joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16390
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x1e0
mov rax, qword [0x00020100]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
and dword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
mov eax, 0x80
mov word [rsp + 0x50], ax
mov eax, 0x82
mov rdi, rdx
mov word [rsp + 0x52], ax
lea rax, [0x0001e5a0]
mov rdx, rcx
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x58], rax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and qword [rsp + 0x68], 0
and qword [rsp + 0x80], 0
and qword [rsp + 0x88], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x48]
lea edx, [r9 + 1]
mov dword [rsp + 0x60], 0x30
mov dword [rsp + 0x78], 0x240
mov qword [rsp + 0x70], rax
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
js 0x164b6
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x90]
mov r8d, 2
mov dword [rsp + 0x20], 0x12c
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
test eax, eax
js 0x164a9
cmp dword [rsp + 0xa4], 4
jne 0x164a4
cmp dword [rsp + 0xa8], 4
jne 0x164a4
mov ecx, dword [rsp + 0xac]
mov dword [rdi], ecx
jmp 0x164a9
mov ebx, 0xc000000d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.0001d8a0
mov rbx, qword [rsp + 0x200]
add rsp, 0x1e0
pop rdi
ret

Function at 0x164e0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xb0
mov rax, qword [0x00020100]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov eax, 0x80
mov dword [rsp + 0x40], edx
mov rdx, rcx
mov word [rsp + 0x50], ax
mov eax, 0x82
lea rcx, [r11 - 0x28]
mov word [rsp + 0x52], ax
lea rax, [0x0001e5a0]
xor ebx, ebx
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x70], rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x60]
lea edx, [rbx + 2]
lea rcx, [rsp + 0x48]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x78], 0x240
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, ebx
jl 0x165c2
mov rcx, qword [rsp + 0x48]
lea r9d, [rbx + 4]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], r9d
lea rdx, [rsp + 0x90]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.0001d8a0
add rsp, 0xb0
pop rbx
ret
Function at 0x165e4
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [0x000453c8]
xor r9d, r9d
mov rdi, r8
mov rbx, rdx
mov r10, rcx
test eax, eax
jle 0x16622
lea rdx, [0x000517c0]
cmp rcx, qword [rdx]
je 0x16650
mov eax, dword [0x000453c8]
inc r9d
add rdx, 8
cmp r9d, eax
jl 0x1660b
mov rax, qword [rbx + 0xb8]
mov cl, byte [rax]
cmp cl, 0x1b
ja 0x16654
lea r8, [0x00051820]
movzx eax, cl
mov r8, qword [r8 + rax*8]
test r8, r8
je 0x16654
mov rdx, rbx
mov rcx, r10
call r8
mov dword [rdi], eax
jmp 0x1667c
xor al, al
jmp 0x1667e
cmp cl, 0x16
jne 0x16662
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PoStartNextPowerIrp]
and qword [rbx + 0x38], 0
mov ecx, 0xc0000010
xor edx, edx
mov dword [rbx + 0x30], ecx
mov dword [rdi], ecx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x17acc
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x260
mov rax, qword [0x00020100]
xor rax, rsp
mov qword [rsp + 0x250], rax
call fcn.000177f4
call sub.SPYSHELTER.SYS_SpS_ControlFunction5
cmp eax, 1
jne 0x17b13
call fcn.0001847c
jmp 0x17c6c
call fcn.00017e88
xor r12d, r12d
mov rbx, rax
cmp rax, r12
je 0x17c6c
lea ecx, [r12 + 1]
mov edx, 0x400
mov r8d, 0x4c506b53
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebp, r12d
xor edx, edx
mov rsi, rax
jmp 0x17c2b
inc ebp
cmp dword [rsi + 4], 1
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x38], r12d
jne 0x17c29
mov ecx, dword [rsi + 8]
shr rcx, 1
cmp rcx, 0x7ffffffe
jbe 0x17b77
mov word [rsp + 0x40], r12w
jmp 0x17bbc
lea rdi, [rsp + 0x40]
mov r8, rsi
mov edx, 0x104
sub r8, rdi
lea rax, [rsp + 0x40]
cmp rcx, r12
je 0x17baf
movzx edi, word [r8 + rax + 0xc]
cmp di, r12w
je 0x17baf
dec rdx
mov word [rax], di
dec rcx
add rax, 2
cmp rdx, r12
jne 0x17b8c
cmp rdx, r12
jne 0x17bb8
sub rax, 2
mov word [rax], r12w
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x17c29
lea rdx, [0x0001e6e0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
cmp eax, r12d
jne 0x17bf1
mov ecx, 2
jmp 0x17c0c
lea rdx, [0x0001e700]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
mov ecx, r12d
cmp eax, r12d
sete cl
cmp dword [0x00045414], r12d
je 0x17c29
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
call fcn.00017860
mov edx, ebp
lea rax, [rsp + 0x34]
mov r9, rsi
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, r12d
jge 0x17b4a
mov edx, 0x4c506b53
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.0001d8a0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x17ca0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
cmp dword [0x00045410], 0x7d0
mov r12, r9
mov r13, r8
mov rbx, rdx
mov esi, ecx
jb 0x17cd9
mov eax, 0xc0000256
jmp 0x17d95
test ecx, ecx
jne 0x17cfc
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
jne 0x17d16
mov eax, 0xc000000d
jmp 0x17d95
cmp ecx, 2
je 0x17d0f
cmp ecx, 1
jne 0x17cf2
lea rbx, [0x0001e700]
jmp 0x17d16
lea rbx, [0x0001e6e0]
call fcn.00017e88
mov rdi, rax
test rax, rax
je 0x17d90
lea rcx, [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [0x0001e100]
lea rdx, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, rdi
mov ebp, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebp, ebp
jns 0x17d6f
mov eax, ebp
jmp 0x17d95
cmp dword [0x00045414], 0
je 0x17d90
mov r9, r12
mov r8, r13
mov rdx, rbx
mov ecx, esi
call fcn.00017860
test al, al
je 0x17d90
xor eax, eax
jmp 0x17d95
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret

Function at 0x17ecc
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x00020100]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov ebx, ecx
lea rcx, [rsp + 0x32]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], di
call fcn.0001de80
call sub.SPYSHELTER.SYS_SpS_ControlFunction5
cmp eax, 1
jne 0x17f1c
mov eax, 0xc0000022
jmp 0x17f77
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov ecx, ebx
call fcn.00017db4
cmp al, dil
jne 0x17f3a
mov eax, 0xc0000001
jmp 0x17f77
call fcn.00017e88
mov rsi, rax
cmp rax, rdi
je 0x17f33
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp ebx, edi
cmovl edi, ebx
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.0001d8a0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x183a4
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x00020100]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov ebx, ecx
lea rcx, [rsp + 0x32]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], di
call fcn.0001de80
call sub.SPYSHELTER.SYS_SpS_ControlFunction5
cmp eax, 1
jne 0x183f4
mov eax, 0xc0000022
jmp 0x1844e
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov ecx, ebx
call fcn.000182cc
cmp eax, edi
jge 0x18411
mov eax, 0xc0000001
jmp 0x1844e
call fcn.00017e88
mov rsi, rax
cmp rax, rdi
je 0x1840a
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp ebx, edi
cmovl edi, ebx
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.0001d8a0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x187bc
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
xor edi, edi
mov r13, rdx
mov r14, rcx
lea esi, [rdi + 0xb]
lea r9, [rax + 0x18]
xor r8d, r8d
xor edx, edx
mov ecx, esi
mov r12, rdi
mov dword [rax + 0x18], edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
je 0x18803
xor eax, eax
jmp 0x18895
mov edx, dword [rsp + 0x60]
mov ecx, 1
call fcn.0001c018
mov rbx, rax
cmp rax, rdi
je 0x187fc
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
mov rdx, rax
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, edi
jl 0x1888a
mov esi, edi
cmp dword [rbx], edi
jbe 0x18887
lea rbp, [rbx + 0x2e]
movzx ecx, word [rbp]
mov eax, esi
mov rdx, r14
imul rax, rax, 0x128
add rax, rbx
lea rcx, [rcx + rax + 0x30]
call fcn.0001d8f6
cmp eax, edi
je 0x1886c
inc esi
add rbp, 0x128
cmp esi, dword [rbx]
jb 0x1883c
jmp 0x18887
mov eax, esi
imul rax, rax, 0x128
mov r12, qword [rax + rbx + 0x18]
cmp r13, rdi
je 0x18887
mov eax, dword [rax + rbx + 0x20]
mov dword [r13], eax
mov rdi, r12
mov rcx, rbx
call fcn.0001c090
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x188b4
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x188d3
xor eax, eax
jmp 0x188ee
mov rcx, qword [rsp + 0x38]
call sub.ntoskrnl.exe_PsGetProcessInheritedFromUniqueProcessId
mov rcx, qword [rsp + 0x38]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1895c
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov dil, bl
cmp rcx, rbx
jne 0x18985
xor al, al
jmp 0x18a47
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, ebx
jl 0x1897e
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsReferencePrimaryToken]
mov rsi, rax
cmp rax, rbx
je 0x18a3a
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_SeQueryInformationToken]
cmp eax, ebx
jl 0x18a2e
call fcn.000190d4
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
mov rdx, qword [rax + 0x108]
call qword [sym.imp.ntoskrnl.exe_RtlEqualSid]
mov dil, al
cmp al, bl
jne 0x18a21
call fcn.000190d4
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
mov rdx, qword [rax + 0x180]
call qword [sym.imp.ntoskrnl.exe_RtlEqualSid]
mov dil, al
cmp al, bl
jne 0x18a21
call fcn.000190d4
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
mov rdx, qword [rax + 0x188]
call qword [sym.imp.ntoskrnl.exe_RtlEqualSid]
mov dil, al
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PsDereferencePrimaryToken]
mov bl, dil
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x18acc
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rsi, r9
mov rbp, r8
mov r12, rdx
mov r13, rcx
mov eax, 0x10000
mov edx, eax
mov ecx, 1
mov dword [rsp + 0x30], eax
call fcn.0001c018
mov rdi, rax
test rax, rax
je 0x18b7e
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x18b3f
mov rcx, rdi
call fcn.0001c090
mov eax, dword [rsp + 0x30]
add eax, 0x4000
jmp 0x18af5
test eax, eax
js 0x18b76
mov rbx, rdi
mov r8, qword [rbx + 0x40]
test r8, r8
je 0x18b6a
mov edx, dword [rbx + 0x64]
mov rcx, qword [rbx + 0x50]
mov r9, r12
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbp
call r13
test al, al
je 0x18b76
cmp dword [rbx], 0
je 0x18b76
mov eax, dword [rbx]
add rbx, rax
jmp 0x18b46
mov rcx, rdi
call fcn.0001c090
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x18ba0
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea rdx, [rsp + 0x40]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, ebx
jge 0x18bc7
xor al, al
jmp 0x18bf4
mov rcx, qword [rsp + 0x40]
call fcn.0001d90e
cmp rax, rbx
je 0x18be7
mov rdx, rdi
mov rcx, rax
call fcn.0001d8f6
cmp eax, ebx
jne 0x18be7
mov bl, 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x19380
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0xc0
and qword [rax + 0x18], 0
lea rdx, [0x0001e910]
lea rcx, [rax - 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x90], 0
and qword [rsp + 0xa8], 0
and qword [rsp + 0xb0], 0
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0xe0]
mov edi, 1
mov edx, 0x80100000
mov dword [rsp + 0x28], 0x60
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x88], 0x30
mov dword [rsp + 0xa0], 0x240
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
js 0x1951c
mov rcx, qword [rsp + 0xe0]
lea r9d, [rdi + 0x17]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x194de
movsxd rbx, dword [rsp + 0x7c]
mov eax, dword [rsp + 0x78]
shl rbx, 0x20
or rbx, rax
je 0x19509
cmp rbx, 0x6400000
ja 0x19509
mov rdx, rbx
mov ecx, edi
call fcn.0001c018
mov rdi, rax
test rax, rax
je 0x194d9
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0xe0]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov esi, eax
test eax, eax
jns 0x194ca
mov rcx, rdi
call fcn.0001c090
mov ebx, esi
jmp 0x194de
cmp qword [rsp + 0x58], rbx
je 0x194f0
mov rcx, rdi
call fcn.0001c090
mov ebx, 0xc0000001
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
jmp 0x1951c
mov rcx, qword [rsp + 0xe0]
mov qword [0x00045528], rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
jmp 0x1951c
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc0000001
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x19538
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rdx, [rsp + 0x38]
xor edi, edi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, edi
jge 0x1955c
xor al, al
jmp 0x19583
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov ecx, 1
movzx ebx, dil
cmp rax, rdi
cmovne ebx, ecx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1962c
Capabilities:
Find process by pid

Disassembly:
push rdi
sub rsp, 0x20
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x19650
lea rax, [0x0001e0f0]
jmp 0x196c0
mov rcx, qword [rsp + 0x38]
call fcn.0001d90e
mov r11, rax
test rax, rax
jne 0x1966f
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x19647
lea rdi, [0x00045530]
mov byte [0x00045633], 0
mov edx, 0x103
mov rcx, rdi
sub r11, rdi
lea rax, [rdx + 0x7ffffefb]
test rax, rax
je 0x196a7
mov al, byte [r11 + rcx]
test al, al
je 0x196a7
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x19688
test rdx, rdx
jne 0x196af
dec rcx
mov byte [rcx], 0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x19aec
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x00045650]
and dword [rsp + 0x30], 0
test rax, rax
jne 0x19bcd
lea edi, [rax + 0xb]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov ecx, edi
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
je 0x19b33
xor eax, eax
jmp 0x19bcd
mov edx, dword [rsp + 0x30]
mov ecx, 1
call fcn.0001c018
mov rbx, rax
test rax, rax
je 0x19b2c
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
jns 0x19b6c
mov rcx, rbx
call fcn.0001c090
jmp 0x19b2c
xor edi, edi
cmp dword [rbx], edi
jbe 0x19bbe
lea rsi, [rbx + 0x2e]
movzx ecx, word [rsi]
mov eax, edi
lea rdx, [0x0001e630]
imul rax, rax, 0x128
add rax, rbx
lea rcx, [rcx + rax + 0x30]
call fcn.0001d8f6
test eax, eax
je 0x19ba9
inc edi
add rsi, 0x128
cmp edi, dword [rbx]
jb 0x19b76
jmp 0x19bbe
mov eax, edi
imul rax, rax, 0x128
mov rax, qword [rax + rbx + 0x18]
mov qword [0x00045650], rax
mov rcx, rbx
call fcn.0001c090
mov rax, qword [0x00045650]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x19c8c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov bpl, r9b
mov bl, r8b
mov esi, edx
mov r12, rcx
call fcn.00019be4
test rax, rax
je 0x19ceb
mov rcx, rax
call fcn.0001c3ec
test eax, eax
jne 0x19ceb
call fcn.0001d940
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
xor r9d, r9d
lea ecx, [r9 + 0x21]
mov rdx, rax
mov r8d, ebx
call fcn.0001b50c
xor eax, eax
jmp 0x19ddb
test bl, bl
je 0x19cf8
mov ecx, esi
call fcn.0001c300
mov esi, eax
cmp esi, 0xffffffff
je 0x19ce4
cmp qword [0x00045528], 0
jne 0x19d28
lea rdx, [0x00045528]
lea rcx, [0x0001e910]
call fcn.00019380
test eax, eax
js 0x19ce4
cmp qword [0x00045528], 0
je 0x19ce4
call fcn.0001adc8
mov rdi, rax
test rax, rax
je 0x19ce4
call fcn.00019aec
mov rbx, qword [0x00045528]
mov r13d, 0x5a4d
sub rdi, rax
cmp word [rbx], r13w
je 0x19d54
xor ecx, ecx
jmp 0x19d5b
movsxd rcx, dword [rbx + 0x3c]
add rcx, rbx
mov edx, edi
call fcn.0001c8c8
test eax, eax
je 0x19ce4
mov edx, eax
add rdx, rbx
cmp word [rbx], r13w
jne 0x19d84
movsxd rax, dword [rbx + 0x3c]
add rax, rbx
je 0x19d84
mov rcx, qword [rax + 0x30]
jmp 0x19d86
xor ecx, ecx
movsxd rax, esi
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x28]
mov rbx, qword [rdx + rax*8]
lea rdx, [rsp + 0x24]
sub rbx, rcx
lea rcx, [rsp + 0x20]
add rbx, r12
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
cmp dword [rsp + 0x20], 5
jne 0x19dbf
cmp dword [rsp + 0x24], 2
jne 0x19dbf
and rbx, 0xfffffffffffffff0
test bpl, bpl
je 0x19dd8
cmp byte [rbx], 0xff
jne 0x19dd8
cmp byte [rbx + 1], 0x25
jne 0x19dd8
movsxd rcx, dword [rbx + 2]
mov rbx, qword [rcx + rbx + 6]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret

Function at 0x1aac0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x48
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x24]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov eax, 1
test eax, eax
jne 0x1aaf9
cmp dword [rsp + 0x24], 5
jne 0x1aaf9
cmp dword [rsp + 0x20], 1
jne 0x1aaf9
mov al, 1
jmp 0x1aafb
xor al, al
add rsp, 0x48
ret
Function at 0x1ab18
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
lea rax, [0x0001e340]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x38]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov dword [rsp + 0x30], ecx
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x50]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov dword [rsp + 0x28], ecx
xor r9d, r9d
lea r8, [rsp + 0x2c]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x24]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov eax, 1
test eax, eax
jne 0x1ab93
cmp dword [rsp + 0x24], 5
jne 0x1ab93
cmp dword [rsp + 0x20], 1
je 0x1ab97
xor al, al
jmp 0x1abe0
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
call fcn.0001d8f6
test eax, eax
jne 0x1abae
mov al, 1
jmp 0x1abe0
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x28], eax
jle 0x1abde
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x28]
sub eax, ecx
cdqe
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rdx, qword [rsp + 0x38]
call fcn.0001d8f6
test eax, eax
jne 0x1abde
mov al, 1
jmp 0x1abe0
xor al, al
add rsp, 0x40
pop rdi
ret

Function at 0x1abec
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
lea rax, [0x0001e850]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x38]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov dword [rsp + 0x30], ecx
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov dword [rsp + 0x28], ecx
xor r9d, r9d
lea r8, [rsp + 0x2c]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x24]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov eax, 1
test eax, eax
jne 0x1ac69
cmp dword [rsp + 0x24], 5
jne 0x1ac69
cmp dword [rsp + 0x20], 1
je 0x1ac6d
xor al, al
jmp 0x1acb8
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
call fcn.0001d926
test eax, eax
jne 0x1ac84
mov al, 1
jmp 0x1acb8
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x28], eax
jle 0x1acb6
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x28]
sub eax, ecx
movsxd rcx, eax
mov rax, qword [rsp + 0x50]
lea rcx, [rax + rcx*2]
mov rdx, qword [rsp + 0x38]
call fcn.0001d926
test eax, eax
jne 0x1acb6
mov al, 1
jmp 0x1acb8
xor al, al
add rsp, 0x40
pop rdi
ret

Function at 0x1ad14
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov byte [rsp + 0x20], 0
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x1ad67
mov rcx, qword [rsp + 0x28]
call fcn.0001acc4
mov byte [rsp + 0x20], al
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, byte [rsp + 0x20]
add rsp, 0x48
ret