joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180020a80
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov ebx, edx
mov esi, ecx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180020ac0
add ebx, 0xffffffff
jne 0x180020a96
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180020ae0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push r13
push r14
push r15
sub rsp, 0x60
mov dword [rax + 0x20], 8
mov r14, rdx
mov dword [rax + 0x18], 0
lea rax, [rax - 0x40]
mov r15, rcx
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, str.HARDWARERESOURCEMAPSystem_ResourcesPhysical_Memory
xor r8d, r8d
mov rcx, 0xffffffff80000002
xor r13d, r13d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180020d53
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x98]
xor r8d, r8d
mov qword [rsp + 0x20], r13
lea rdx, str..Translated
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180020bca
cmp dword [rsp + 0x98], 8
jne 0x180020bca
mov rax, qword gs:[0x30]
mov edx, 8
mov r8d, dword [rsp + 0x90]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r13, rax
test rax, rax
je 0x180020bca
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x98]
xor r8d, r8d
mov qword [rsp + 0x20], r13
lea rdx, str..Translated
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r13, r13
je 0x180020d53
xor eax, eax
mov dword [rsp + 0x30], eax
cmp dword [r13], eax
jbe 0x180020d27
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r12
nop word [rax + rax]
lea rcx, [rax + rax*8]
xor ebp, ebp
lea r12, [rcx*4 + 4]
add r12, r13
cmp dword [r12 + 0xc], ebp
jbe 0x180020cf7
nop dword [rax]
lea rcx, [rbp*4]
add rcx, rbp
movzx eax, byte [r12 + rcx*4 + 0x10]
lea rbx, [r12 + rcx*4]
sub al, 3
test al, 0xfb
jne 0x180020cea
movzx ecx, word [rbx + 0x12]
mov eax, dword [rbx + 0x1c]
and ecx, 0xe00
cmp ecx, 0x200
je 0x180020c80
cmp ecx, 0x400
je 0x180020c7a
cmp ecx, 0x800
jne 0x180020c84
shl rax, 0x20
jmp 0x180020c84
shl rax, 0x10
jmp 0x180020c84
shl rax, 8
mov rbx, qword [rbx + 0x14]
lea rdx, str.___Enumerating_memory_address_range_0x_llX____0x_llX_r_n
xor edi, edi
mov r8, rbx
mov ecx, 2
lea rsi, [rbx + rax]
mov r9, rsi
call fcn.1800224a0
test edi, edi
jne 0x180020cc3
mov r8d, 0x10000
lea rcx, str._r_tProbing_memory_at_0x_llX_with_size_0x_llX
mov rdx, rbx
call fcn.1800140c0
mov edi, 0x10
mov rdx, r14
mov rcx, rbx
call r15
test eax, eax
jne 0x180020cde
add rbx, 0x1000
dec edi
cmp rbx, rsi
jb 0x180020ca5
lea rcx, str.e_2K_r_tAddress_range_probed_successfully_r_n
call fcn.1800140c0
inc ebp
cmp ebp, dword [r12 + 0xc]
jb 0x180020c30
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
cmp eax, dword [r13]
jb 0x180020c10
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x80]
mov rax, qword gs:[0x30]
mov r8, r13
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, 1
add rsp, 0x60
pop r15
pop r14
pop r13
ret
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x60
pop r15
pop r14
pop r13
ret
Function at 0x180020ef0
Capabilities:
Delete file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x1801e4940]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
mov qword [rsp + 0x20], r9
xor eax, eax
lea rdi, [rsp + 0x30]
mov esi, edx
mov r9, r8
mov ecx, 0x410
lea r8, str._ws_ws
rep stosb byte [rdi], al
lea rcx, [rsp + 0x30]
mov edx, 0x208
call fcn.180015b10
cmp dword [rsp + 0x490], 0
je 0x180020f55
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x180020f6a
test rbx, rbx
je 0x180020f6a
mov r8d, esi
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180020d70
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180028780
add rsp, 0x450
pop rdi
pop rsi
pop rbx
ret

Function at 0x180021010
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1801e4940]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
lea rdi, [rsp + 0x28]
mov dword [rcx], eax
lea r9, [rsp + 0x20]
mov rbx, rcx
mov dword [rsp + 0x20], eax
mov ecx, 0x20
lea rdx, [rsp + 0x28]
rep stosb byte [rdi], al
mov ecx, 0x5a
mov r8d, 0x20
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x180021065
mov ecx, dword [rsp + 0x38]
mov dword [rbx], ecx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180028780
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x180021080
Capabilities:
Get system information on windows

Disassembly:
lea r9, [fcn.1800212b0]
lea r8, [fcn.180021290]
jmp fcn.18001ff00

Function at 0x1800210a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub rsp, 0x28
lea r9, [fcn.1800212b0]
xor edx, edx
lea r8, [fcn.180021290]
xor ecx, ecx
call fcn.18001ff00
mov r8, rax
test rax, rax
je 0x1800210f2
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rbx, qword [rax + 0x18]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
add rsp, 0x28
ret

Function at 0x180021240
Capabilities:
Get system information on windows

Disassembly:
lea r9, [fcn.1800212b0]
xor edx, edx
lea r8, [fcn.180021290]
jmp fcn.18001ffe0
Function at 0x1800217c0
Capabilities:
Install driver
Unload driver

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x260
mov rax, qword [0x1801e4940]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rdx
mov rdx, rcx
movzx esi, r8b
test rcx, rcx
jne 0x1800217f8
mov eax, 0xc00000ef
jmp 0x1800218b7
test rbx, rbx
jne 0x180021807
mov eax, 0xc00000f0
jmp 0x1800218b7
mov qword [rsp + 0x280], rdi
lea r9, str.RegistryMachine
xor eax, eax
mov qword [rsp + 0x20], rdx
lea rdi, [rsp + 0x40]
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rcx, [rsp + 0x40]
mov edx, 0x104
lea r8, str._wSSystemCurrentControlSetServices_wS
call fcn.180015b10
mov rdi, qword [rsp + 0x280]
test eax, eax
js 0x1800217ee
lea rdx, [rsp + 0x64]
mov rcx, rbx
call fcn.1800233e0
test eax, eax
js 0x1800218b7
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
test sil, sil
je 0x1800218ad
cmp eax, 0xc000010e
je 0x180021891
cmp eax, 0xc0000035
je 0x180021891
cmp eax, 0x40000000
jne 0x1800218b7
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
test eax, eax
js 0x1800218b7
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
jmp 0x1800218b7
xor ecx, ecx
cmp eax, 0x40000000
cmove eax, ecx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180028780
mov rbx, qword [rsp + 0x288]
add rsp, 0x260
pop rsi
ret

Function at 0x1800218e0
Capabilities:
Install driver
Unload driver

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0x268
mov rax, qword [0x1801e4940]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14, qword [rsp + 0x2b0]
mov rbx, rdx
mov rdx, rcx
mov rsi, r9
movzx ebp, r8b
test rcx, rcx
je 0x1800219f5
test rbx, rbx
jne 0x18002192c
mov eax, 0xc00000f0
jmp 0x1800219fa
mov qword [rsp + 0x260], rdi
lea r9, str.RegistryMachine
xor eax, eax
mov qword [rsp + 0x20], rdx
lea rdi, [rsp + 0x40]
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rcx, [rsp + 0x40]
mov edx, 0x104
lea r8, str._wSSystemCurrentControlSetServices_wS
call fcn.180015b10
mov rdi, qword [rsp + 0x260]
test eax, eax
js 0x1800219f5
lea rdx, [rsp + 0x64]
mov rcx, rbx
call fcn.1800233e0
test eax, eax
js 0x1800219fa
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
test rsi, rsi
je 0x1800219a8
mov rdx, r14
lea rcx, [rsp + 0x30]
call rsi
test eax, eax
js 0x1800219fa
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
test bpl, bpl
je 0x1800219e9
cmp eax, 0xc000010e
je 0x1800219cd
cmp eax, 0xc0000035
je 0x1800219cd
cmp eax, 0x40000000
jne 0x1800219fa
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
test eax, eax
js 0x1800219fa
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
jmp 0x1800219fa
xor ecx, ecx
cmp eax, 0x40000000
cmove eax, ecx
jmp 0x1800219fa
mov eax, 0xc00000ef
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180028780
add rsp, 0x268
pop r14
pop rsi
pop rbp
pop rbx
ret
Function at 0x180021bb0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180021c48
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
mov r8d, 0x1000002
mov qword [rsp + 0x50], rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
test rax, rax
je 0x180021c3a
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x180021c60
Capabilities:
Map section object

Disassembly:
sub rsp, 0x68
xor r11d, r11d
mov eax, r8d
mov r10, rdx
mov qword [rsp + 0x78], r11
and r10, 0xfffffffffffff000
lea r8, [rsp + 0x78]
sub rax, r10
mov qword [rsp + 0x58], r10
add rax, rdx
mov edx, 2
mov qword [rsp + 0x50], rax
test r9d, r9d
mov eax, 4
cmove eax, edx
xor r9d, r9d
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], edx
mov rdx, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r11
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jns 0x180021cef
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x68
ret
mov rax, qword [rsp + 0x78]
add rsp, 0x68
ret

Function at 0x180022580
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rdi
sub rsp, 0xb0
mov rax, qword [0x1801e4940]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov dword [rsp + 0x20], 0
lea rdi, [rsp + 0x60]
mov ecx, 0x40
rep stosb byte [rdi], al
xor ecx, ecx
lea r9, [rsp + 0x20]
mov r8d, 0x40
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x1800225d7
mov rax, qword [rsp + 0x88]
jmp 0x1800225f5
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x30
rep stosb byte [rdi], al
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180028780
add rsp, 0xb0
pop rdi
ret
Function at 0x180022610
Capabilities:
Map section object

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r12, r8
mov rsi, rdx
xor edi, edi
mov r14d, edi
mov qword [r11 + 0x10], rdi
mov r13, rdx
and r13, 0xfffffffffffff000
mov qword [r11 - 0x30], r13
mov r15d, r9d
mov eax, r9d
sub rax, r13
add rax, rdx
mov qword [r11 - 0x38], rax
mov eax, 4
mov edx, 2
cmp byte [rsp + 0xc0], dil
cmove eax, edx
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edx
lea rax, [r11 - 0x38]
mov qword [r11 - 0x68], rax
lea rax, [r11 - 0x30]
mov qword [r11 - 0x70], rax
mov qword [r11 - 0x78], rdi
xor r9d, r9d
lea r8, [r11 + 0x10]
mov rdx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jns 0x1800226b6
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, edi
jmp 0x1800226be
mov rbx, qword [rsp + 0xa8]
mov qword [rsp + 0x58], rbx
test rbx, rbx
je 0x18002271a
sub rsi, r13
lea rax, [rsi + rbx]
mov r8, r15
cmp byte [rsp + 0xc0], 0
je 0x1800226e4
mov rdx, r12
mov rcx, rax
jmp 0x1800226ea
mov rdx, rax
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
mov edi, 1
mov dword [rsp + 0x50], edi
jmp 0x180022708
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
jmp 0x180022723
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x180022750
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x1801e4940]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rcx
mov rbx, r8
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.180024fd0
lea rcx, [rsp + 0x40]
call fcn.18001f970
mov r9d, 1
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, rdi
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180028780
mov rbx, qword [rsp + 0xf8]
add rsp, 0xd0
pop rdi
ret
Function at 0x1800227f0
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x30
mov ebx, r9d
mov r15, r8
mov r13d, edx
mov r14, rcx
xor edi, edi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rsi, rax
test rax, rax
je 0x180022912
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x50], rbp
mov rcx, r14
mov dword [rsp + 0x20], edi
call fcn.180013160
mov rbp, rax
test rax, rax
je 0x1800228f1
mov rdx, r15
mov rcx, rax
call fcn.180013030
test rax, rax
je 0x1800228e0
sub eax, ebp
mov dword [rsi + 0x28], eax
test ebx, ebx
je 0x180022871
mov eax, 0xdfff
and word [rsi + 0x16], ax
lea r8d, [r13 + 1]
mov r9, r14
shr r8d, 1
mov edx, edi
je 0x18002289a
nop
movzx eax, word [r9]
lea r9, [r9 + 2]
add edx, eax
mov ecx, edx
movzx edx, dx
shr ecx, 0x10
add edx, ecx
add r8d, 0xffffffff
jne 0x180022880
mov ebx, edx
mov rcx, r14
shr ebx, 0x10
add bx, dx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rcx, rax
test rax, rax
je 0x1800228cf
movzx eax, word [rax + 0x58]
cmp bx, ax
adc ax, di
sub bx, ax
movzx eax, word [rcx + 0x5a]
cmp bx, ax
adc ax, di
sub bx, ax
jmp 0x1800228d2
movzx ebx, di
movzx eax, bx
mov edi, 1
add eax, r13d
mov dword [rsi + 0x58], eax
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbp, qword [rsp + 0x50]
mov eax, edi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
mov eax, edi
jmp 0x1800228f8

Function at 0x180022920
Capabilities:
Access pe header

Disassembly:
push rsi
push r12
push r15
sub rsp, 0x50
mov r12, r8
mov r15, rdx
mov rsi, rcx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
cmp dword [rax + 0x84], 1
jbe 0x180022a41
mov qword [rsp + 0x40], r14
mov r14d, dword [rax + 0x90]
test r14, r14
je 0x180022a3c
mov eax, dword [r14 + rsi]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x48], r13
test eax, eax
jne 0x18002297a
mov eax, dword [r14 + rsi + 0x10]
mov ebx, eax
xor r13d, r13d
add rbx, rsi
mov edi, r13d
mov rax, qword [rbx]
test rax, rax
je 0x180022a2a
mov qword [rsp + 0x78], rbp
mov rcx, rax
nop dword [rax]
mov ebp, dword [r14 + rsi + 0x10]
mov qword [rsp + 0x88], r13
test rax, rax
js 0x1800229cb
lea rdx, [rsi + 2]
add rdx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlInitString]
lea rdx, [rsp + 0x20]
jmp 0x1800229de
movzx edx, cx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitString]
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x88]
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov r8, qword [rsp + 0x88]
lea rcx, [rsi + rbp]
sub r8, r15
mov edx, edi
add r8, r12
test eax, eax
cmovs r8, r13
add rbx, 8
mov qword [rcx + rdx*8], r8
inc edi
mov rax, qword [rbx]
mov rcx, rax
test rax, rax
jne 0x1800229a0
mov rbp, qword [rsp + 0x78]
mov r13, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x40]
add rsp, 0x50
pop r15
pop r12
pop rsi
ret
Function at 0x180022a50
Capabilities:
Access peb ldr_data
Get ntdll base address
Get windows directory from kuser_shared_data

Disassembly:
mov r11, rsp
push rbp
push r12
sub rsp, 0x498
mov rax, qword [0x1801e4940]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov qword [r11 + 0x10], rbx
lea rax, [0x180031060]
mov qword [r11 - 0x20], r14
lea r8, str._ws_system32_ws
xor r14d, r14d
mov qword [rsp + 0x20], rax
mov rbp, rcx
mov qword [rsp + 0x30], r14
mov r9d, 0x7ffe0030
lea rcx, [rsp + 0x60]
mov edx, 0x208
mov ebx, r14d
mov r12d, r14d
call fcn.180015b10
test rbp, rbp
jne 0x180022ada
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 1
call fcn.180023e80
test rax, rax
mov rbp, rax
setne r14b
test rax, rax
je 0x180022bf6
lea r9, [fcn.1800212b0]
xor edx, edx
lea r8, [fcn.180021290]
xor ecx, ecx
call fcn.18001ff00
test rax, rax
je 0x180022bf6
mov rcx, qword gs:[0x30]
mov r8, rax
mov qword [rsp + 0x490], r13
xor edx, edx
mov r13, qword [rax + 0x18]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test r13, r13
je 0x180022bee
xor r8d, r8d
lea rcx, [rsp + 0x60]
mov rdx, rbp
call fcn.180023a50
test eax, eax
je 0x180022bee
lea rdx, [rsp + 0x30]
lea rcx, str.MiFillPteHierarchy
call fcn.180023af0
test eax, eax
je 0x180022bee
mov qword [rsp + 0x4c0], rsi
xor eax, eax
mov qword [rsp + 0x4c8], rdi
mov ecx, 0x25
lea rdi, [rsp + 0x38]
mov qword [rsp + 0x480], r15
mov r15, qword [rsp + 0x30]
rep stosb byte [rdi], al
nop word [rax + rax]
mov edi, ebx
lea rdx, [rsp + 0x38]
lea rsi, [rdi + r15]
mov rcx, rsi
call fcn.1800240e0
test dword [rsp + 0x59], 0x1000
jne 0x180022bd6
movzx eax, byte [rsp + 0x38]
cmp al, 0xa
jne 0x180022bc0
mov ecx, 0xb849
cmp word [rsi], cx
je 0x180022bc9
add ebx, eax
cmp ebx, 0x40
jb 0x180022b90
jmp 0x180022bd6
sub rdi, rbp
lea r12, [r13 + 2]
add r12, rdi
add r12, r15
mov r15, qword [rsp + 0x480]
mov rdi, qword [rsp + 0x4c8]
mov rsi, qword [rsp + 0x4c0]
mov r13, qword [rsp + 0x490]
mov rbx, qword [rsp + 0x4b8]
test r14d, r14d
mov r14, qword [rsp + 0x488]
je 0x180022c14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, r12
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.180028780
add rsp, 0x498
pop r12
pop rbp
ret
Function at 0x1800231e0
Capabilities:
Unload driver

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x670
mov rax, qword [0x1801e4940]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov r8, rcx
lea rdi, [rsp + 0x40]
xor eax, eax
mov qword [rsp + 0x20], r8
movzx esi, dl
lea r9, str.RegistryMachine
mov ecx, 0x20a
lea r8, str._wSSystemCurrentControlSetServices_wS
rep stosb byte [rdi], al
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.180015b10
test eax, eax
jns 0x180023243
mov eax, 0xc00000ef
jmp 0x1800232cd
lea rdx, [rsp + 0x64]
xor ecx, ecx
call fcn.1800233e0
test eax, eax
js 0x1800232cd
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x688], rbx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
mov ebx, eax
test eax, eax
js 0x1800232c3
test sil, sil
je 0x1800232c3
xor eax, eax
lea rdi, [rsp + 0x250]
mov ecx, 0x410
lea r8, [rsp + 0x64]
rep stosb byte [rdi], al
lea rcx, [rsp + 0x250]
mov r9d, 0x104
mov edx, 0x208
call fcn.18001f910
lea rdx, [rsp + 0x250]
mov rcx, 0xffffffff80000002
call fcn.1800235c0
mov eax, ebx
mov rbx, qword [rsp + 0x688]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.180028780
mov rsi, qword [rsp + 0x690]
add rsp, 0x670
pop rdi
ret

Function at 0x180023310
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, edx
xor ebp, ebp
mov rsi, r9
mov r14, r8
mov rdx, rcx
mov rbx, rcx
mov r10d, ebp
lea r11d, [rdi + 1]
shr r11d, 1
je 0x18002336d
nop word [rax + rax]
movzx eax, word [rbx]
lea rbx, [rbx + 2]
add r10d, eax
mov ecx, r10d
movzx r10d, r10w
shr ecx, 0x10
add r10d, ecx
add r11d, 0xffffffff
jne 0x180023350
mov ebx, r10d
mov rcx, rdx
shr ebx, 0x10
add bx, r10w
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x1800233a4
movzx ecx, word [rax + 0x58]
cmp bx, cx
adc cx, bp
sub bx, cx
movzx ecx, word [rax + 0x5a]
cmp bx, cx
adc cx, bp
sub bx, cx
mov ecx, dword [rax + 0x58]
jmp 0x1800233a9
mov ecx, edi
movzx ebx, bp
movzx eax, bx
add eax, edi
test r14, r14
je 0x1800233b6
mov dword [r14], ecx
test rsi, rsi
je 0x1800233bd
mov dword [rsi], eax
mov rbx, qword [rsp + 0x30]
cmp eax, ecx
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
sete al
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1800233e0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov rbx, rdx
mov qword [rax + 0x18], rsi
mov rdi, rcx
mov qword [rax - 0x10], rsi
mov dword [rax - 0x18], esi
test rcx, rcx
je 0x180023434
xor r9d, r9d
lea rdx, [rax - 0x18]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
jne 0x180023434
mov eax, 0xc00000f0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rdx, rbx
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x18002347b
mov ebx, 0xc0000022
jmp 0x18002358d
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 4
lea rdx, str.ErrorControl
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x70], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x180023574
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 4
lea rdx, str.Type
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x70], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x180023574
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 4
lea rdx, str.Start
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x70], 3
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x180023574
test rdi, rdi
je 0x180023574
movzx eax, word [rsp + 0x50]
lea rdx, str.ImagePath
mov rcx, qword [rsp + 0x80]
add eax, 2
mov dword [rsp + 0x28], eax
mov r9d, 2
mov rax, qword [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg ebx
mov ebx, 0xc0000022
sbb ecx, ecx
and ebx, ecx
test rdi, rdi
je 0x1800235a4
cmp qword [rsp + 0x58], rsi
je 0x1800235a4
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov rsi, qword [rsp + 0x88]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret