b365f
movzx edx, byte [rcx + 0x43]
Function at 0x1400be5e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]

Function at 0x1400be650
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140103294]
test esi, esi
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
jle 0x1400be7e0
mov rax, qword [0x140103298]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rdi, rdx
jb 0x1400be69c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rdi, rdx
jb 0x1400be725
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x1400be680
mov rcx, rdi
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x1400be832
mov rax, qword [0x140103298]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x140103298]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400be815
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400be71e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400be790
add dword [0x140103294], 1
cmp ebx, 8
jae 0x1400be751
test bl, 4
jne 0x1400be7f0
test ebx, ebx
je 0x1400be746
movzx eax, byte [rbp]
test bl, 2
mov byte [rdi], al
jne 0x1400be804
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
sub ebx, 1
mov rdx, qword [rbp + rax - 8]
cmp ebx, 8
mov qword [rdi + rax - 8], rdx
jb 0x1400be746
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, ebx
mov qword [rdi + rdx], rcx
jb 0x1400be76a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov r8d, 4
mov eax, 0x40
mov rcx, qword [rsp + 0x20]
cmovne r8d, eax
mov rdx, qword [rsp + 0x38]
add rsi, qword [0x140103298]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400be71e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
xor esi, esi
jmp 0x1400be6a7
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rdi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rdi + rbx - 4], eax
jmp 0x1400be746
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rdi + rbx - 2], ax
jmp 0x1400be746
mov rax, qword [0x140103298]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rdi
call sym.__report_error
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x1400bee00
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140103300]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1401032e0]
test rbx, rbx
je 0x1400bee54
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400bee4b
test rsi, rsi
je 0x1400bee4b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400bee30
lea rcx, [0x140103300]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400bf0a0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x1400bf0b0
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x1400bf0c0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x1400bf101
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x1400bf0f8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x1400bf103
add rax, 0x28
cmp rax, r9
jne 0x1400bf0e4
xor eax, eax
ret

Function at 0x1400bf1b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1400f1320]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x1400bf21f
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400bf21f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x1400bf21d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x1400bf214
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400bf21f
add rdx, 0x28
cmp rdx, r9
jne 0x1400bf200
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x1400bf320
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x1400f1320]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x1400bf38f
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400bf38f
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x1400bf38d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x1400bf384
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400bf394
add rax, 0x28
cmp rax, r9
jne 0x1400bf370
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x1400bf3b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x1400f1320]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x1400bf423
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400bf423
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x1400bf423
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x1400bf423
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov rcx, r9
jb 0x1400bf417
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x1400bf430
add rdx, 0x28
cmp rdx, r10
jne 0x1400bf403
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jne 0x1400bf448
jmp 0x1400bf420
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x1400bf456
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400bf420
test r8d, r8d
jg 0x1400bf440
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x1400220b4
Capabilities:
Get disk information

Disassembly:
push rbx
mov eax, 0x1260
call fcn.140055f20
sub rsp, rax
mov rax, qword [0x140081ee0]
xor rax, rsp
mov qword [rsp + 0x1250], rax
mov r8d, 0x800
lea rdx, [rsp + 0x250]
call fcn.140031c94
mov dword [rsp + 0x38], 0x105
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x250]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140022153
lea rdx, [0x14006e4f8]
lea rcx, [rsp + 0x40]
call fcn.14005d4e8
test eax, eax
je 0x14002214a
lea rdx, str.FAT32
lea rcx, [rsp + 0x40]
call fcn.14005d4e8
test eax, eax
jne 0x14002214f
mov ebx, 1
mov al, bl
jmp 0x140022155
xor al, al
mov rcx, qword [rsp + 0x1250]
xor rcx, rsp
call fcn.140055f90
add rsp, 0x1260
pop rbx
ret

Function at 0x14002217c
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1038
call fcn.140055f20
sub rsp, rax
mov rax, qword [0x140081ee0]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov r8d, 0x800
lea rdx, [rsp + 0x20]
call fcn.140031c94
movzx eax, word [rsp + 0x20]
neg ax
lea rax, [rsp + 0x20]
sbb rcx, rcx
and rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x1400221d2
cmp eax, 5
je 0x1400221d2
xor eax, eax
jmp 0x1400221d7
mov eax, 1
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140055f90
add rsp, 0x1038
ret

Function at 0x1400221f4
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1030
call fcn.140055f20
sub rsp, rax
mov rax, qword [0x140081ee0]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov ebp, r8d
mov sil, dl
mov rdi, rcx
call fcn.140032798
xor ebx, ebx
cmp word [rax], 0x20
je 0x140022246
cmp word [rax], 0x2e
je 0x140022246
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14002227b
mov rcx, rdi
call fcn.140021e60
cmp eax, 0xffffffff
jne 0x14002228e
mov r8d, 0x800
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140031ef0
test al, al
je 0x14002228e
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14002228e
test sil, sil
je 0x14002228a
mov edx, ebp
mov rcx, rdi
call fcn.140022740
xor eax, eax
jmp 0x1400222a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 1
setbe bl
lea eax, [rbx + 1]
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140055f90
mov rbx, qword [rsp + 0x1058]
add rsp, 0x1030
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003b67c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140047cc8], rbx
je 0x14003b6e3
cmp rax, rbx
jne 0x14003b6d6
mov ebx, 1
mov esi, ebx
jmp 0x14003b6e8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14003b6bb
mov ebx, 1
mov eax, dword [0x140047cd0]
cmp eax, ebx
jne 0x14003b700
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14003b76c
mov eax, dword [0x140047cd0]
test eax, eax
jne 0x14003b761
mov dword [0x140047cd0], ebx
lea r15, [0x14003e280]
lea rdi, [0x14003e268]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14003b753
test eax, eax
jne 0x14003b757
cmp qword [rdi], r14
je 0x14003b748
mov rax, qword [rdi]
mov rcx, qword [0x14003e228]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14003b72a
test eax, eax
je 0x14003b767
mov eax, 0xff
jmp 0x14003b8c0
mov dword [0x140047284], ebx
mov edi, 0x1f
mov eax, dword [0x140047cd0]
cmp eax, ebx
jne 0x14003b793
lea rdx, [0x14003e260]
lea rcx, [0x14003e230]
call sub.msvcrt.dll__initterm
mov dword [0x140047cd0], 2
test esi, esi
jne 0x14003b7a1
mov rax, r14
xchg qword [0x140047cc8], rax
cmp qword [0x140047ce8], r14
je 0x14003b7d4
lea rcx, [0x140047ce8]
call fcn.14003bc50
test eax, eax
je 0x14003b7d4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140047ce8]
mov r9, qword [0x14003e228]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14003b7ed
mov eax, 0xff
jmp 0x14003b8c0
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14003b871
cmp word [rcx], r14w
je 0x14003b806
test edx, edx
jne 0x14003b871
movzx eax, word [rcx]
sub ax, bx
cmp ax, di
ja 0x14003b81c
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14003b806
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001fa0
mov dword [0x140047280], eax
cmp dword [0x1400472a0], r14d
jne 0x14003b85a
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140047284], r14d
jne 0x14003b86f
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140047280]
jmp 0x14003b8c0
cmp word [rcx], 0x22
jne 0x14003b885
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14003b7f6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.1400da000
add rsp, 0x28
jmp 0x14003b67c
Function at 0x1400010cc
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x14025ca40]
xor rax, rsp
mov qword [rbp + 0x3f], rax
and dword [rsp + 0x50], 0
lea r9, [rbp - 0x19]
and qword [rsp + 0x48], 0
mov eax, 1
and dword [rsp + 0x40], 0
mov rdi, r8
and qword [rbp - 1], 0
lea r8, [rbp - 9]
mov dword [rsp + 0x38], eax
mov rsi, rdx
mov dword [rsp + 0x30], eax
xorps xmm0, xmm0
and dword [rsp + 0x28], 0
mov edx, 0x80000000
and qword [rsp + 0x20], 0
mov qword [rbp + 7], rcx
lea rcx, [rbp - 0x29]
mov dword [rbp - 9], 0x30
mov dword [rbp + 0xf], 0x240
movdqu xmmword [rbp + 0x17], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x1400011e6
mov rcx, qword [rbp - 0x29]
lea r8, [rbp + 0x27]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea rdx, [rbp - 0x19]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x1400011dc
mov eax, dword [rbp + 0x2f]
xor ecx, ecx
mov edx, eax
mov dword [rdi], eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsi], rax
test rax, rax
je 0x1400011d7
and qword [rsp + 0x40], 0
lea rcx, [rbp - 0x21]
and qword [rbp - 0x21], 0
xor r9d, r9d
mov qword [rsp + 0x38], rcx
xor r8d, r8d
mov ecx, dword [rdi]
xor edx, edx
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbp - 0x29]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
jmp 0x1400011dc
mov ebx, 0xc000009a
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140002350
mov rbx, qword [rsp + 0x108]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001208
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x14025ca40]
xor rax, rsp
mov qword [rbp + 0xc8], rax
mov rax, qword [0x14025caa8]
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x140001253
call qword [0x140003110]
jmp 0x14000144f
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x11c
call fcn.140002800
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
cmp dword [rsp + 0x3c], 0x1db1
mov ecx, 0xe3e3
ja 0x140001364
mov dword [rbp + 0x50], 0xe38ee3ae
lea rax, [rbp + 0x50]
mov dword [rbp + 0x54], 0xe386e3a4
mov edx, 0x1b
mov dword [rbp + 0x58], 0xe3b0e397
mov dword [rbp + 0x5c], 0xe390e39a
mov dword [rbp + 0x60], 0xe386e397
mov dword [rbp + 0x64], 0xe3b1e38e
mov dword [rbp + 0x68], 0xe396e38c
mov dword [rbp + 0x6c], 0xe38ae397
mov dword [rbp + 0x70], 0xe386e38d
mov dword [rbp + 0x74], 0xe387e3a2
mov dword [rbp + 0x78], 0xe391e387
mov dword [rbp + 0x7c], 0xe390e386
mov dword [rbp + 0x80], 0xe3e3e390
mov word [rbp + 0x84], cx
xor word [rax], cx
lea rax, [rax + 2]
sub rdx, 1
jne 0x1400012f1
xorps xmm0, xmm0
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov rdx, rax
xor eax, eax
xor ecx, ecx
cmp byte [rcx + rdx], 0xe8
jne 0x140001334
cmp byte [rcx + rdx + 5], 0x48
je 0x14000134e
inc eax
inc rcx
cmp rcx, 0x100
jl 0x140001327
mov rax, qword [0x14025caa8]
jmp 0x14000143f
cdqe
movsxd rcx, dword [rax + rdx + 1]
add rax, 5
add rax, rcx
add rax, rdx
jmp 0x140001438
mov dword [rbp + 0x88], 0xe397e3b1
lea rax, [rbp + 0x88]
mov dword [rbp + 0x8c], 0xe3a5e38f
mov edx, 0x1e
mov dword [rbp + 0x90], 0xe38de38a
mov dword [rbp + 0x94], 0xe3a6e387
mov dword [rbp + 0x98], 0xe393e39b
mov dword [rbp + 0x9c], 0xe391e38c
mov dword [rbp + 0xa0], 0xe386e397
mov dword [rbp + 0xa4], 0xe3b1e387
mov dword [rbp + 0xa8], 0xe396e38c
mov dword [rbp + 0xac], 0xe38ae397
mov dword [rbp + 0xb0], 0xe386e38d
mov dword [rbp + 0xb4], 0xe39ae3a1
mov dword [rbp + 0xb8], 0xe382e3ad
mov dword [rbp + 0xbc], 0xe386e38e
mov dword [rbp + 0xc0], 0xe3e3e3e3
xor word [rax], cx
lea rax, [rax + 2]
sub rdx, 1
jne 0x140001406
xorps xmm0, xmm0
lea rdx, [rbp + 0x88]
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov qword [0x14025caa8], rax
test rax, rax
je 0x14000144f
mov rdx, rdi
mov rcx, rbx
jmp 0x140001248
mov rcx, qword [rbp + 0xc8]
xor rcx, rsp
call fcn.140002350
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140001bbc
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x14025ca40]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor ebp, ebp
lea r9, [rsp + 0x20]
mov r15, rdx
mov dword [rsp + 0x20], ebp
mov r14, rcx
lea rdx, [rsp + 0x30]
mov r8d, 0x130
lea ecx, [rbp + 0xb]
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov dl, 1
mov rcx, r14
mov ebx, eax
call fcn.140001b3c
mov r12, rax
cmp ebx, 0xc0000004
jne 0x140001d0f
mov edi, dword [rsp + 0x20]
lea ecx, [rbp + 1]
add edi, 0x130
mov edx, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8d, edi
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.140002800
lea r9, [rsp + 0x20]
mov r8d, edi
mov rdx, rsi
lea ecx, [rbp + 0xb]
call sub.ntoskrnl.exe_ZwQuerySystemInformation
lfence
test eax, eax
jns 0x140001c82
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
jmp 0x140001d1d
lea rdx, [0x140002c80]
mov rcx, r14
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x140001cf7
lea rdx, [0x140002c90]
mov rcx, r14
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x140001cf7
mov edi, ebp
cmp dword [rsi], ebp
jbe 0x140001d04
movsxd rax, edi
imul r14, rax, 0x128
lea rbx, [r14 + rsi]
lea rcx, [rbx + 0x30]
call sub.ntoskrnl.exe__strupr
mov rdx, r12
lea rcx, [rbx + 0x30]
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x140001ce0
inc edi
cmp edi, dword [rsi]
jb 0x140001cb0
jmp 0x140001d04
lfence
test r15, r15
je 0x140001cf0
mov rax, qword [r14 + rsi + 0x18]
mov qword [r15], rax
mov ebp, dword [r14 + rsi + 0x20]
jmp 0x140001d04
lfence
mov rax, qword [rsi + 0x18]
mov qword [r15], rax
mov ebp, dword [rsi + 0x20]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbp
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140002350
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140001ff4
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
and dword [rbp - 0x2c], 0
xorps xmm0, xmm0
and dword [rbp - 0x14], 0
mov rdx, rcx
lea rcx, [rbp - 0x50]
movups xmmword [rbp - 0x50], xmm0
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp - 0x28], 0
lea rax, [rbp - 0x50]
and qword [rbp + 0x20], 0
lea r9, [rbp - 0x40]
mov ecx, 0x40
mov dword [rbp - 0x30], 0x30
mov dword [rsp + 0x28], ecx
lea r8, [rbp - 0x30]
and dword [rsp + 0x20], 0
xorps xmm0, xmm0
mov dword [rbp - 0x18], ecx
mov edx, 0x80000000
lea rcx, [rbp + 0x20]
mov qword [rbp - 0x20], rax
movdqu xmmword [rbp - 0x10], xmm0
movups xmmword [rbp - 0x40], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov ebx, eax
test eax, eax
jns 0x14000207f
lea r8, [0x140002cb0]
jmp 0x140002111
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
lea rax, [rbp + 0x18]
and qword [rbp + 0x18], 0
xor r9d, r9d
and qword [rsp + 0x28], 0
xor edx, edx
mov rcx, qword [rbp + 0x20]
mov r8, qword [r8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov rcx, qword [rbp + 0x20]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
jns 0x1400020c5
lea r8, [0x140002ce0]
jmp 0x140002111
mov rax, qword [rbp + 0x18]
xor edx, edx
mov byte [rax + 0x4c], 1
mov rax, qword [rbp + 0x18]
mov byte [rax + 0x4f], 1
mov rax, qword [rbp + 0x18]
mov byte [rax + 0x49], 0
mov rax, qword [rbp + 0x18]
mov rcx, qword [rax + 0x28]
and qword [rcx + 0x10], 0
mov rcx, qword [rbp + 0x18]
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
lea rcx, [rbp - 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov ebx, eax
test eax, eax
jns 0x140002122
lea r8, [0x140002d10]
lfence
xor edx, edx
mov r9d, ebx
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret