joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14014f3c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1402be168]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14014f44e
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14014f44e
call fcn.14014dc20
mov ebx, eax
jmp 0x14014f573
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14014f46f
call fcn.14014dc20
jmp 0x14014f562
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14014f492
call fcn.14014dc20
jmp 0x14014f562
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14014f4b4
mov ebx, 0x8007000e
jmp 0x14014f564
mov ecx, eax
test eax, eax
je 0x14014f4e9
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14014f5ab
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14014f4e9
lea rcx, [rsp + 0x70]
call fcn.14014db00
jmp 0x14014f4f3
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x14014f506
cmp qword [rsp + 0x70], 0
jne 0x14014f515
mov ebx, 0x8007000e
jmp 0x14014f564
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14014f53f
call fcn.14014dc20
jmp 0x14014f562
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14014eee0
mov ebx, eax
test rdi, rdi
je 0x14014f573
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14014f58a
lea rcx, [rsp + 0x70]
call fcn.14014e070
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1401837c0
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.14014dc50
int3
Function at 0x140187210
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
lea r14, [rcx + 0x370]
mov r15, rdx
cmp qword [r14 + 0x18], 8
mov rsi, rcx
jb 0x140187247
mov r14, qword [r14]
mov edi, dword [rcx + 0x390]
mov ebx, dword [rcx + 0x38]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movups xmm0, xmmword [rsi + 0x28]
mov dword [rbp - 0x5c], eax
lea r9, [rsp + 0x40]
lea rax, [rsi + 0x5c]
mov dword [rbp - 0x58], ebx
xor ebx, ebx
mov qword [rbp - 0x50], rax
lea rax, [rsi + 0x60]
mov qword [rsp + 0x30], rbx
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x60]
lea rax, [rsi + 0x68]
mov dword [rbp - 0x60], 1
mov qword [rbp - 0x40], rax
lea r8d, [rbx + 0x60]
xor eax, eax
mov qword [rbp - 0x28], rbx
mov qword [rsp + 0x68], rax
mov rcx, r15
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0x80]
movups xmmword [rbp - 0x38], xmm0
mov qword [rsp + 0x28], rax
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x60
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r14
mov dword [rbp - 8], edi
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebx
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rbx
movdqa xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rbx
mov dword [rbp - 0x68], ebx
mov dword [rbp + 0x80], ebx
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x1401873a8
cmp dword [rsp + 0x40], 2
jne 0x1401873a8
cmp dword [rsp + 0x44], ebx
je 0x1401873a8
cmp qword [rsp + 0x78], rbx
je 0x1401873a8
cmp qword [rbp - 0x80], rbx
je 0x1401873a8
cmp qword [rbp - 0x78], rbx
je 0x1401873a8
xor eax, eax
mov qword [rbp + 4], rbx
xorps xmm0, xmm0
mov qword [rbp + 0x20], rax
lea r9, [rbp + 0x80]
movdqa xmmword [rbp + 0x10], xmm0
lea r8d, [rbx + 0x60]
mov qword [rbp + 0x28], rax
lea rdx, [rbp]
mov qword [rbp + 0x30], rax
mov rcx, r15
movdqa xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x50], rbx
mov dword [rbp + 0x58], ebx
mov dword [rbp], 3
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1401873a8
mov rax, qword [rsp + 0x78]
mov qword [rsi + 0x40], rax
mov rax, qword [rbp - 0x80]
mov qword [rsi + 0x48], rax
mov rax, qword [rbp - 0x78]
mov qword [rsi + 0x50], rax
mov eax, dword [rsp + 0x44]
mov dword [rsi + 0x58], eax
mov al, 1
jmp 0x1401873aa
xor al, al
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1401d2134
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1401d1dfc
Function at 0x1401dcac8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1401dc6f0
call fcn.140196190
mov dword [rax], 0x16
call fcn.140195fdc
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1401dc6d8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1401dc6d8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1401dc722
lock or dword [rax + 0x14], 0x10
jmp 0x1401dc6d8
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1401dc73f
mov rcx, qword [rbp + 0x10]
call fcn.1401deb2c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1401d9124
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1401da114
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1401dc796
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1401dc6d8
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1401dc802
mov rcx, qword [rbp + 0x10]
call fcn.1401d9124
cmp eax, 0xffffffff
je 0x1401dc7e9
mov rcx, qword [rbp + 0x10]
call fcn.1401d9124
cmp eax, 0xfffffffe
je 0x1401dc7e9
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1401d9124
movsxd rdi, eax
lea rsi, [0x1402c2840]
mov rcx, rbx
sar rdi, 6
call fcn.1401d9124
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1401dc7f0
lea rax, [0x1402be510]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401dc802
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1401dc838
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1401dc834
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1401dc834
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1401dc6db
jmp 0x1401dc6a8
Function at 0x14000144c
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, r8
mov rbx, rdx
test r8, r8
je 0x140001559
cmp r9, 0x38
jb 0x140001559
mov rcx, qword [r8]
lea rdx, [rax + 8]
mov rbp, qword [r8 + 8]
mov r14, qword [r8 + 0x10]
and qword [rax + 8], 0
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1400014a5
mov dword [rbx], 3
jmp 0x14000155f
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x1400014bd
mov dword [rbx], 0x65
jmp 0x14000155f
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
test rax, rax
jne 0x1400014db
mov dword [rbx], 0xc
jmp 0x14000155f
mov r8, r14
mov rdx, rbp
mov rcx, rdi
call fcn.140006980
mov rbp, qword [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_PsGetProcessExitStatus]
cmp eax, 0x103
je 0x140001505
mov esi, 0xc000010a
jmp 0x14000152a
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x140001519
mov esi, 0xc0000141
jmp 0x14000152a
lea r8, [rsi + 0x20]
mov rdx, rdi
mov rcx, rbp
call fcn.140001d74
mov esi, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000153a
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbx
test esi, esi
jns 0x140001554
mov dword [rbx], 0x81
jmp 0x140001562
and dword [rbx], 0
jmp 0x140001562
mov dword [rdx], 0x16
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140001900
Capabilities:
Delete file

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
and qword [rbp + 0x18], 0
lea r9, [rbp - 0x40]
and dword [rbp - 0x2c], 0
lea r8, [rbp - 0x30]
and dword [rbp - 0x14], 0
xorps xmm0, xmm0
and qword [rbp - 0x28], 0
mov edx, 0x80000000
mov qword [rbp - 0x20], rcx
lea rcx, [rbp + 0x18]
mov dword [rsp + 0x28], 0x40
and dword [rsp + 0x20], 0
movups xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x30
movdqu xmmword [rbp - 0x10], xmm0
mov dword [rbp - 0x18], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
jns 0x14000196b
mov eax, 0xc300c307
jmp 0x1400019f5
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
lea rax, [rbp + 0x10]
and qword [rbp + 0x10], 0
xor r9d, r9d
and qword [rsp + 0x28], 0
xor edx, edx
mov rcx, qword [rbp + 0x18]
mov r8, qword [r8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jns 0x1400019a8
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x140001961
mov rax, qword [rbp + 0x10]
xor edx, edx
mov byte [rax + 0x49], 0
mov rax, qword [rbp + 0x10]
mov byte [rax + 0x4c], 1
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 0x28]
and qword [rcx + 0x10], 0
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 0x28]
and qword [rcx], 0
mov rcx, qword [rbp + 0x10]
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rcx, [rbp - 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
add rsp, 0x70
pop rbp
ret
Function at 0x140001a94
Capabilities:
Encode data using xor
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 0x10], rax
and qword [rbp - 0x60], 0
mov rax, rdx
mov rdi, rcx
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x140001bfc
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
movups xmm1, xmmword [str._B_CGlQH_YF]
movzx eax, word [0x140007380]
lea r9, [rbp - 0x48]
xorps xmm0, xmm0
mov word [rbp - 0x18], ax
movups xmmword [rbp - 0x48], xmm1
xor r8d, r8d
movups xmm1, xmmword [0x140007370]
movups xmmword [rbp - 0x58], xmm0
movups xmm0, xmmword [0x140007360]
movups xmmword [rbp - 0x28], xmm1
movups xmmword [rbp - 0x38], xmm0
mov eax, 0x29e4129f
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movzx eax, ax
imul ecx, eax, 0x37
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x30
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0x19
jl 0x140001b1b
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [0x140008310]
call qword [sym.imp.ntoskrnl.exe_KeAcquireGuardedMutex]
mov rbx, qword [0x140008348]
lea rcx, [0x140008348]
cmp rbx, rcx
je 0x140001b91
mov rax, qword [rbp - 0x60]
cmp qword [rbx + 0x10], rax
je 0x140001bdb
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x140001b83
lea rcx, [0x140008310]
call qword [sym.imp.ntoskrnl.exe_KeReleaseGuardedMutex]
mov rcx, qword [rbp - 0x60]
call fcn.1400019fc
mov rbx, rax
test rax, rax
jne 0x140001bb6
mov eax, 0xc600c601
jmp 0x140001bfc
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessExitStatus]
cmp eax, 0x103
je 0x140001bce
mov eax, 0xc400c402
jmp 0x140001bfc
lea rcx, [0x140008310]
call qword [sym.imp.ntoskrnl.exe_KeAcquireGuardedMutex]
mov qword [rbx + 0x30], rdi
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov byte [rbx + 0x43], 1
lea rcx, [0x140008310]
mov qword [rbx + 0x18], rax
call qword [sym.imp.ntoskrnl.exe_KeReleaseGuardedMutex]
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140006890
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140002b54
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, 0xfffffffffffff000
mov edi, edx
add rdi, rcx
mov rbx, rcx
and rdi, rax
and rbx, rax
jmp 0x140002bc2
mov rcx, rbx
call fcn.140004788
mov rcx, rax
mov rsi, rax
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x140002bbb
mov rcx, qword [rsi]
test cl, 1
je 0x140002bbb
movabs rax, 0x7ffffffffffffffd
and rcx, rax
or rcx, 2
mov qword [rsi], rcx
lea rcx, [0x140006e10]
call qword [sym.imp.ntoskrnl.exe_DbgPrint]
add rbx, 0x1000
cmp rbx, rdi
jbe 0x140002b7a
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004198
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 8], rax
mov eax, dword [0x1400073e4]
lea r9, [rbp - 0x20]
and qword [rbp - 0x28], 0
and qword [rbp - 0x30], 0
mov dword [rbp - 0x20], eax
xor r8d, r8d
movzx eax, word [0x1400073e8]
mov word [rbp - 0x1c], ax
mov eax, 0xa0a0a0a1
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x33
mov al, r8b
inc r8d
sub al, cl
add al, 0x30
xor byte [r9], al
inc r9
cmp r8d, 6
jl 0x1400041d4
mov eax, dword [0x1400073f8]
lea r9, [rbp - 0x18]
movsd xmm0, qword [str.E___GX_]
xor r8d, r8d
mov dword [rbp - 0x10], eax
mov al, byte [0x1400073fc]
mov byte [rbp - 0xc], al
movsd qword [rbp - 0x18], xmm0
mov eax, 0xa0a0a0a1
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x33
mov al, r8b
inc r8d
sub al, cl
add al, 0x30
xor byte [r9], al
inc r9
cmp r8d, 0xd
jl 0x140004221
lea r9, [rbp - 0x28]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x18]
call fcn.14000450c
test al, al
je 0x1400042da
movups xmm0, xmmword [str.HIJ_f_v_n_tO_A]
movdqu xmmword [rbp - 0x18], xmm0
psrldq xmm0, 0xf
movd eax, xmm0
test al, al
je 0x1400042a8
xor r8d, r8d
lea r9, [rbp - 0x18]
mov eax, 0xa0a0a0a1
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x33
mov al, r8b
inc r8d
sub al, cl
add al, 0x30
xor byte [r9], al
inc r9
cmp r8d, 0x10
jl 0x140004281
mov rdx, qword [rbp - 0x30]
lea r9, [rbp - 0x18]
mov rcx, qword [rbp - 0x28]
lea r8, [0x140006e30]
call fcn.1400042f0
test rax, rax
je 0x1400042da
mov ecx, dword [rax + 0xa]
lea rdx, [rax + 0xe]
add rdx, rcx
mov al, 1
mov qword [0x1400084c0], rdx
jmp 0x1400042dc
xor al, al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140006890
add rsp, 0x50
pop rbp
ret
Function at 0x140004398
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov r12, r8
mov rsi, rcx
test r8, r8
je 0x1400044ef
mov qword [rdx], rbx
lea r14d, [rbx + 0xb]
mov ecx, r14d
mov dword [rbp + 0x50], ebx
lea r9, [rbp + 0x50]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp dword [rbp + 0x50], ebx
je 0x1400044ef
mov edx, dword [rbp + 0x50]
mov ecx, 0x200
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
test rax, rax
je 0x1400044ef
mov r8d, dword [rbp + 0x50]
lea r9, [rbp + 0x50]
mov rdx, rax
mov ecx, r14d
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
js 0x1400044e0
mov rdx, rsi
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov esi, ebx
cmp dword [rdi], ebx
jbe 0x1400044e0
mov eax, esi
lea rdx, [rdi + 0x30]
imul r13, rax, 0x128
lea rcx, [rbp - 0x20]
mov qword [rbp + 0x58], rax
add rdx, r13
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
movzx eax, word [rbp - 0x10]
movzx r14d, word [rbp - 0x20]
cmp r14w, ax
jb 0x1400044b8
movaps xmm0, xmmword [rbp - 0x20]
sub r14w, ax
movdqa xmmword [rbp - 0x30], xmm0
movzx r15d, bx
mov word [rbp - 0x30], ax
mov r8d, 1
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlEqualString]
test al, al
jne 0x1400044af
mov eax, 1
add qword [rbp - 0x28], rax
add r15w, ax
mov eax, 0xffff
add word [rbp - 0x2e], ax
cmp r15w, r14w
jbe 0x140004479
jmp 0x1400044b8
mov eax, dword [rdi + r13 + 0x20]
test eax, eax
jne 0x1400044c3
inc esi
cmp esi, dword [rdi]
jae 0x1400044e0
jmp 0x140004437
mov rcx, rax
mov bl, 1
mov rax, qword [rbp + 0x48]
mov qword [rax], rcx
imul rcx, qword [rbp + 0x58], 0x128
mov rdx, qword [rcx + rdi + 0x18]
mov qword [r12], rdx
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, bl
jmp 0x1400044f1
xor al, al
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000450c
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x17], rax
movups xmm1, xmmword [0x140007440]
and qword [rbp - 0x41], 0
mov r14, r9
and qword [rbp - 0x49], 0
xorps xmm0, xmm0
and qword [r8], 0
lea r9, [rbp - 0x11]
movzx eax, word [0x140007460]
mov r15, r8
movups xmmword [rbp - 0x31], xmm0
mov rsi, rdx
mov rdi, rcx
movups xmm0, xmmword [0x140007450]
mov word [rbp + 0xf], ax
xor r8d, r8d
movups xmmword [rbp - 0x11], xmm1
movups xmmword [rbp - 1], xmm0
mov eax, 0xa0a0a0a1
mul r8d
shr edx, 5
movzx eax, dx
imul ecx, eax, 0x33
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x30
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0x11
jl 0x14000457a
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x31]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x31]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov rbx, rax
test rax, rax
je 0x14000464d
lea r8, [rbp - 0x49]
mov rcx, rdi
lea rdx, [rbp - 0x41]
call fcn.140004398
test al, al
je 0x14000464d
test r14, r14
je 0x14000464d
mov rcx, qword [rbp - 0x49]
call rbx
test rax, rax
je 0x14000464d
movzx edi, word [rax + 0x14]
lea rcx, [rbp - 0x21]
movzx ebx, word [rax + 6]
add rdi, 0x18
mov rdx, rsi
add rdi, rax
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
xor esi, esi
test ebx, ebx
je 0x14000464d
lea r13d, [rsi + 8]
mov rdx, rdi
lea rcx, [rbp - 0x41]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
cmp word [rbp - 0x41], r13w
jbe 0x14000462e
mov word [rbp - 0x41], r13w
xor r8d, r8d
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x41]
call qword [sym.imp.ntoskrnl.exe_RtlCompareString]
test eax, eax
je 0x14000466d
add rdi, 0x28
inc esi
cmp esi, ebx
jl 0x140004615
xor al, al
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140006890
add rsp, 0x90
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, dword [rdi + 8]
mov al, 1
mov qword [r15], rcx
mov ecx, dword [rdi + 0xc]
add rcx, qword [rbp - 0x49]
mov qword [r14], rcx
jmp 0x14000464f
Function at 0x140004684
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rax, qword [0x14000afe0]
xor ebx, ebx
test rax, rax
jne 0x14000476c
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x114
call fcn.140006c40
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
js 0x14000475b
cmp dword [rsp + 0x6c], 0x3839
jb 0x14000475b
movups xmm1, xmmword [str.uV_c_ELL_WzRLo_81_GbEzYTQRvMr_Y_M_]
lea r8, [rsp + 0x30]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [0x140007430]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [0x140007420]
movups xmmword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x40], xmm0
mov eax, 0xa0a0a0a1
mul ebx
shr edx, 5
movzx eax, dx
imul ecx, eax, 0x33
movzx eax, bx
inc ebx
sub ax, cx
add ax, 0x30
xor word [r8], ax
lea r8, [r8 + 2]
cmp ebx, 0x18
jl 0x140004711
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov rax, qword [rax + 0x22]
jmp 0x140004765
movabs rax, 0xfffff68000000000
mov qword [0x14000afe0], rax
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140006890
add rsp, 0x190
pop rbx
ret
Function at 0x14000484c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x160
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
cmp dword [rsp + 0x34], 0xa
jb 0x1400048ff
cmp dword [rsp + 0x3c], 0x37ec
jb 0x1400048ff
call fcn.1400056e8
test rax, rax
jne 0x1400048b4
and qword [0x140008ce8], rax
xorps xmm0, xmm0
and qword [0x140008d00], rax
jmp 0x140004929
mov r8, qword [rax + 0x360]
mov rdx, r8
mov qword [0x140008d00], r8
shr rdx, 0x27
and edx, 0x1ff
mov ecx, edx
mov eax, edx
shl rcx, 0x1e
or rcx, r8
shl rax, 0x15
or rax, rcx
shl rdx, 0xc
or rdx, rax
mov qword [0x140008cf0], rax
mov qword [0x140008ce8], rdx
mov qword [0x140008cf8], rcx
jmp 0x140004931
movdqa xmm0, xmmword [0x1400074b0]
movabs rax, 0xfffff6fb7dbed000
mov qword [0x140008ce8], rax
movabs rax, 0xfffff68000000000
mov qword [0x140008d00], rax
movdqu xmmword [0x140008cf0], xmm0
mov rax, qword [sym.imp.ntoskrnl.exe_PsInitialSystemProcess]
mov rcx, qword [rax]
mov rax, qword [rcx + 0x28]
and dword [0x140008f10], 0
mov qword [0x140008d08], rax
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalMemoryRanges]
and dword [0x140008f10], 0
mov r8, rax
xor eax, eax
movsxd rdx, eax
add rdx, rdx
mov rax, qword [r8 + rdx*8]
mov rcx, qword [r8 + rdx*8 + 8]
test rax, rax
jne 0x140004978
test rcx, rcx
je 0x1400049a9
add rcx, rax
mov qword [rsp + 0x20], rax
lea rax, [0x140008d10]
mov qword [rsp + 0x28], rcx
movups xmm0, xmmword [rsp + 0x20]
movdqu xmmword [rax + rdx*8], xmm0
mov eax, dword [0x140008f10]
inc eax
mov dword [0x140008f10], eax
cmp eax, 0x20
jl 0x14000495f
xor edx, edx
mov rcx, r8
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and dword [0x14000af44], 0
mov ecx, 0x2ff
mov byte [0x14000af40], 0
rdmsr
shl rdx, 0x20
mov ebx, 0xfe
or rax, rdx
mov ecx, ebx
mov r8, rax
rdmsr
shl rdx, 0x20
or rax, rdx
mov byte [0x14000af40], r8b
bt rax, 8
jae 0x140004a0e
bt r8, 0xa
jae 0x140004a0e
lea rax, [0x140008f18]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.140004b30
mov ecx, ebx
rdmsr
shl rdx, 0x20
xor r11d, r11d
or rax, rdx
movzx r10d, al
mov dword [0x14000af44], r10d
test al, al
je 0x140004ab3
lea rbx, [0x140009768]
movabs rbp, 0xfffffffff000
mov r9d, 0x201
lea ecx, [r9 - 1]
rdmsr
shl rdx, 0x20
mov ecx, r9d
or rax, rdx
mov r8, rax
rdmsr
shl rdx, 0x20
or rax, rdx
bt rax, 0xb
jae 0x140004aa3
and rax, rbp
mov byte [rbx], r8b
bsf rcx, rax
mov eax, 1
mov rdx, r8
shl rax, cl
and rdx, rbp
shl rax, 0xc
add rax, rdx
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
movdqu xmmword [rbx - 0x10], xmm0
mov r10d, dword [0x14000af44]
inc r11d
add r9d, 2
add rbx, 0x18
cmp r11d, r10d
jl 0x140004a46
and dword [rdi], 0
mov rax, rdi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140006890
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret