joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140183040
Capabilities:
Get user security identifier

Disassembly:
push r12
push r14
push r15
sub rsp, 0x60
movzx eax, word [rcx]
mov r15, r9
mov word [rsp + 0x38], ax
mov r14, r8
add ax, 2
mov r12, rdx
cmp qword [rcx], 0xfffe
mov word [rsp + 0x3a], ax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x40], rax
jbe 0x140183086
mov eax, 0xc0000106
add rsp, 0x60
pop r15
pop r14
pop r12
ret
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x50], r13
call fcn.140182ba0
xor r13d, r13d
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x20], rcx
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x80], r13
lea r8d, [r13 + 1]
call qword [sym.imp.ADVAPI32.dll_LsaLookupNames2]
mov rdx, qword ds:[rsp + 0x80]
mov ebp, eax
test eax, eax
js 0x140183207
mov ecx, dword [rdx]
sub ecx, 7
cmp ecx, 1
jbe 0x140183202
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0x58], rdi
test r12, r12
je 0x140183151
mov rsi, qword [rdx + 8]
lea edx, [r13 + 4]
movzx ecx, byte [rsi + 1]
lea rdi, [rcx*4 + 8]
mov rcx, qword [0x1402bfe50]
mov r8, rdi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8, rdi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.1401e3aa0
mov rdx, qword [rsp + 0x80]
mov qword [r12], rbx
test r14, r14
je 0x1401831e1
movsxd rax, dword ds:[rdx + 0x10]
test eax, eax
js 0x1401831d1
lea rdx, [rax + rax*2]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
lea rax, [rcx + rdx*8]
movzx ecx, word [rcx + rdx*8]
test cx, cx
jne 0x14018318d
nop
call sym.SystemInformer.exe_PhReferenceEmptyString
mov rbx, rax
mov qword [r14], rax
jmp 0x1401831d9
mov rdx, qword [0x1402bfcf8]
mov rdi, rcx
mov rsi, qword [rax + 8]
add rcx, 0x12
call sym.SystemInformer.exe_PhCreateObject
mov rbx, rax
mov qword [rax], rdi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rdi], r13w
test rsi, rsi
je 0x1401831cc
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.1401e3aa0
mov qword [r14], rbx
jmp 0x1401831d9
call sym.SystemInformer.exe_PhReferenceEmptyString
mov qword [r14], rax
mov rdx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x88]
test r15, r15
je 0x140183207
mov eax, dword [rdx]
mov dword [r15], eax
jmp 0x140183207
mov ebp, 0xc0000073
mov rcx, qword [rsp + 0x30]
mov r13, qword [rsp + 0x50]
test rcx, rcx
je 0x140183224
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140183232
mov rcx, rdx
call qword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
mov eax, ebp
mov rbp, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop r12
ret
Function at 0x1401836a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rdi, rdx
test byte [0x1402bc318], 1
mov rsi, rcx
mov dword [rsp + 0x60], ebx
jne 0x1401837e5
lock bts qword [0x1402bc318], 0x1f
jae 0x1401836f9
test byte [0x1402bc318], 1
nop dword [rax + rax]
jne 0x1401837e5
xor edx, edx
lea rcx, [0x1402bc318]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401837e5
lea r8, str.sechost.dll
xorps xmm1, xmm1
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
and ecx, 0xf
je 0x14018372f
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
je 0x14018372b
mov edx, ecx
shr rdx, 1
jmp 0x140183763
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
jne 0x140183755
nop
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
je 0x140183740
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
lea rax, [rdx + rdx]
mov qword [rsp + 0x38], r8
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.140174480
mov rcx, rax
test rax, rax
je 0x1401837d2
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401837d2
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 1]
cmp eax, 0x7ffffffd
ja 0x1401837d2
cmp dword [rdx + rcx], 0x4550
jne 0x1401837d2
add rdx, 0x88
add rdx, rcx
mov eax, dword [rdx]
test eax, eax
je 0x1401837d2
cmp dword [rdx + 4], ebx
je 0x1401837d2
lea r8, [rcx + rax]
mov word [rsp + 0x20], bx
lea r9, str.LsaLookupUserAccountType
call fcn.140174840
mov rbx, rax
lea rcx, [0x1402bc318]
mov qword [0x1402c3d68], rbx
call sym.SystemInformer.exe_PhfSetEvent
mov rax, qword [0x1402c3d68]
test rax, rax
jne 0x140183806
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [str.PB__]
test eax, eax
js 0x14018381e
mov ecx, dword [rsp + 0x60]
mov dword [rdi], ecx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140185f40
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x60
xor r8d, r8d
mov qword [rsp + 0x28], 0
mov rbx, rdx
mov qword [rsp + 0x20], 0x30
mov rdx, rcx
lea r9, [rsp + 0x30]
lea rcx, [r8 - 1]
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
test eax, eax
js 0x140185fcd
mov rdx, qword ds:[rsp + 0x38]
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140185fcd
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140185fcd
mov r8, qword [rax + rdx + 0xe8]
mov rcx, r8
shr rcx, 0x20
test r8d, r8d
je 0x140185fcd
test ecx, ecx
je 0x140185fcd
mov eax, r8d
add rax, rdx
cmp rbx, rax
jb 0x140185fcd
add ecx, r8d
add rcx, rdx
cmp rbx, rcx
jae 0x140185fcd
mov al, 1
add rsp, 0x60
pop rbx
ret
xor al, al
add rsp, 0x60
pop rbx
ret

Function at 0x140186240
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [0x1402c3d80]
test rbx, rbx
je 0x1401862bd
mov qword [rsp + 0x58], rdi
xor edi, edi
nop dword [rax]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], edi
mov r9d, 0x20
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x48]
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x48], 0x10000
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov r8d, 0x10000
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtFlushInstructionCache]
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x140186260
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbx
ret

Function at 0x1401862e0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x60
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x140186302
sub rbx, rax
add rbx, 0x10000
mov qword [rsp + 0x80], rsi
cmp rbx, rdi
jae 0x1401863fe
xor esi, esi
nop word [rax + rax]
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x14018633b
add rbx, 0x8000000
jmp 0x1401863f5
xorps xmm0, xmm0
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0x30]
mov rdx, rbx
movups xmmword [rsp + 0x30], xmm0
lea rcx, [r8 - 1]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
test eax, eax
js 0x1401863fe
cmp dword [rsp + 0x50], 0x10000
mov rcx, qword [rsp + 0x48]
jne 0x1401863da
cmp rcx, 0x10000
jb 0x1401863da
xor r8d, r8d
mov dword [rsp + 0x28], 0x40
lea r9, [rsp + 0x78]
mov qword [rsp + 0x78], 0x10000
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x20], 0x3000
lea rcx, [r8 - 1]
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jns 0x140186416
cmp eax, 0xc0000604
je 0x1401863fe
add rbx, 0x10000
jmp 0x1401863f5
mov rbx, qword [rsp + 0x30]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x1401863f5
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x140186320
xor eax, eax
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
mov rax, qword [rsp + 0x70]
jmp 0x140186400
Function at 0x140186420
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x14018653f
xor esi, esi
nop dword [rax]
nop dword [rax + rax]
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x14018647b
sub rbx, 0x8000000
jmp 0x140186536
xorps xmm0, xmm0
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0x30]
mov rdx, rbx
movups xmmword [rsp + 0x30], xmm0
lea rcx, [r8 - 1]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.ntdll.dll_NtQueryVirtualMemory]
test eax, eax
js 0x14018653f
cmp dword [rsp + 0x50], 0x10000
jne 0x14018651a
cmp qword [rsp + 0x48], 0x10000
jb 0x14018651a
xor r8d, r8d
mov dword [rsp + 0x28], 0x40
lea r9, [rsp + 0x78]
mov qword [rsp + 0x78], 0x10000
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x20], 0x3000
lea rcx, [r8 - 1]
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jns 0x140186553
cmp eax, 0xc0000604
je 0x14018653f
sub rbx, 0x10000
jmp 0x140186536
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x140186460
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rax, qword [rsp + 0x70]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14018d4e0
Capabilities:
Get file attributes

Disassembly:
push rsi
sub rsp, 0x80
mov rax, qword [0x1402b5020]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rdx
mov dword [rsp + 0x30], 0x60
mov rdx, rcx
mov dword [rsp + 0x28], 1
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x20], 5
mov r9d, 0x80
mov r8d, 0x120089
call sym.SystemInformer.exe_PhCreateFile
test eax, eax
jns 0x14018d538
lfence
jmp 0x14018d5dc
mov qword [rsp + 0xa8], rdi
lea r8, [rsp + 0x60]
mov rdi, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov rcx, rdi
mov dword [rsp + 0x20], 5
mov r9d, 0x18
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
js 0x14018d58d
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsp + 0x48], xmm0
cmp qword [rsp + 0x50], 0
jne 0x14018d58d
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, 0xc0000011
jmp 0x14018d5d4
mov rdx, rdi
mov qword [rsp + 0xa0], rbx
call fcn.1401d3bb0
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtClose]
test rbx, rbx
je 0x14018d5c7
cmp dword [rbx], 0
jne 0x14018d5bf
test rsi, rsi
je 0x14018d5bb
mov qword [rsi], rbx
xor eax, eax
jmp 0x14018d5cc
mov rcx, rbx
call fcn.1401d3600
mov eax, 0xc0000102
mov rbx, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401dd6a0
add rsp, 0x80
pop rsi
ret
Function at 0x14018eb60
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x28
mov r9, rcx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], r8
cmp r8, 0x40
jae 0x14018eb7f
mov eax, 0xc000001f
add rsp, 0x28
ret
lea rax, [rdx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14018ec92
lea rcx, [rdx + 0x40]
cmp rcx, rdx
jb 0x14018ec84
lea rax, ds:[rdx + r8]
cmp rcx, rax
ja 0x14018ec84
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x14018ebbd
mov eax, 0xc000012f
add rsp, 0x28
ret
lfence
movsxd rax, dword [rdx + 0x3c]
cmp rax, r8
jae 0x14018ec7a
cmp rax, 0x10000000
jae 0x14018ec7a
add rdx, rax
mov rcx, qword [r9 + 0x10]
mov rax, qword [r9 + 8]
lea r10, [rdx + 0x18]
cmp r10, rdx
jb 0x14018ec6c
cmp rdx, rax
jb 0x14018ec6c
lea r8, [rax + rcx]
cmp r10, r8
ja 0x14018ec6c
movzx eax, word [rdx + 6]
lea rcx, [rax + rax*4]
movzx eax, word [rdx + 0x14]
lea rax, [rax + rcx*8]
add rax, 0x18
add rax, rdx
cmp rax, rdx
jb 0x14018ec61
cmp rax, r8
ja 0x14018ec61
cmp dword [rdx], 0x4550
jne 0x14018ec7a
movzx eax, word [r10]
mov word [r9 + 0x30], ax
mov ecx, 0x10b
sub ax, cx
mov ecx, 0xfeff
test cx, ax
jne 0x14018ec7a
mov qword [r9 + 0x18], rdx
movzx eax, word [rdx + 6]
mov dword [r9 + 0x20], eax
movzx ecx, word [rdx + 0x14]
add rcx, 0x18
add rcx, rdx
mov qword [r9 + 0x28], rcx
xor eax, eax
add rsp, 0x28
ret
mov ecx, 0xc0000005
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
mov ecx, 0xc0000005
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
nop
jmp 0x14018ec97
mov eax, 0xc000007b
add rsp, 0x28
ret
mov ecx, 0xc0000005
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
nop
jmp 0x14018ec97
mov eax, 0xc000000d
add rsp, 0x28
ret
Function at 0x14018eca0
Capabilities:
Get file attributes
Map section object

Disassembly:
push rsi
push rdi
push r12
push r15
sub rsp, 0xc8
mov rax, qword [0x1402b5020]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor r15b, r15b
mov qword [rsp + 0x70], rdx
xor r12d, r12d
mov rsi, r8
mov rdi, rdx
test rdx, rdx
jne 0x14018ed35
test rcx, rcx
jne 0x14018ece5
mov eax, 0xc0000030
jmp 0x14018eea4
mov qword ss:[rsp + 0x40], r12
mov rdx, rcx
mov dword [rsp + 0x38], 0x60
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x30], 1
xor r9d, r9d
mov dword [rsp + 0x28], 1
mov r8d, 0x100081
mov dword [rsp + 0x20], 0x80
call sym.SystemInformer.exe_PhCreateFileWin32Ex
test eax, eax
js 0x14018eea4
mov rdi, qword [rsp + 0x70]
mov r15b, 1
mov qword [rsp + 0xc0], rbx
lea r8, [rsp + 0x88]
mov qword [rsp + 0xb8], rbp
lea rdx, [rsp + 0x70]
mov r9d, 0x18
mov qword [rsp + 0xb0], r14
mov rcx, rdi
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x14018ee36
movups xmm0, xmmword [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
lea r9, [rsp + 0x58]
movups xmmword [rsp + 0x70], xmm0
mov rax, qword [rsp + 0x78]
lea rcx, [rsp + 0x60]
lea edx, [r8 + 5]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 2
call qword [sym.imp.ntdll.dll_NtCreateSection]
mov ebx, eax
test eax, eax
js 0x14018ee36
mov rax, qword [rsp + 0x58]
lea r8, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x50], rax
lea rdx, [r9 - 1]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov rcx, qword ds:[rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x14018ee36
mov rbp, qword [rsp + 0x68]
mov r14, qword [rsp + 0x58]
jmp 0x14018ee40
mov rbp, qword [rsp + 0x50]
mov r14, qword [rsp + 0x50]
test r15b, r15b
je 0x14018ee4e
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x14018ee8a
mov r8, r14
mov rdx, rbp
mov rcx, rsi
call fcn.14018eb60
mov ebx, eax
test eax, eax
jns 0x14018ee8c
cmp qword [rsi + 8], r12
je 0x14018ee8c
lfence
mov rdx, qword [rsi + 8]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov qword [rsi + 8], r12
mov eax, ebx
mov rbp, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401dd6a0
add rsp, 0xc8
pop r15
pop r12
pop rdi
pop rsi
ret
Function at 0x14018eee0
Capabilities:
Get file attributes
Map section object

Disassembly:
push rdi
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x1402b5020]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor r15b, r15b
mov qword [rsp + 0x70], rdx
mov rdi, r8
mov r14, rdx
test rdx, rdx
jne 0x14018ef66
test rcx, rcx
jne 0x14018ef25
mov eax, 0xc0000030
jmp 0x14018f124
mov dword [rsp + 0x30], 0x60
mov rdx, rcx
mov dword [rsp + 0x28], 1
lea rcx, [rsp + 0x70]
mov r9d, 0x80
mov dword [rsp + 0x20], 1
mov r8d, 0x100081
call sym.SystemInformer.exe_PhCreateFile
test eax, eax
js 0x14018f124
mov r14, qword [rsp + 0x70]
mov r15b, 1
mov qword [rsp + 0xc8], rbx
lea r8, [rsp + 0x88]
mov qword [rsp + 0xc0], rbp
lea rdx, [rsp + 0x70]
mov qword [rsp + 0xb8], rsi
mov r9d, 0x18
mov rcx, r14
mov qword [rsp + 0xb0], r12
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
xor r12d, r12d
mov esi, eax
test eax, eax
js 0x14018f076
movups xmm0, xmmword [rsp + 0x88]
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x58]
mov dword [rsp + 0x28], 0x8000000
lea edx, [r12 + 5]
movups xmmword [rsp + 0x70], xmm0
mov rax, qword [rsp + 0x78]
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 2
call qword [sym.imp.ntdll.dll_NtCreateSection]
mov esi, eax
test eax, eax
js 0x14018f076
mov rax, qword [rsp + 0x58]
lea r8, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
lea rdx, [r12 - 1]
mov dword [rsp + 0x48], 2
xor r9d, r9d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x68], r12
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov rcx, qword ds:[rsp + 0x60]
mov esi, eax
call qword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x14018f076
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
jmp 0x14018f080
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x50]
test r15b, r15b
je 0x14018f08e
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x14018f102
movzx eax, word [rbx]
mov ecx, 0x457f
mov word [rdi], ax
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbp
cmp ax, cx
je 0x14018f0cb
mov ecx, 0x5a4d
cmp ax, cx
je 0x14018f0bb
mov ebx, 0xc00001a3
jmp 0x14018f0df
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.14018eb60
jmp 0x14018f0d9
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.1401d76e0
mov ebx, eax
test eax, eax
jns 0x14018f0fe
nop
cmp qword [rdi + 8], r12
je 0x14018f0fe
lfence
mov rdx, qword [rdi + 8]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov qword [rdi + 8], r12
mov eax, ebx
jmp 0x14018f104
mov eax, esi
mov rsi, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401dd6a0
add rsp, 0xd0
pop r15
pop r14
pop rdi
ret
Function at 0x14018f160
Capabilities:
Map section object

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
sub rsp, 0x60
xor sil, sil
mov rbp, r8
mov rbx, rdx
test rdx, rdx
jne 0x14018f1df
test rcx, rcx
jne 0x14018f18c
mov eax, 0xc0000030
add rsp, 0x60
pop rsi
pop rbp
pop rbx
ret
mov dword ss:[rsp + 0x30], 0x60
mov rdx, rcx
mov dword [rsp + 0x28], 1
lea rcx, [rsp + 0x88]
mov r9d, 0x80
mov dword [rsp + 0x20], 1
mov r8d, 0x100081
call sym.SystemInformer.exe_PhCreateFile
test eax, eax
jns 0x14018f1d4
lfence
add rsp, 0x60
pop rsi
pop rbp
pop rbx
ret
mov rbx, qword [rsp + 0x88]
mov sil, 1
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000000
lea r9, [rsp + 0x58]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x58], 0x1000
lea edx, [r8 + 5]
mov dword [rsp + 0x20], 2
call qword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
test sil, sil
je 0x14018f22f
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
test edi, edi
jns 0x14018f248
lfence
mov eax, edi
mov rdi, qword [rsp + 0x90]
add rsp, 0x60
pop rsi
pop rbp
pop rbx
ret
xor ecx, ecx
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ecx
lea rax, [rsp + 0x98]
mov dword [rsp + 0x38], 2
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea rdx, [rcx - 1]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x98], 0x1000
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov rcx, qword [rsp + 0x80]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x14018f2cf
lfence
mov rdi, qword [rsp + 0x90]
mov eax, ebx
add rsp, 0x60
pop rsi
pop rbp
pop rbx
ret
mov r8, qword ds:[rsp + 0x98]
mov rcx, rbp
mov rdx, qword [rsp + 0x50]
call fcn.14018eb60
mov rdi, qword [rsp + 0x90]
add rsp, 0x60
pop rsi
pop rbp
pop rbx
ret
Function at 0x14018f5e0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, qword [rsp + 0x70]
mov r15, r9
mov rbp, r8
mov rbx, rdx
mov r14, rcx
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], r8
cmp r8, 0x1000
jae 0x14018f61f
mov eax, 0xc0000017
jmp 0x14018f793
lea rax, [rdx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14018f7a7
mov rcx, qword [0x1402bfe50]
mov edx, 4
mov r8d, 0x1000
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov r8d, 0x1000
mov rcx, rax
mov rsi, rax
call fcn.1401dff50
mov r9d, 0x1000
mov qword [rsp + 0x20], 0
mov r8, rsi
mov rdx, rbx
mov rcx, r14
mov rax, r15
call qword [str.PB__]
mov ebx, eax
lfence
test eax, eax
js 0x14018f78e
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14018f772
movsxd rcx, dword ds:[rsi + 0x3c]
test rcx, rcx
je 0x14018f772
cmp rcx, rbp
jae 0x14018f772
cmp rcx, 0x10000000
jae 0x14018f772
lea rax, [rcx + 0x108]
cmp rax, 0x1000
jb 0x14018f6d8
mov ebx, 0xc0000017
jmp 0x14018f777
cmp dword [rcx + rsi], 0x4550
lea r8, [rcx + rsi]
je 0x14018f6ef
mov ebx, 0xc000007b
jmp 0x14018f777
movzx eax, word [r8 + 0x14]
mov edx, 0xe0
sub ax, dx
mov edx, 0xffef
test dx, ax
je 0x14018f70d
mov ebx, 0xc0000903
jmp 0x14018f777
movzx eax, word [r8 + 0x18]
mov edx, 0x10b
mov word [rdi + 0x30], ax
sub ax, dx
mov edx, 0xfeff
test dx, ax
jne 0x14018f6e5
movzx eax, word [r8 + 6]
mov dword [rdi + 0x20], eax
cmp eax, 0x7f
jae 0x14018f6e5
lea rdx, [rax + rax*4]
movzx eax, word [r8 + 0x14]
add rcx, rax
lea rax, [rdx + 0x24]
lea rax, [rcx + rax*8]
cmp rax, 0x1000
jae 0x14018f6ce
mov qword [rdi], r14
mov qword [rdi + 0x18], r8
movzx ecx, word [r8 + 0x14]
add rcx, 0x18
mov qword [rdi + 0x38], rsi
add rcx, r8
mov qword [rdi + 0x28], rcx
jmp 0x14018f78c
mov ebx, 0xc000012f
lfence
mov rcx, qword [0x1402bfe50]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov eax, 0xc000000d
jmp 0x14018f793
Function at 0x14018f7c0
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x1a0
mov rax, qword [0x1402b5020]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rdi, qword [rsp + 0x1f0]
mov r14, r9
mov qword [rsp + 0x20], rdi
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
call fcn.14018f5e0
nop
cmp eax, 0xc0000017
jne 0x14018fa0e
mov qword [rsp + 0x198], r12
mov qword [rsp + 0x190], r15
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rsi
cmp rsi, 0x40
jb 0x14018f9f9
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14018f9f2
lfence
xor r12d, r12d
lea r8, [rsp + 0x30]
mov rdx, rbx
mov qword [rsp + 0x20], r12
mov rcx, rbp
mov rax, r14
lea r9d, [r12 + 0x40]
call qword [str.PB__]
nop
test eax, eax
js 0x14018f8ca
mov eax, 0x5a4d
cmp word [rsp + 0x30], ax
je 0x14018f87a
mov eax, 0xc000012f
jmp 0x14018f9fe
movsxd rax, dword ds:[rsp + 0x6c]
test rax, rax
je 0x14018f9f9
cmp rax, rsi
jae 0x14018f9f9
cmp rax, 0x10000000
jae 0x14018f9f9
lfence
lea r15, [rbx + rax]
mov qword [rsp + 0x20], r12
mov rdx, r15
lea r8, [rsp + 0x70]
mov r9d, 0x108
mov rcx, rbp
mov rax, r14
call qword [str.PB__]
test eax, eax
jns 0x14018f8d2
lfence
jmp 0x14018f9fe
cmp dword ds:[rsp + 0x70], 0x4550
jne 0x14018f9f9
movzx edx, word ds:[rsp + 0x84]
mov ecx, 0xe0
movzx eax, dx
sub ax, cx
mov ecx, 0xffef
test cx, ax
je 0x14018f90f
mov eax, 0xc0000903
jmp 0x14018f9fe
movzx eax, word [rsp + 0x88]
mov ecx, 0x10b
mov word [rdi + 0x30], ax
sub ax, cx
mov ecx, 0xfeff
test cx, ax
jne 0x14018f9f9
movzx ecx, word ds:[rsp + 0x76]
mov dword [rdi + 0x20], ecx
cmp ecx, 0x7f
jae 0x14018f9f9
lea eax, ds:[rdx + 0x18]
lea rcx, [rcx + rcx*4]
lea rsi, [rax + rcx*8]
cmp rsi, 0x100000
ja 0x14018f9f9
lfence
mov rcx, qword [0x1402bfe50]
mov r8, rsi
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.1401dff50
mov r9, rsi
mov qword [rdi + 0x18], rbx
mov r8, rbx
mov qword [rsp + 0x20], r12
mov rdx, r15
mov rcx, rbp
mov rax, r14
call qword [str.PB__]
mov ebx, eax
lfence
test eax, eax
jns 0x14018f9d8
mov r8, qword [rdi + 0x18]
xor edx, edx
mov rcx, qword [0x1402bfe50]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov qword [rdi + 0x18], r12
jmp 0x14018f9fe
mov rcx, qword [rdi + 0x18]
mov qword [rdi], rbp
movzx eax, word [rcx + 0x14]
add rcx, 0x18
add rcx, rax
mov qword [rdi + 0x28], rcx
xor eax, eax
jmp 0x14018f9fe
mov eax, 0xc000000d
jmp 0x14018f9fe
mov eax, 0xc000007b
mov r12, qword [rsp + 0x198]
mov r15, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1401dd6a0
add rsp, 0x1a0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret