joyce8/EMBER2024-capa huggingface dataset:
Function at 0x21008f6d0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea r14, [method.fhandler_base.get_handle__]
mov rax, qword [rcx]
mov rbp, qword [rsp + 0xc0]
mov rax, qword [rax + 0x280]
mov dword [rbp], 0
mov r12, rcx
mov rsi, rdx
mov ebx, r8d
mov rdi, r9
cmp rax, r14
jne 0x21008f7b8
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x20], 0
call sym.WriteFile
mov r13d, eax
test eax, eax
je 0x21008f7df
cmp dword [rbp], 5
je 0x21008f7f3
lea r15, [0x210273880]
test byte [0x210273880], 1
je 0x21008f7a0
mov rax, qword [r12]
mov edi, dword [rdi]
mov rax, qword [rax + 0x280]
cmp rax, r14
jne 0x21008f870
mov dword [rsp + 0x48], edi
mov rax, qword [r12 + 0x18]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rax
mov eax, dword [rbp]
mov edx, 0x10
mov rcx, r15
mov dword [rsp + 0x20], r13d
lea r9, str._d__err__d___WriteFile___p___p__write__u__written__u__0_
lea r8, str.BOOL_fhandler_dev_floppy::write_file_const_void__DWORD__DWORD__int_
mov dword [rsp + 0x28], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov eax, r13d
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call rax
mov r9, rdi
mov r8d, ebx
mov rdx, rsi
mov qword [rsp + 0x20], 0
mov rcx, qword [rax]
call sym.WriteFile
mov r13d, eax
test eax, eax
jne 0x21008f732
call sym.GetLastError
xor r13d, r13d
mov dword [rbp], eax
cmp eax, 5
jne 0x21008f73c
cmp word [r12 + 0x1b2], 0xb
je 0x21008f73c
test byte [r12 + 0x2c], 3
je 0x21008f73c
mov edx, ebx
mov rcx, r12
call method.fhandler_dev_floppy.lock_partition_unsigned_int_
test eax, eax
je 0x21008f73c
mov rax, qword [r12]
mov dword [rbp], 0
mov rax, qword [rax + 0x280]
cmp rax, r14
jne 0x21008f88a
lea rax, [r12 + 0x18]
mov qword [rsp + 0x20], 0
mov rcx, qword [rax]
mov r9, rdi
mov r8d, ebx
mov rdx, rsi
call sym.WriteFile
mov r13d, eax
test eax, eax
jne 0x21008f73c
call sym.GetLastError
mov dword [rbp], eax
jmp 0x21008f73c
mov rcx, r12
call rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rsi
mov rax, qword [rax]
jmp 0x21008f774
mov rcx, r12
call rax
jmp 0x21008f83d
Function at 0x210090a50
Capabilities:
Get file attributes

Disassembly:
push r12
push rsi
push rbx
add rsp, 0xffffffffffffff80
lea rsi, [method.fhandler_base.get_handle__]
mov rax, qword [rcx]
mov rax, qword [rax + 0x280]
mov qword [rsp + 0x68], 0
mov r12, rcx
mov ebx, edx
cmp rax, rsi
jne 0x210090b70
mov rcx, qword [rcx + 0x18]
lea rdx, [rsp + 0x50]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea r8, [rsp + 0x60]
call sym.NtQueryInformationFile
test eax, eax
js 0x210090b9a
mov rax, qword [r12]
lea rdx, [r12 + 0x80]
mov rax, qword [rax + 0x280]
cmp rax, rsi
jne 0x210090b10
mov rcx, qword [r12 + 0x18]
xor r9d, r9d
lea r8, [rsp + 0x4c]
mov qword [rsp + 0x20], 0
call sym.get_file_attribute_void__path_conv__unsigned_int__unsigned_int__unsigned_int_
test eax, eax
jne 0x210090b3c
mov r8d, dword [rsp + 0x4c]
mov rdx, qword [rsp + 0x68]
mov r9d, ebx
mov rcx, r12
mov dword [rsp + 0x20], 1
call method.fhandler_mqueue._mqinfo_unsigned_long_long__unsigned_int__int__bool_
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop r12
ret
mov qword [rsp + 0x38], rdx
mov rcx, r12
call rax
mov rdx, qword [rsp + 0x38]
xor r9d, r9d
lea r8, [rsp + 0x4c]
mov qword [rsp + 0x20], 0
mov rcx, qword [rax]
call sym.get_file_attribute_void__path_conv__unsigned_int__unsigned_int__unsigned_int_
test eax, eax
je 0x210090ae0
mov dword [rsp + 0x20], 1
mov rdx, qword [rsp + 0x68]
mov r9d, ebx
mov rcx, r12
mov r8d, 0x1a4
mov dword [rsp + 0x4c], 0x1a4
call method.fhandler_mqueue._mqinfo_unsigned_long_long__unsigned_int__int__bool_
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop r12
ret
call rax
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x50]
mov r9d, 0x18
mov rcx, qword [rax]
lea r8, [rsp + 0x60]
call sym.NtQueryInformationFile
test eax, eax
jns 0x210090aa9
mov r8d, eax
mov edx, 0xfb
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler_mqueue.cc
call sym.seterrno_from_nt_status_char_const__int__int_
xor eax, eax
jmp 0x210090afd
Function at 0x210090bc0
Capabilities:
Set file attributes

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [rdx + 0x10]
mov r13, qword [rdx + 8]
lea rbx, [rax + 7]
mov rax, qword [rcx]
and rbx, 0xfffffffffffffff8
lea rdi, [rbx + 0xc]
mov rsi, rdx
mov r12, rcx
mov ebp, r8d
imul r13, rdi
mov rax, qword [rax + 0x280]
lea rdx, [method.fhandler_base.get_handle__]
mov r14d, r9d
add r13, 0xf4
mov qword [rsp + 0x38], r13
cmp rax, rdx
jne 0x210090cf0
mov rcx, qword [rcx + 0x18]
lea rdx, [rsp + 0x40]
mov r9d, 8
mov dword [rsp + 0x20], 0x14
lea r8, [rsp + 0x38]
call sym.NtSetInformationFile
test eax, eax
js 0x210090d1a
mov r9d, r14d
mov r8d, ebp
mov rdx, r13
mov rcx, r12
mov dword [rsp + 0x20], 0
call method.fhandler_mqueue._mqinfo_unsigned_long_long__unsigned_int__int__bool_
test rax, rax
je 0x210090cde
mov r11, qword [rsi + 8]
mov r8, qword [rax]
mov rdx, qword [rsi + 0x10]
lea r10, [r11 - 1]
mov dword [r8 + 4], r11d
mov dword [r8], 0
mov dword [r8 + 8], edx
mov dword [r8 + 0xf0], 0x98765432
mov qword [r8 + 0xc], 0
mov qword [r8 + 0x14], 0xf4
mov dword [r8 + 0x1c], 0
test r10, r10
jle 0x210090d40
xor ecx, ecx
mov edx, 0xf4
mov r9, rdx
add ecx, 1
lea rdx, [rbx + rdx + 0xc]
mov dword [r8 + r9], edx
movsxd r9, ecx
cmp r9, r10
jl 0x210090cb0
sub r11, 2
add r8, rbx
imul r11, rdi
mov dword [r11 + r8 + 0x100], 0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call rax
mov dword [rsp + 0x20], 0x14
lea rdx, [rsp + 0x40]
mov r9d, 8
mov rcx, qword [rax]
lea r8, [rsp + 0x38]
call sym.NtSetInformationFile
test eax, eax
jns 0x210090c41
mov r8d, eax
mov edx, 0x116
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler_mqueue.cc
call sym.seterrno_from_nt_status_char_const__int__int_
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [r8 + 0xf4], 0
jmp 0x210090cde
Function at 0x210090d50
Capabilities:
Set file attributes

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
lea r12, [method.fhandler_base.get_handle__]
mov rax, qword [rcx]
mov rax, qword [rax + 0x280]
mov rbx, rcx
mov esi, edx
mov edi, r8d
cmp rax, r12
jne 0x210090e68
mov r12, qword [rcx + 0x18]
test r12, r12
je 0x210090e55
mov qword [rbx + 0x18], 0
test sil, sil
jne 0x210090db8
test dil, dil
jne 0x210090ea8
mov rcx, r12
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp sym.NtClose
xor edx, edx
lea rcx, [rbx + 0x80]
call method.path_conv.get_nt_native_path__UNICODE_STRING_
test rax, rax
je 0x210090e16
mov ecx, dword [0x2102d1cd0]
xor eax, eax
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x78], 0
test ecx, ecx
setne al
add eax, eax
or eax, dword [rbx + 0x84]
mov dword [rsp + 0x68], eax
lea rax, [rbx + 0xf8]
mov qword [rsp + 0x60], rax
mov rax, qword [0x2102d1cc8]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x38]
lea r9, [rsp + 0x40]
mov edx, 0x80100000
mov dword [rsp + 0x28], 0x4020
mov dword [rsp + 0x20], 7
lea r8, [rsp + 0x50]
call sym.NtOpenFile
test eax, eax
js 0x210090e90
mov rax, qword [rsp + 0x38]
mov qword [rbx + 0x18], rax
mov rcx, r12
call sym.NtClose
nop
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
call rax
cmp qword [rax], 0
je 0x210090e55
mov rax, qword [rbx]
mov rax, qword [rax + 0x280]
cmp rax, r12
je 0x210090fb8
mov rcx, rbx
call rax
mov r12, qword [rax]
jmp 0x210090d8a
test byte [0x210273880], 1
jne 0x210090f90
or byte [rbx + 8], 0x10
jmp 0x210090e4c
mov dword [rsp + 0x20], 0xd
lea rsi, [rsp + 0x37]
lea r13, [rsp + 0x40]
mov rcx, r12
mov rdx, r13
mov r9d, 1
mov r8, rsi
mov byte [rsp + 0x37], 1
call sym.NtSetInformationFile
xor edx, edx
lea rcx, [rbx + 0x80]
call method.path_conv.get_nt_native_path__UNICODE_STRING_
test rax, rax
je 0x210090f2e
mov edx, dword [0x2102d1cd0]
xor eax, eax
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x78], 0
test edx, edx
setne al
add rbx, 0xf8
add eax, eax
or eax, dword [rbx - 0x74]
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], eax
mov rax, qword [0x2102d1cc8]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x28], 0x4000
lea rcx, [rsp + 0x38]
mov r9, r13
lea r8, [rsp + 0x50]
mov dword [rsp + 0x20], 7
mov edx, 0x10000
call sym.NtOpenFile
test eax, eax
js 0x210090e4c
mov dword [rsp + 0x20], 0xd
mov rcx, qword [rsp + 0x38]
mov r8, rsi
mov rdx, r13
mov r9d, 1
call sym.NtSetInformationFile
mov rcx, qword [rsp + 0x38]
call sym.NtClose
jmp 0x210090e4c
mov dword [rsp + 0x20], eax
lea r9, str.Opening_default_stream_failed:_status__y
lea r8, str.void_fhandler_mqueue::mq_open_finish_bool__bool_
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x210090e9d
mov r12, qword [rbx + 0x18]
jmp 0x210090d8a
Function at 0x210091400
Capabilities:
Process ghostly hollowing

Disassembly:
sub rsp, 0x48
test edx, 0xfffbb5fc
jne 0x210091420
mov eax, edx
and eax, 3
cmp eax, 3
je 0x210091420
add rsp, 0x48
jmp method.fhandler_mqueue.mq_open_int__unsigned_int__mq_attr___clone_.part.0_
test byte [0x210273880], 1
jne 0x210091450
mov rax, qword [sym.msys_2.0.dll__impure_ptr]
mov dword [rax], 0x16
call sym.msys_2.0.dll___errno
mov dword [rax], 0x16
xor eax, eax
add rsp, 0x48
ret
lea rax, str.int_fhandler_mqueue::mq_open_int__mode_t__mq_attr_
mov dword [rsp + 0x30], 0x16
lea r9, [0x21028e6f1]
mov edx, 0x40
mov dword [rsp + 0x28], 0x48
lea r8, [0x21028e708]
lea rcx, [0x210273880]
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x210091429

Function at 0x210091490
Capabilities:
Process ghostly hollowing

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x48
mov rax, qword [rcx + 0x128]
lea r12, [rax + 0xc]
mov r13, rcx
mov rcx, r12
mov ebx, edx
mov esi, r8d
call sym.msys_2.0.dll_strlen
sub rax, 1
cmp rax, 0xfe
jbe 0x2100914f8
test byte [0x210273880], 1
jne 0x210091568
mov rax, qword [sym.msys_2.0.dll__impure_ptr]
mov dword [rax], 0x16
call sym.msys_2.0.dll___errno
mov dword [rax], 0x16
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
lea rdx, [0x21028e9ca]
mov rcx, r12
call sym.msys_2.0.dll_strpbrk
test rax, rax
jne 0x2100914c1
test ebx, 0xfdf835fc
jne 0x210091540
mov eax, ebx
and eax, 3
cmp eax, 3
je 0x210091540
and ebx, 0xfdfc7fff
xor r9d, r9d
mov r8d, esi
mov rcx, r13
mov edx, ebx
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
jmp method.fhandler_mqueue.mq_open_int__unsigned_int__mq_attr___clone_.part.0_
test byte [0x210273880], 1
je 0x2100914ce
mov dword [rsp + 0x30], 0x16
lea rax, str.int_fhandler_mqueue::mq_open_int__mode_t__mq_attr_
mov dword [rsp + 0x28], 0x48
jmp 0x21009157f
mov dword [rsp + 0x30], 0x16
lea rax, str.virtual_int_fhandler_mqueue::open_int__mode_t_
mov dword [rsp + 0x28], 0x33
mov qword [rsp + 0x20], rax
lea r9, [0x21028e6f1]
lea r8, [0x21028e708]
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100914ce
Function at 0x2100915b0
Capabilities:
Map section object

Disassembly:
push r12
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov rbx, rcx
mov r12, rdx
mov rsi, r8
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
lea rdx, [rsp + 0x60]
mov rax, qword [rax - 0x1bf8]
mov qword [rsp + 0x60], rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov qword [rax - 0x1bf8], rdx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov rax, qword [rax - 0x2cc8]
mov qword [rsp + 0x68], rax
lea rax, [0x2100917b0]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rsp
mov qword [rsp + 0x50], 0
mov rax, qword [rcx + 0x1f0]
mov qword [rsp + 0x58], rax
call sym.GetCurrentProcess
mov dword [rsp + 0x30], 2
mov rcx, r12
mov rdx, qword [rbx + 0x1e8]
mov dword [rsp + 0x28], 0
mov r8, rax
lea r9, [rsi + 0x1e8]
mov dword [rsp + 0x20], 0
call sym.DuplicateHandle
test eax, eax
je 0x2100917db
lea rax, [rsp + 0x58]
mov dword [rsp + 0x48], 4
mov rcx, qword [rbx + 0x1e8]
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
lea r8, [rsp + 0x50]
mov rdx, 0xffffffffffffffff
mov dword [rsp + 0x40], 0x100000
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call sym.NtMapViewOfSection
test eax, eax
js 0x210091848
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x1e0], rax
call sym.GetCurrentProcess
mov dword [rsp + 0x30], 2
mov rcx, r12
mov rdx, qword [rbx + 0x208]
mov dword [rsp + 0x28], 0
mov r8, rax
lea r9, [rsi + 0x208]
mov dword [rsp + 0x20], 0
call sym.DuplicateHandle
test eax, eax
je 0x2100917db
call sym.GetCurrentProcess
mov dword [rsp + 0x30], 2
mov rcx, r12
mov rdx, qword [rbx + 0x210]
mov dword [rsp + 0x28], 0
mov r8, rax
lea r9, [rsi + 0x210]
mov dword [rsp + 0x20], 0
call sym.DuplicateHandle
test eax, eax
je 0x2100917db
call sym.GetCurrentProcess
mov dword [rsp + 0x30], 2
mov rcx, r12
mov rdx, qword [rbx + 0x200]
mov dword [rsp + 0x28], 0
mov r8, rax
lea r9, [rsi + 0x200]
mov dword [rsp + 0x20], 0
call sym.DuplicateHandle
test eax, eax
je 0x2100917db
mov rax, qword gs:[0x30]
mov rdx, qword [rsp + 0x60]
mov rax, qword [rax + 8]
mov qword [rax - 0x1bf8], rdx
xor eax, eax
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop r12
ret
mov rax, qword gs:[0x30]
mov rdx, qword [rsp + 0x60]
mov rax, qword [rax + 8]
mov qword [rax - 0x1bf8], rdx
mov eax, 0xffffffff
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop r12
ret
mov edx, eax
lea rcx, str.Mapping_message_queue_failed_in_fork__status_0x_x_n
call sym.api_fatal
nop
nop
nop dword [rax + rax]
Function at 0x210091860
Capabilities:
Map section object

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
mov rbx, rdx
call method.fhandler_disk_file.dup_fhandler_base__int_
test eax, eax
je 0x210091880
add rsp, 0x28
pop rbx
pop r12
ret
mov rdx, qword [r12 + 0x220]
mov rax, qword [rbx + 0x220]
movdqu xmm0, xmmword [rdx]
movups xmmword [rax], xmm0
movdqu xmm1, xmmword [rdx + 0x10]
movups xmmword [rax + 0x10], xmm1
movdqu xmm2, xmmword [rdx + 0x20]
movups xmmword [rax + 0x20], xmm2
movdqu xmm3, xmmword [rdx + 0x30]
movups xmmword [rax + 0x30], xmm3
movdqu xmm4, xmmword [rdx + 0x40]
movups xmmword [rax + 0x40], xmm4
call sym.GetCurrentProcess
mov r8, rbx
mov rcx, r12
mov rdx, rax
add rsp, 0x28
pop rbx
pop r12
jmp method.fhandler_mqueue._dup_void__fhandler_mqueue_
Function at 0x2100960a0
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x58
mov rax, qword [rcx]
mov rax, qword [rax + 0x280]
movzx edx, dl
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], edx
lea rdx, [method.fhandler_base.get_handle__]
cmp rax, rdx
jne 0x2100960f8
mov rcx, qword [rcx + 0x18]
lea rdx, [rsp + 0x40]
mov r9d, 8
mov dword [rsp + 0x20], 0x17
lea r8, [rsp + 0x38]
call sym.NtSetInformationFile
test eax, eax
js 0x21009611e
add rsp, 0x58
ret
call rax
mov dword [rsp + 0x20], 0x17
lea rdx, [rsp + 0x40]
mov r9d, 8
mov rcx, qword [rax]
lea r8, [rsp + 0x38]
call sym.NtSetInformationFile
test eax, eax
jns 0x2100960ee
test byte [0x210273880], 1
je 0x2100960ee
mov dword [rsp + 0x20], eax
lea r9, str.NtSetInformationFile_FilePipeInformation_:__y
lea r8, str.void_fhandler_pipe::set_pipe_non_blocking_bool_
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
nop
add rsp, 0x58
ret
Function at 0x210097450
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x70
lea rdx, [method.fhandler_base.get_handle__]
mov rax, qword [rcx]
mov rax, qword [rax + 0x280]
mov rbx, rcx
cmp rax, rdx
jne 0x2100974a8
mov rcx, qword [rcx + 0x18]
lea rdx, [rsp + 0x30]
mov r9d, 0x28
mov dword [rsp + 0x20], 0x18
lea r8, [rsp + 0x40]
call sym.NtQueryInformationFile
test eax, eax
js 0x21009749e
mov eax, dword [rsp + 0x50]
mov qword [rbx + 0x1d0], rax
add rsp, 0x70
pop rbx
ret
call rax
mov dword [rsp + 0x20], 0x18
lea rdx, [rsp + 0x30]
mov r9d, 0x28
mov rcx, qword [rax]
lea r8, [rsp + 0x40]
call sym.NtQueryInformationFile
test eax, eax
jns 0x210097493
jmp 0x21009749e
Function at 0x210097870
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r12, rdx
mov qword [rsp + 0xa0], rcx
mov rbp, r8
mov edx, 0x10000
jmp 0x2100978d7
mov r8d, esi
xor r9d, r9d
mov rdx, rax
mov ecx, 0x10
call sym.NtQuerySystemInformation
mov esi, eax
test eax, eax
jns 0x210097918
call sym.GetProcessHeap
xor edx, edx
mov r8, rbx
mov rcx, rax
call sym.HeapFree
mov rdx, rdi
cmp rdi, 0x7fffff
ja 0x210097900
cmp esi, 0xc0000004
jne 0x210097900
lea rdi, [rdx + rdx]
add rdx, rdi
lea rsi, [rdx*8 + 4]
call sym.GetProcessHeap
mov r8, rsi
xor edx, edx
mov rcx, rax
call sym.HeapAlloc
mov rbx, rax
test rax, rax
jne 0x210097898
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movsxd rax, dword [rbx]
mov r13d, eax
sub r13d, 1
js 0x210097a18
lea rax, [rax + rax*2]
lea rdi, [rsp + 0x48]
lea rsi, [rbx + rax*8]
lea r15, [rsp + 0x44]
jmp 0x210097952
sub r13d, 1
sub rsi, 0x18
cmp r13d, 0xffffffff
je 0x210097a18
cmp dword [rsi], 0x120199
jne 0x210097940
movzx r8d, word [rsi - 0x10]
xor edx, edx
mov ecx, 0x40
call sym.OpenProcess
mov r14, rax
test rax, rax
je 0x210097940
movzx eax, word [rsi - 0xa]
mov qword [rsp + 0x48], rax
call sym.GetCurrentProcess
mov rdx, qword [rsp + 0x48]
mov r9, rdi
mov rcx, r14
mov dword [rsp + 0x30], 0
mov r8, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
call sym.DuplicateHandle
test eax, eax
je 0x2100979fe
mov qword [rsp + 0x20], r15
mov rcx, qword [rsp + 0x48]
mov r8, rbp
mov edx, 1
mov r9d, 0x10000
call sym.NtQueryObject
test eax, eax
js 0x2100979f4
mov rdx, qword [rbp + 8]
test rdx, rdx
je 0x2100979f4
movzx eax, word [rbp]
xor ecx, ecx
and rax, 0xfffffffffffffffe
mov word [rdx + rax], cx
mov rcx, r12
call sym.msys_2.0.dll_wcscmp
test eax, eax
je 0x210097a2f
mov rcx, qword [rsp + 0x48]
call sym.CloseHandle
mov rcx, r14
sub r13d, 1
sub rsi, 0x18
call sym.CloseHandle
cmp r13d, 0xffffffff
jne 0x210097952
call sym.GetProcessHeap
mov r8, rbx
xor edx, edx
mov rcx, rax
call sym.HeapFree
jmp 0x210097900
mov rax, qword [rsp + 0xa0]
movsxd r10, r13d
mov rdi, qword [rsp + 0xa0]
mov qword [rax + 0x1f8], r14
lea rax, [r10 + r10*2]
movzx eax, word [rbx + rax*8 + 0xe]
mov qword [rdi + 0x200], rax
call sym.GetProcessHeap
mov r8, rbx
xor edx, edx
mov rcx, rax
call sym.HeapFree
mov rax, qword [rsp + 0x48]
jmp 0x210097902
Function at 0x210098370
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
xor r9d, r9d
mov r8d, 0x30
mov ecx, 3
sub rsp, 0x150
mov r13, rdx
lea rdx, [rbp - 0x30]
lea rbx, [rsp + 0x30]
call sym.NtQuerySystemInformation
test eax, eax
js 0x2100984c0
mov rdx, qword [rbp - 0x28]
sub rdx, qword [rbp - 0x30]
xor r9d, r9d
movabs rcx, 0xa7c5ac471b47843
movabs r8, 0x28f5c28f5c28f5c3
shr rdx, 5
mov rax, rdx
mul rcx
mov rcx, rdx
shr rdx, 9
mov rax, rdx
shr rcx, 7
mul r8
mov r8d, 0x148
mov rdi, rdx
mov rdx, rbx
shr rdi, 2
lea rax, [rdi + rdi*4]
mov rsi, rdi
mov rdi, rcx
mov ecx, 2
lea rax, [rax + rax*4]
shl rax, 2
sub rdi, rax
call sym.NtQuerySystemInformation
test eax, eax
js 0x2100984eb
mov rax, qword [rbx]
mov ecx, dword [0x21034b040]
cqo
idiv rcx
mov rcx, qword [r13]
movabs rdx, 0xa7c5ac471b47843
shr rax, 5
mul rdx
mov rbx, rdx
mov r12, rdx
mov edx, 0x50
call sym.crealloc_abort
shr rbx, 9
shr r12, 7
movabs rdx, 0x28f5c28f5c28f5c3
mov qword [r13], rax
mov rcx, rax
mov rax, rbx
mul rdx
mov r8, rdx
and rdx, 0xfffffffffffffffc
shr r8, 2
lea rbx, [rdx + r8]
mov qword [rsp + 0x20], r8
lea rax, [rbx + rbx*4]
shl rax, 2
sub r12, rax
mov qword [rsp + 0x28], r12
mov r9, rdi
mov r8, rsi
lea rdx, str._U._02u__U._02u_n
call sym.__small_sprintf
cdqe
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
test byte [0x210273880], 1
jne 0x210098518
xor r9d, r9d
mov r8d, 0x148
mov rdx, rbx
xor esi, esi
mov ecx, 2
xor edi, edi
call sym.NtQuerySystemInformation
test eax, eax
jns 0x210098420
mov rcx, qword [r13]
mov edx, 0x50
call sym.crealloc_abort
mov qword [rsp + 0x28], 0
mov qword [r13], rax
mov rcx, rax
mov qword [rsp + 0x20], 0
jmp 0x210098496
mov dword [rsp + 0x20], eax
lea r9, [0x21028f900]
lea r8, str.off_t_format_proc_uptime_void__char_
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100984c9
Function at 0x2100a1370
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x30
mov edi, ecx
mov ecx, 0x4000
call sym.malloc_1
mov r12, rax
test rax, rax
je 0x2100a14cb
mov esi, 0x4000
jmp 0x2100a13ba
lea edx, [rsi + rsi]
mov rcx, r12
mov rsi, rdx
call sym.realloc_1
test rax, rax
je 0x2100a1479
mov r12, rax
xor r9d, r9d
mov r8d, esi
mov rdx, r12
mov ecx, 5
call sym.NtQuerySystemInformation
mov ebx, eax
cmp eax, 0xc0000004
je 0x2100a13a0
test eax, eax
js 0x2100a1470
mov rdx, r12
cmp dword [r12 + 0x50], edi
jne 0x2100a13f8
jmp 0x2100a1420
add rdx, rax
cmp dword [rdx + 0x50], edi
je 0x2100a1420
mov eax, dword [rdx]
test eax, eax
jne 0x2100a13f0
mov r13d, 0x5a
mov rcx, r12
call sym.free_1
mov eax, r13d
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov eax, dword [rdx + 4]
lea rcx, [rdx + 0x100]
test eax, eax
je 0x2100a14c0
sub eax, 1
lea rax, [rax + rax*4]
shl rax, 4
lea rdx, [rdx + rax + 0x150]
jmp 0x2100a1459
add rcx, 0x50
cmp rcx, rdx
je 0x2100a14c0
mov eax, dword [rcx + 0x44]
sub eax, 1
cmp eax, 1
ja 0x2100a1450
mov r13d, 0x52
jmp 0x2100a1404
test byte [0x210273880], 1
jne 0x2100a1481
mov r13d, 0x20
jmp 0x2100a1404
mov ecx, eax
mov r13d, 0x20
call sym.RtlNtStatusToDosError
mov dword [rsp + 0x20], ebx
mov edx, 0x40
lea r9, str.NtQuerySystemInformation:_status__y___u
mov dword [rsp + 0x28], eax
lea r8, str.int_get_process_state_DWORD_
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100a1404
mov r13d, 0x53
jmp 0x2100a1404
mov r13d, 0x20
jmp 0x2100a140c