joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001135c
Capabilities:
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rax, [rbp + 0x18]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1800113b5
lea rax, str.Failed_to_open_Memory_Management_registry_key
mov qword [rbp - 8], 0x2d
mov ecx, 0x50
lea rdx, [rbp - 0x10]
mov qword [rbp - 0x10], rax
call fcn.18000b3f4
jmp 0x180011459
mov rcx, qword [rbp + 0x18]
lea rax, [rbp + 0x10]
mov dword [rsp + 0x28], 4
lea rdx, str.FeatureSettingsOverride
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x10], 3
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x18]
test eax, eax
je 0x18001140b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, str.Failed_to_set_FeatureSettingsOverride_to_3
mov qword [rbp - 8], 0x2a
mov ecx, 0x51
jmp 0x1800113a3
lea rax, [rbp + 0x10]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.FeatureSettingsOverrideMask
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x18]
test eax, eax
je 0x180011451
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, str.Failed_to_set_FeatureSettingsOverrideMask_to_3
mov qword [rbp - 8], 0x2e
jmp 0x180011404
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x40
pop rbp
ret
Function at 0x180011460
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x30
xor bl, bl
call fcn.180011dd4
test al, al
je 0x1800114ca
mov r9d, 0x1034
lea r8, str.Incompatible_system_settings
lea rdx, str.Hypervisor_Code_Integrity__HVCI__is_enabled__nFumo_loader_is_not_compatible_with_HVCI._nDisable_HVCI_now_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x1800114bb
lea rax, str.Hypervisor_Code_Integrity__HVCI__is_enabled__please_disable_it_and_try_again
mov qword [rsp + 0x28], 0x4c
mov ecx, 0x33
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.18000b3f4
jmp 0x180011579
call fcn.1800112a8
test eax, eax
jne 0x180011579
mov bl, 1
call fcn.180011e18
test al, al
je 0x180011516
mov r9d, 0x1034
lea r8, str.Incompatible_system_settings
lea rdx, str.Kernel_Virtual_Address_Shadow__KVAS__is_enabled__nFumo_loader_is_not_compatible_with_KVAS._nDisable_KVAS_now_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x18001150b
lea rax, str.Kernel_Virtual_Address_Shadow__KVAS__is_enabled__please_disable_it_and_try_again
mov qword [rsp + 0x28], 0x50
mov ecx, 0x34
jmp 0x1800114a7
call fcn.18001135c
test eax, eax
je 0x18001151a
jmp 0x180011579
test bl, bl
je 0x180011577
mov r9d, 0x1024
lea r8, str.Reboot_required
lea rdx, str.System_settings_have_been_changed._nA_reboot_is_required_to_apply_the_changes._nReboot_now_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x180011570
lea rcx, str.SeShutdownPrivilege
call fcn.180012588
test al, al
jne 0x180011565
lea rax, str.Failed_to_get_shutdown_privileges
mov qword [rsp + 0x28], 0x21
mov ecx, 4
jmp 0x1800114a7
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, 0x35
jmp 0x180011579
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x180011580
Capabilities:
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov r8d, 0x24
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor ebx, ebx
mov rdi, rax
test rax, rax
jne 0x1800115aa
lea eax, [rdi + 0x3e]
jmp 0x18001161e
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1800115c6
lea ebx, [rax + 0x3f]
jmp 0x180011613
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rsi, rax
jmp 0x1800115fe
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, rsi
cmp rax, 0x7530
ja 0x18001160e
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x180011607
cmp dword [rsp + 0x24], 1
jne 0x1800115d1
jmp 0x180011613
mov ebx, 0x41
jmp 0x180011613
mov ebx, 0x40
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180011dd4
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov r8d, 8
xor r9d, r9d
mov dword [rsp + 0x30], r8d
lea ecx, [r8 + 0x5f]
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
js 0x180011e10
mov al, 1
test byte [rsp + 0x34], al
je 0x180011e10
test dword [rsp + 0x34], 0x400
jne 0x180011e12
xor al, al
add rsp, 0x28
ret

Function at 0x180011e18
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov ecx, 0xc4
lea r8d, [r9 + 4]
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
js 0x180011e53
mov eax, dword [rsp + 0x30]
mov cl, 1
test cl, al
je 0x180011e4d
test al, 0x20
je 0x180011e4f
test al, 0x10
jne 0x180011e4f
xor cl, cl
mov al, cl
jmp 0x180011e55
xor al, al
add rsp, 0x28
ret
Function at 0x180013030
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 0x10], rdx
push r14
sub rsp, 0x40
mov r14, rcx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
jne 0x18001305d
mov ecx, 0xc0000005
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x40
pop r14
ret
movzx ecx, word [rax + 4]
mov edx, 0x8664
cmp cx, dx
jne 0x180013073
mov ecx, dword [rax + 0x88]
jmp 0x180013084
mov edx, 0x14c
cmp cx, dx
jne 0x180013143
mov ecx, dword [rax + 0x78]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov r15d, ecx
add r15, r14
mov r12d, dword [r15 + 0x20]
mov r13d, dword [r15 + 0x24]
add r12, r14
mov edi, dword [r15 + 0x18]
add r13, r14
dec edi
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rsp + 0x58]
lea ebx, [rdi + rsi]
shr ebx, 1
mov edx, dword [r12 + rbx*4]
add rdx, r14
call fcn.180015bd0
test eax, eax
jns 0x1800130ef
lea edi, [rbx - 1]
jmp 0x1800130f4
jle 0x180013124
lea esi, [rbx + 1]
cmp edi, esi
jae 0x1800130d0
xor eax, eax
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x20]
add rsp, 0x40
pop r14
ret
cmp edi, esi
jb 0x1800130f8
movzx ecx, word [r13 + rbx*2]
cmp ecx, dword [r15 + 0x14]
jae 0x1800130f8
mov eax, dword [r15 + 0x1c]
add rax, r14
mov eax, dword [rax + rcx*4]
add rax, r14
jmp 0x1800130fa
mov ecx, 0x65e
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x40
pop r14
ret
Function at 0x180017c40
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call fcn.18001f970
lea rcx, [rax*2 + 0x208]
call fcn.180021290
mov rbx, rax
test rax, rax
jne 0x180017c80
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov r9d, 0x7ffe0030
mov qword [rsp + 0x20], rdi
lea r8, str._ws_system32drivers_ws.sys
mov edx, 0x208
mov rcx, rbx
call fcn.180015b10
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180017cb0
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x498
mov rax, qword [0x1801e4940]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rbp, qword [rsp + 0x4f0]
xor eax, eax
mov qword [r8], rax
mov r15, r9
mov qword [r9], rax
mov r14, r8
mov rsi, rdx
mov dword [rsp + 0x40], eax
mov qword [rbp], rax
mov rbx, rcx
mov rdi, qword [rcx + 0x18]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
test rdi, rdi
jne 0x180017d24
lea rdx, str.____Cannot_query_ntoskrnl_loaded_base__abort_r_n
mov ecx, 1
call fcn.1800224a0
jmp 0x180017ea8
mov rdx, rdi
lea rcx, str.___Loaded_ntoskrnl_base_0x_llX_r_n
call fcn.1800140c0
mov edx, 0x7ffe0030
lea rcx, [rsp + 0x70]
call fcn.180024fd0
lea rdx, str._system32_ntoskrnl.exe
lea rcx, [rsp + 0x70]
call fcn.18001f8c0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea r9, [rsp + 0x48]
xor edx, edx
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_LdrLoadDll]
test eax, eax
js 0x180017e9a
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x180017e9a
lea rcx, str.___Ntoskrnl.exe_mapped_at_0x_llX_r_n
call fcn.1800140c0
mov rax, qword [rsp + 0x48]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x50]
mov r9, rsi
mov qword [rbx + 0x20], rax
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.180018890
test eax, eax
jne 0x180017ddb
lea rdx, str.____Error_while_mapping_payload__abort_r_n
mov ecx, 1
call fcn.1800224a0
jmp 0x180017ea8
mov rsi, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov rdx, rsi
mov r8, qword [rsp + 0x58]
mov ecx, dword [rbx + 8]
mov qword [rsp + 0x30], rax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
call fcn.180014120
mov rdi, rax
test rax, rax
je 0x180017ea8
mov edx, dword [rsp + 0x40]
test edx, edx
jne 0x180017e46
lea rdx, str.____Unexpected_shellcode_procedure_size__abort_r_n
mov ecx, 1
call fcn.1800224a0
mov ecx, dword [rbx + 8]
xor edx, edx
call fcn.180015810
mov edx, eax
mov rcx, rdi
call fcn.180015240
jmp 0x180017ea8
lea rcx, str.___Bootstrap_code_size__0x_lX_r_n
call fcn.1800140c0
mov ecx, dword [rbx + 8]
mov rdx, rdi
call fcn.1800144f0
test rax, rax
jne 0x180017e89
lea rdx, str.____Error_building_the_ready_event_handle__abort_r_n
mov ecx, 1
call fcn.1800224a0
mov ecx, dword [rbx + 8]
xor edx, edx
call fcn.180015810
mov edx, eax
mov rcx, rdi
call fcn.180015240
jmp 0x180017eb9
mov qword [r14], rdi
mov qword [r15], rsi
mov qword [rbp], rax
mov eax, 1
jmp 0x180017ebb
mov edx, eax
lea rcx, str.____Error_while_loading_ntoskrnl.exe
call fcn.180023040
lea rdx, str.____Error_while_building_shellcode__abort_r_n
mov ecx, 1
call fcn.1800224a0
xor eax, eax
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.180028780
add rsp, 0x498
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800185b0
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x490
mov rax, qword [0x1801e4940]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor r14d, r14d
mov rsi, r8
mov qword [r8], r14
mov rbp, rdx
mov rbx, qword [rcx + 0x18]
mov rdi, rcx
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
test rbx, rbx
jne 0x180018612
lea rdx, str.____Cannot_query_ntoskrnl_loaded_base__abort_r_n
mov ecx, 1
call fcn.1800224a0
jmp 0x18001874f
mov rdx, rbx
lea rcx, str.___Loaded_ntoskrnl_base_0x_llX_r_n
call fcn.1800140c0
mov edx, 0x7ffe0030
lea rcx, [rsp + 0x70]
call fcn.180024fd0
lea rdx, str._system32_ntoskrnl.exe
lea rcx, [rsp + 0x70]
call fcn.18001f8c0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea r9, [rsp + 0x48]
xor edx, edx
lea r8, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_LdrLoadDll]
test eax, eax
js 0x180018741
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x180018741
lea rcx, str.___Ntoskrnl.exe_mapped_at_0x_llX_r_n
call fcn.1800140c0
mov rax, qword [rsp + 0x48]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], rbx
lea rdx, [rsp + 0x50]
mov r9, rbp
mov qword [rdi + 0x20], rax
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.180018890
test eax, eax
jne 0x1800186c9
lea rdx, str.____Error_while_mapping_payload__abort_r_n
mov ecx, 1
call fcn.1800224a0
jmp 0x18001874f
mov rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsi], rdx
mov eax, dword [rdi + 0xc]
mov ecx, dword [rdi + 8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call fcn.180014120
mov rbx, rax
test rax, rax
je 0x180018752
mov edx, dword [rsp + 0x40]
test edx, edx
jne 0x180018730
lea rdx, str.____Unexpected_shellcode_procedure_size__abort_r_n
mov ecx, 1
call fcn.1800224a0
mov ecx, dword [rdi + 8]
xor edx, edx
call fcn.180015810
mov edx, eax
mov rcx, rbx
call fcn.180015240
jmp 0x18001874f
lea rcx, str.___Bootstrap_code_size__0x_lX_r_n
call fcn.1800140c0
mov rax, rbx
jmp 0x180018752
mov edx, eax
lea rcx, str.____Error_while_loading_ntoskrnl.exe
call fcn.180023040
mov rax, r14
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.180028780
add rsp, 0x490
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180018770
Capabilities:
Map section object

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov ecx, dword [rcx + 8]
lea rdx, [rsp + 0x70]
xor esi, esi
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x80], rsi
call fcn.180015810
mov eax, dword [rsp + 0x70]
lea r8, [rsp + 0x80]
mov dword [rsp + 0x48], 4
add rax, 0xfff
mov dword [rsp + 0x40], esi
and rax, 0xfffffffffffff000
mov dword [rsp + 0x38], 2
xor r9d, r9d
mov qword [rsp + 0x88], rax
mov rdx, 0xffffffffffffffff
lea rax, [rsp + 0x88]
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0x1000
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
js 0x180018865
mov ecx, dword [rdi + 8]
sub ecx, 1
je 0x18001882b
cmp ecx, 1
jne 0x18001882b
mov r8, qword [rsp + 0x80]
lea rdx, str.___Shellcode_result__system_worker:_0x_p_r_n
mov ecx, 2
mov r8, qword [r8 + 0x10]
call fcn.1800224a0
jmp 0x180018848
mov r8, qword [rsp + 0x80]
lea rdx, str.___Shellcode_result:_NTSTATUS__0x_lX__r_n
mov ecx, 2
mov r8d, dword [r8 + 8]
call fcn.1800224a0
mov rdx, qword [rsp + 0x80]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
mov r8d, eax
lea rdx, str.____Cannot_map_shellcode_section__NTSTATUS___lX__r_n
mov ecx, 1
call fcn.1800224a0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x18001f7f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x1801e4940]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebp, ebp
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0x48]
mov edi, r9d
mov dword [rsp + 0x50], r9d
mov rsi, r8
mov dword [rsp + 0x28], 0x10
mov r9d, 0x10
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x48]
mov dword [rsp + 0x40], ebp
mov edx, 0x22e400
mov rbx, rcx
call fcn.180020790
test eax, eax
jns 0x18001f865
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18001f8a0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
cmp dword [rsp + 0xb0], ebp
je 0x18001f89a
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x18001f8a0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180028780
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18001fb20
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x90
xor r15d, r15d
mov rax, rdx
mov qword [rbp - 1], r15
mov r14, r9
mov rsi, r8
mov rdx, rcx
test r8, r8
jne 0x18001fb58
mov eax, 0xc00000f2
jmp 0x18001fd25
mov qword [rsp + 0xb8], rdi
test rdx, rdx
je 0x18001fbbf
xor eax, eax
lea rdi, [rbp + 7]
mov ecx, 0x10
rep stosb byte [rdi], al
lea rcx, [rbp + 7]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp + 7]
mov dword [rbp + 0x17], 0x30
xorps xmm0, xmm0
mov qword [rbp + 0x27], rax
lea r8, [rbp + 0x17]
mov qword [rbp + 0x1f], r15
mov edx, 1
mov dword [rbp + 0x2f], 0x40
lea rcx, [rbp - 1]
movdqu xmmword [rbp + 0x37], xmm0
call qword [sym.imp.ntdll.dll_NtOpenDirectoryObject]
test eax, eax
js 0x18001fd1d
mov rax, qword [rbp - 1]
jmp 0x18001fbd2
test rax, rax
jne 0x18001fbce
mov eax, 0xc00000f0
jmp 0x18001fd1d
mov qword [rbp - 1], rax
lea rcx, [rbp + 0x77]
mov dword [rbp - 9], r15d
mov qword [rsp + 0x30], rcx
mov r9b, 1
lea rcx, [rbp - 9]
mov dword [rbp + 0x77], r15d
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov rcx, rax
mov byte [rsp + 0x20], r15b
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryDirectoryObject]
mov edi, eax
cmp eax, 0xc0000023
jne 0x18001fd0c
mov qword [rsp + 0xb0], rbx
nop word [rax + rax]
mov rcx, qword gs:[0x30]
mov edx, 8
mov r8d, dword [rbp + 0x77]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x18001fd04
mov r8d, dword [rbp + 0x77]
lea rax, [rbp + 0x77]
mov rcx, qword [rbp - 1]
mov r9b, 1
mov qword [rsp + 0x30], rax
mov rdx, rbx
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], r15b
call qword [sym.imp.ntdll.dll_NtQueryDirectoryObject]
mov edi, eax
test eax, eax
js 0x18001fce8
mov rdx, r14
mov rcx, rbx
call rsi
mov rcx, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov edi, eax
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test edi, edi
jns 0x18001fce3
mov rcx, qword [rbp - 1]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x30], rax
mov r9b, 1
lea rax, [rbp - 9]
mov dword [rbp + 0x77], r15d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov byte [rsp + 0x20], r15b
call qword [sym.imp.ntdll.dll_NtQueryDirectoryObject]
mov edi, eax
cmp eax, 0xc0000023
je 0x18001fc20
jmp 0x18001fd04
mov edi, r15d
jmp 0x18001fd04
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x18001fd1b
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
mov rdi, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xc8]
add rsp, 0x90
pop r15
pop r14
pop rbp
ret
Function at 0x18001ff00
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov dword [rsp + 0x40], 0x1000
mov rbp, r9
mov r14, r8
mov rdi, rdx
test rdx, rdx
je 0x18001ff2e
mov dword [rdx], 0
test ecx, ecx
mov eax, 0xb
mov esi, 0x4d
mov ecx, 0x1000
cmove esi, eax
call r14
mov rbx, rax
test rax, rax
je 0x18001ffbe
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rax
mov ecx, esi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edx, eax
cmp eax, 0xc0000004
jne 0x18001ff91
mov rcx, rbx
call rbp
mov ecx, dword [rsp + 0x40]
call r14
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rax
mov ecx, esi
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edx, eax
test rdi, rdi
je 0x18001ff9c
mov eax, dword [rsp + 0x40]
mov dword [rdi], eax
cmp edx, 0x80000005
jne 0x18001ffab
cmp dword [rbx], 0
jne 0x18001ffaf
jmp 0x18001ffb9
test edx, edx
js 0x18001ffb4
mov rax, rbx
jmp 0x18001ffc0
test rbx, rbx
je 0x18001ffbe
mov rcx, rbx
call rbp
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x18001ffe0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor eax, eax
mov rsi, r9
mov dword [rsp + 0x48], eax
mov rbp, r8
mov r14, rdx
mov r15d, ecx
mov ebx, 0x1000
test rdx, rdx
je 0x180020016
mov dword [rdx], eax
mov rcx, rbx
call rbp
mov rdi, rax
test rax, rax
je 0x180020092
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rdx, rax
mov ecx, r15d
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ecx, eax
cmp eax, 0xc0000004
jne 0x180020073
mov rcx, rdi
call rsi
add ebx, ebx
cmp ebx, 0x20000000
ja 0x180020092
mov ecx, ebx
call rbp
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rdx, rax
mov ecx, r15d
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ecx, eax
cmp eax, 0xc0000004
je 0x180020040
test r14, r14
je 0x18002007f
mov eax, dword [rsp + 0x48]
mov dword [r14], eax
test ecx, ecx
js 0x180020088
mov rax, rdi
jmp 0x180020094
test rdi, rdi
je 0x180020092
mov rcx, rdi
call rsi
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1800200f0
Capabilities:
Access pe header
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x20
mov r14, rcx
mov ebp, edx
mov rcx, r8
mov rsi, r9
mov r15, r8
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rsi, rsi
je 0x18002011d
mov dword [rsi], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
test rax, rax
je 0x18002015b
movzx ebx, word [rax + 0x14]
movzx edi, word [rax + 6]
add rbx, 0x18
add rbx, rax
test edi, edi
je 0x18002015b
nop
mov r8, rbp
mov rdx, r14
mov rcx, rbx
call fcn.180026d50
test eax, eax
je 0x180020176
add rbx, 0x28
add edi, 0xffffffff
jne 0x180020140
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov eax, dword [rbx + 0xc]
add rax, r15
test rsi, rsi
je 0x18002015d
mov ecx, dword [rbx + 8]
mov dword [rsi], ecx
jmp 0x18002015d
Function at 0x180020860
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1801e4940]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rcx], 0
lea rdi, [rsp + 0x28]
mov r15, rcx
mov qword [rdx], 0
mov dword [rsp + 0x20], 0
xor eax, eax
mov word [rsp + 0x24], 0x500
mov r14, rdx
mov ecx, 0x18
mov edx, 8
rep stosb byte [rdi], al
mov rax, qword gs:[0x30]
mov r8d, 0x28
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
jne 0x1800208e7
mov edi, 0xc000009a
jmp 0x180020a47
mov ecx, 1
call qword [sym.imp.ntdll.dll_RtlLengthRequiredSid]
mov ecx, 2
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlLengthRequiredSid]
add eax, 0x18
mov edx, 8
add edi, eax
mov rax, qword gs:[0x30]
mov r8d, edi
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x180020935
mov edi, 0xc000009a
jmp 0x180020a2b
mov r8d, 2
mov edx, edi
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlCreateAcl]
mov edi, eax
test eax, eax
js 0x180020a0f
mov r8b, 1
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntdll.dll_RtlInitializeSid]
xor edx, edx
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
lea r9, [rsp + 0x28]
mov edx, 2
mov r8d, 0x10000000
mov rcx, rbx
mov dword [rax], 0x12
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
mov r8b, 2
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntdll.dll_RtlInitializeSid]
xor edx, edx
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov edx, 1
lea rcx, [rsp + 0x28]
mov dword [rax], 0x20
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
lea r9, [rsp + 0x28]
mov edx, 2
mov r8d, 0x10000000
mov rcx, rbx
mov dword [rax], 0x220
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
mov edi, eax
test eax, eax
js 0x180020a0f
xor r9d, r9d
mov r8, rbx
mov dl, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
mov edi, eax
test eax, eax
jns 0x180020a4b
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor ebx, ebx
xor esi, esi
mov qword [r15], rsi
mov eax, edi
mov qword [r14], rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180028780
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret