joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015630
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x14000996e
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140015630
cmp byte [0x14009a090], 0
jne 0x1400099b9
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400099a9
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14009a090], 1
mov qword [0x14009a088], rax
jmp 0x1400099c0
mov rax, qword [0x14009a088]
mov byte [0x14009a090], 1
jmp 0x1400099c0
mov rax, qword [0x14009a088]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x1400099df
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400156a4
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x1400156bf
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x1400156bf
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x1400156bf
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
add byte [rax], al
movsb byte [rdi], byte [rsi]
xor al, 5
add al, al
and dword [rax], eax
add al, ah
and dword [rax], eax
add byte [rax], cl
add eax, 0x22a000
add al, ch
and al, byte [rax]
add ah, ch
invalid
Function at 0x140015c60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x460
mov rax, qword [0x1400975a0]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor r14d, r14d
mov rbx, rdx
mov rsi, r8
mov qword [rsp + 0x38], rcx
lea r8d, [r14 + 0x60]
xor edx, edx
mov rcx, rbx
mov rbp, r9
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x40], r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x140015cd5
lea r8d, [r14 + 2]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x140015cd5
call fcn.140007660
mov ebx, eax
jmp 0x140015dd7
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140015cf6
call fcn.140007660
jmp 0x140015dc7
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
jne 0x140015d14
call fcn.140007660
jmp 0x140015dc7
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
inc eax
cmp eax, ebx
jae 0x140015d32
mov ebx, 0x8007000e
jmp 0x140015dc9
mov ecx, eax
test eax, eax
je 0x140015d70
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140015e10
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x140015d70
lea rcx, [rsp + 0x40]
call fcn.140007100
cmp qword [rsp + 0x40], r14
jne 0x140015d7a
mov ebx, 0x8007000e
jmp 0x140015dc9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor edx, edx
mov r9d, ebx
lea ecx, [rdx + 3]
mov r8, rsi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x140015da4
call fcn.140007660
jmp 0x140015dc7
mov r8d, dword [rsp + 0x4b0]
mov ecx, eax
mov rax, qword [rsp + 0x40]
mov word [rax + rcx*2], r14w
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140015a20
mov ebx, eax
test rdi, rdi
je 0x140015dd7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x40], rax
je 0x140015df0
lea rcx, [rsp + 0x40]
call fcn.14000c920
nop dword [rax]
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14001d080
add rsp, 0x460
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80070216
call fcn.140007790
int3
Function at 0x140017530
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x140017780
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r9, r8
mov r10, rdx
test r8, r8
jne 0x140017798
lea eax, [r8 + 0xd]
add rsp, 0x38
ret
xor r8d, r8d
mov rdx, r9
nop
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400177a4
inc eax
lea rdx, [rdx + rax*2]
lea r8d, [r8 + rax*2]
cmp eax, 1
jne 0x1400177a0
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret
Function at 0x14001a3b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x38
mov rbx, qword [0x14009a190]
movzx edi, r8b
mov rsi, rcx
mov r8d, 0xf1
mov rcx, rbx
mov ebp, r9d
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
jne 0x14001a3ed
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14001a3e2
mov rcx, rax
mov qword [rsp + 0x78], r14
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
jne 0x14001a422
mov r14, qword [rsp + 0x78]
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
movzx r8d, word [rax + 4]
movzx edx, word [rax + 2]
mov rcx, rsi
mov qword [rsp + 0x30], r15
movzx r15d, word [rax + 6]
call fcn.140017610
cmp qword [rsi + 0x80], 0
jne 0x14001a47b
mov rcx, qword [rsp + 0x68]
call fcn.1400076b0
and byte [rsi + 0xf1], 0xdf
mov rcx, rsi
and al, 1
shl al, 5
or byte [rsi + 0xf1], al
movzx edx, word [r14 + 6]
call fcn.140008fb0
test al, al
jne 0x14001a47b
xor eax, eax
jmp 0x14001a5ac
mov rcx, qword [rsi + 0x80]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r13
call qword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
xor r12d, r12d
mov r13d, eax
test dil, dil
je 0x14001a4c8
mov ecx, dword [rsp + 0x88]
movsx edx, word [rsp + 0x68]
mov r9, qword [rsp + 0x80]
mov dword [rsp + 0x20], ecx
mov rcx, qword [0x14009a190]
movzx r8d, bp
call qword [sym.imp.COMCTL32.dll_CreateMappedBitmap]
jmp 0x14001a4fe
test byte [rsi + 0xf1], 0x20
mov rdx, qword [rsp + 0x68]
mov rcx, qword [0x14009a190]
je 0x14001a4f8
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x2040
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_LoadImageW]
jmp 0x14001a4fe
call qword [sym.imp.USER32.dll_LoadBitmapW]
mov rbx, rax
test rax, rax
je 0x14001a591
mov r8d, dword [rsi + 0x10c]
mov rcx, qword [rsi + 0x80]
mov rdx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
cmp eax, 0xffffffff
je 0x14001a591
mov ebp, r12d
mov rdi, r12
test r15, r15
jle 0x14001a55a
cmp word [r14 + rdi*2 + 8], r12w
je 0x14001a550
movsxd rdx, ebp
lea rcx, [rsi + 0x88]
add rdx, 4
lea rdx, [r14 + rdx*2]
call fcn.140005930
inc rdi
inc ebp
cmp rdi, r15
jl 0x14001a531
mov rcx, qword [rsi + 0x80]
call qword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
mov edi, eax
cmp eax, dword [rsi + 0x90]
jne 0x14001a591
call fcn.14000e360
test al, al
je 0x14001a58b
sub edi, r13d
mov edx, r13d
mov rcx, rsi
mov r8d, edi
call fcn.14001a060
mov r12d, 1
mov r13, qword [rsp + 0x70]
test rbx, rbx
je 0x14001a5a4
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov eax, r12d
mov r12, qword [rsp + 0x60]
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x78]
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001b1a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
xor r14d, r14d
mov rbp, rcx
mov ebx, 0xa2864115
cmp byte [rcx], r14b
je 0x14001b224
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
mov rdi, rcx
nop dword [rax]
lea rcx, [0x140046298]
call fcn.14001c914
movzx edi, word [rdi]
lea rcx, [0x1400462a0]
sub di, ax
call fcn.14001c914
lea rcx, [0x140046290]
lea esi, [rdi + rax]
call fcn.14001c914
inc r14d
mov ecx, ebx
add ax, si
mov edi, r14d
ror ecx, 8
movzx eax, ax
add rdi, rbp
add ecx, eax
xor ebx, ecx
cmp byte [rdi], 0
jne 0x14001b1d0
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14001b240
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x48
cmp dword [0x1400965f0], 0
je 0x14001b257
mov eax, 1
add rsp, 0x48
ret
mov rax, qword gs:[0x60]
xor edx, edx
mov qword [rsp + 0x60], rsi
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x14001b43c
nop dword [rax]
mov rsi, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x14001b2b9
lea rdx, [rsi + rcx]
mov ecx, dword [rsi + rcx + 0xc]
mov eax, dword [rcx + rsi]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x14001b2b9
mov eax, dword [rcx + rsi + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x14001b2c5
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x14001b280
test rdx, rdx
je 0x14001b43c
mov qword [rsp + 0x58], rbp
mov ebp, dword [rdx + 0x18]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r12
mov r12d, dword [rdx + 0x1c]
mov qword [rsp + 0x30], r13
mov r13d, dword [rdx + 0x24]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov r15d, dword [rdx + 0x20]
add r12, rsi
add r13, rsi
add r15, rsi
mov eax, 0x775a
lea rdx, [0x1400965f0]
xor edi, edi
mov qword [rsp + 0x50], rbx
nop word [rax + rax]
dec ebp
mov ecx, dword [r15 + rbp*4]
add rcx, rsi
cmp word [rcx], ax
jne 0x14001b35d
lea rbx, [rdx + rdi*8]
call fcn.14001b1a0
inc edi
mov dword [rbx + 4], eax
movzx eax, word [r13 + rbp*2]
mov ecx, dword [r12 + rax*4]
mov dword [rbx + 8], ecx
cmp edi, 0x1f4
je 0x14001b361
lea rdx, [0x1400965f0]
mov eax, 0x775a
test ebp, ebp
jne 0x14001b320
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
lea eax, [rdi - 1]
xor esi, esi
mov dword [0x1400965f0], edi
test eax, eax
je 0x14001b414
nop
mov eax, edi
xor ebx, ebx
sub eax, esi
dec eax
je 0x14001b407
lea r15, [0x1400965f0]
lea rcx, [0x140046298]
call fcn.14001c914
lea rcx, [0x1400462a0]
mov edi, ebx
sub edi, eax
call fcn.14001c914
mov ebp, dword [r15 + rbx*8 + 8]
lea r14, [r15 + rbx*8]
lea rcx, [0x140046290]
add edi, eax
call fcn.14001c914
lea ecx, [rax + 1]
add ecx, edi
cmp ebp, dword [r15 + rcx*8 + 8]
jbe 0x14001b3f5
mov edx, dword [r14 + 4]
lea eax, [rbx + 1]
mov ecx, eax
mov eax, dword [r15 + rax*8 + 4]
mov dword [r14 + 4], eax
mov eax, dword [r15 + rcx*8 + 8]
mov dword [r15 + rcx*8 + 4], edx
mov dword [r14 + 8], eax
mov dword [r15 + rcx*8 + 8], ebp
mov edi, dword [0x1400965f0]
inc ebx
mov eax, edi
sub eax, esi
dec eax
cmp ebx, eax
jb 0x14001b391
lea eax, [rdi - 1]
inc esi
cmp esi, eax
jb 0x14001b380
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov eax, 1
add rsp, 0x48
ret
xor eax, eax
mov rsi, qword [rsp + 0x60]
add rsp, 0x48
ret

Function at 0x14001e518
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14001e380
Function at 0x1400bcba0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1400bcbc2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1400bcc3c
mov rdi, r14
mov rcx, rbx
call fcn.1400be040
test rax, rax
jle 0x1400bcc14
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1400c2920
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400bcc2c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400bcc34
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400bcbd6
sub r14, rdi
jmp 0x1400bcd29
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400bcc53
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400bcc55
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400bcc8a
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400c2920
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400bcd26
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x1400bccc5
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x1400bcd01
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400c9800
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x1400bcd3f
cmp rbp, rax
ja 0x1400bccd1
mov r8, rdi
test rdi, rdi
je 0x1400bcd26
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400c9800
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x1400bcd29
Function at 0x1400bd140
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400f8060]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400bd16d
xor eax, eax
jmp 0x1400bd2b3
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400bd1a7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400bd1a7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400bd2b3
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400bd2a6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400bd1ea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400bd1f9
movsx ecx, dil
jmp 0x1400bd24d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
je 0x1400bd267
sub eax, 1
je 0x1400bd267
cmp eax, 2
jne 0x1400bd2a6
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.1400c6fbc
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400bd2ab
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400bd294
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.1400c9144
cmp rsi, rax
jne 0x1400bd2a6
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x1400bd2ab
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400c08b0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400bef20
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push r12
sub rsp, 0x20
cmp dword [0x1400fa8e0], 0
jne 0x1400bf11e
mov rax, qword gs:[0x60]
xor r12d, r12d
mov edx, r12d
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x1400bf12a
nop word [rax + rax]
mov r11, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x1400bef9d
lea rdx, [r11 + rcx]
mov ecx, dword [r11 + rcx + 0xc]
mov eax, dword [rcx + r11]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x1400bef9d
mov eax, dword [rcx + r11 + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x1400befa9
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x1400bef60
test rdx, rdx
je 0x1400bf12a
mov qword [rsp + 0x30], rbx
mov ebx, dword [rdx + 0x18]
mov qword [rsp + 0x38], rbp
mov ebp, dword [rdx + 0x24]
mov qword [rsp + 0x40], rsi
mov esi, dword [rdx + 0x20]
mov qword [rsp + 0x18], rdi
add rsi, r11
mov qword [rsp + 0x10], r13
mov r13d, 0x775a
mov qword [rsp + 8], r14
mov r14d, dword [rdx + 0x1c]
mov edx, r12d
add r14, r11
mov qword [rsp], r15
add rbp, r11
lea r15, [0x1400fa8e0]
nop word [rax + rax]
dec ebx
mov r10d, dword [rsi + rbx*4]
add r10, r11
cmp word [r10], r13w
jne 0x1400bf063
mov r9d, r12d
mov r8d, 0x8a52dcf3
mov rax, r10
nop dword [rax + rax]
movzx eax, word [rax]
mov ecx, r8d
ror ecx, 8
inc r9d
add ecx, eax
mov eax, r9d
add rax, r10
xor r8d, ecx
cmp byte [rax], r12b
jne 0x1400bf020
mov ecx, edx
inc edx
add rcx, rcx
mov dword [r15 + rcx*8 + 8], r8d
movzx eax, word [rbp + rbx*2]
mov eax, dword [r14 + rax*4]
mov dword [r15 + rcx*8 + 0xc], eax
mov qword [r15 + rcx*8 + 0x10], r12
cmp edx, 0x1f4
je 0x1400bf067
test ebx, ebx
jne 0x1400bf000
mov r14, qword [rsp + 8]
lea eax, [rdx - 1]
mov r13, qword [rsp + 0x10]
mov r11d, r12d
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov dword [0x1400fa8e0], edx
test eax, eax
je 0x1400bf110
nop
mov ecx, edx
mov eax, r12d
sub ecx, r11d
cmp ecx, 1
je 0x1400bf105
nop dword [rax]
lea r10d, [rax + 1]
mov r9d, eax
add r9, r9
mov r8d, r10d
add r8, r8
mov edi, dword [r15 + r9*8 + 0xc]
mov ebx, dword [r15 + r8*8 + 0xc]
cmp edi, ebx
jbe 0x1400bf0f6
mov edx, dword [r15 + r9*8 + 8]
mov eax, dword [r15 + r8*8 + 8]
mov rcx, qword [r15 + r9*8 + 0x10]
mov dword [r15 + r9*8 + 8], eax
mov rax, qword [r15 + r8*8 + 0x10]
mov qword [r15 + r9*8 + 0x10], rax
mov dword [r15 + r9*8 + 0xc], ebx
mov dword [r15 + r8*8 + 8], edx
mov dword [r15 + r8*8 + 0xc], edi
mov qword [r15 + r8*8 + 0x10], rcx
mov edx, dword [0x1400fa8e0]
mov ecx, edx
mov eax, r10d
sub ecx, r11d
dec ecx
cmp r10d, ecx
jb 0x1400bf0a0
inc r11d
lea eax, [rdx - 1]
cmp r11d, eax
jb 0x1400bf090
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp]
mov eax, 1
add rsp, 0x20
pop r12
ret
xor eax, eax
add rsp, 0x20
pop r12
ret
Function at 0x1400bf1c0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xe5355801
call fcn.1400bf140
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400bf200
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xadbda420
call fcn.1400bf140
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400bf480
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xdd8d21e9
call fcn.1400bf140
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400bf500
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x3e6b16cd
call fcn.1400bf140
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400bf540
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x1d951717
call fcn.1400bf140
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400bf5c0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x89e39547
call fcn.1400bf140
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400c6f98
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400c6dc4
Function at 0x140001058
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
movsxd rax, dword [rcx]
mov rbx, rcx
test eax, eax
je 0x1400010a3
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400010a3
call qword [sym.imp.ntoskrnl.exe_PsGetProcessSectionBaseAddress]
test rax, rax
je 0x1400010a3
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, 0xc0000001
add rsp, 0x20
pop rbx
ret

Function at 0x140001260
Capabilities:
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
movsxd rax, dword [rcx]
mov rdi, rcx
test eax, eax
je 0x14000132a
and qword [r11 + 8], 0
lea rdx, [r11 + 8]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000132a
call fcn.140001000
mov rcx, qword [rsp + 0x40]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, qword [rdi + 8]
mov rcx, rbx
mov rsi, qword [rdi + 0x18]
call fcn.140001340
test rax, rax
je 0x14000132a
mov ecx, eax
mov edx, 0x1000
and ecx, 0xfff
sub edx, ecx
mov ecx, dword [rdi + 4]
cmp edx, esi
cmovl esi, edx
and qword [rsp + 0x48], 0
movsxd r8, esi
cmp ecx, 0x762c
jne 0x14000130f
lea rcx, [rsp + 0x48]
mov r9d, 1
mov qword [rsp + 0x20], rcx
mov rdx, rax
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ntoskrnl.exe_MmCopyMemory]
xor eax, eax
jmp 0x14000132f
cmp ecx, 0x76b
jne 0x14000132a
mov rdx, qword [rdi + 0x10]
lea r9, [rsp + 0x48]
mov rcx, rax
call fcn.1400014f4
jmp 0x14000130b
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret