joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140165c80
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rsi
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x1402bb040]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x130
lea rcx, [rsp + 0x30]
call fcn.14020c410
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov r8d, 0x130
lea rdx, [rsp + 0x30]
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax]
test eax, eax
je 0x140165df0
cmp eax, 0xc0000004
jne 0x140165df5
cmp dword [rsp + 0x30], 1
jb 0x140165df0
nop
test rsi, rsi
je 0x140165dc8
cmp dword [0x1402bbf68], 0x64
jb 0x140165da2
mov qword [rsp + 0x1b8], rbx
mov qword [rsp + 0x170], rdi
mov rdi, qword [0x1402c1668]
test rdi, rdi
jne 0x140165d3c
call sym.SystemInformer.exe_Ordinal_1430
mov rbx, rax
jmp 0x140165d8d
mov rdx, qword [0x1402c5ff0]
lea rcx, [rdi + 0x12]
mov qword [rsp + 0x178], rbp
mov rbp, qword [str.SystemRootSystem32_ntoskrnl.exe]
call sym.SystemInformer.exe_Ordinal_1240
mov rbx, rax
xor ecx, ecx
mov qword [rax], rdi
add rax, 0x10
mov qword [rbx + 8], rax
mov word [rax + rdi], cx
test rbp, rbp
je 0x140165d85
mov rcx, qword ds:[rbx + 8]
mov r8, rdi
mov rdx, rbp
call fcn.14020c7e0
mov rbp, qword [rsp + 0x178]
mov rdi, qword [rsp + 0x170]
mov qword [rsi], rbx
mov rbx, qword [rsp + 0x1b8]
jmp 0x140165dc8
lea rax, [rsp + 0x60]
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp byte [rax + rdx], 0
jne 0x140165db0
lea rcx, ds:[rsp + 0x60]
call sym.SystemInformer.exe_Ordinal_1315
mov qword [rsi], rax
cmp dword [0x1402bbf68], 0x71
mov rax, qword [rsp + 0x48]
jb 0x140165de2
test rax, rax
jne 0x140165de2
mov rax, 0xfffffffffffffffe
mov qword [r14], rax
mov eax, dword [rsp + 0x50]
mov dword [r15], eax
xor eax, eax
jmp 0x140165df5
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401e5e40
add rsp, 0x180
pop r15
pop r14
pop rsi
ret

Function at 0x140165e20
Capabilities:
Get system information on windows

Disassembly:
mov edx, 5
jmp sym.SystemInformer.exe_Ordinal_1500
Function at 0x140165e40
Capabilities:
Get system information on windows

Disassembly:
push rsi
push r14
push r15
sub rsp, 0x20
mov r8d, edx
mov esi, edx
mov r15, rcx
sub r8d, 5
je 0x140165e93
sub r8d, 0x34
je 0x140165e84
nop
cmp r8d, 0x5b
je 0x140165e75
mov eax, 0xc0000003
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov eax, dword [0x1402c1640]
lea r14, [0x1402c1640]
jmp 0x140165ea0
mov eax, dword [0x1402c163c]
lea r14, [0x1402c163c]
jmp 0x140165ea0
mov eax, dword [0x1402c1638]
lea r14, [0x1402c1638]
mov rcx, qword [0x1402c6140]
xor edx, edx
mov qword [rsp + 0x40], rbx
mov ebx, eax
mov r8d, eax
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x50], rdi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x140165f5f
lea r9, ds:[rsp + 0x48]
mov r8d, ebx
mov rdx, rdi
mov ecx, esi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
cmp eax, 0xc0000023
je 0x140165ef6
cmp eax, 0xc0000004
jne 0x140165f2b
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov rcx, qword [0x1402c6140]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x140165f5f
mov ebx, dword [rsp + 0x48]
jmp 0x140165ed2
lfence
test ebx, ebx
jns 0x140165f4a
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
jmp 0x140165f64
mov eax, dword [rsp + 0x48]
cmp eax, 0x100000
ja 0x140165f58
mov dword [r14], eax
mov qword [r15], rdi
mov eax, ebx
jmp 0x140165f64
mov eax, 0xc0000017
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
Function at 0x1401662a0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebx, dword [0x1402c15d8]
mov r14, rcx
mov rcx, qword [0x1402c6140]
xor ebp, ebp
mov r8d, ebx
mov dword [rsp + 0x48], ebp
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rdx, rax
mov ecx, 0x40
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x140166351
cmp ebp, 0xa
jae 0x140166359
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ebx, dword [rsp + 0x48]
mov edx, 4
mov rcx, qword [0x1402c6140]
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r9, ds:[rsp + 0x48]
mov r8d, ebx
mov rdx, rax
mov ecx, 0x40
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
inc ebp
mov esi, eax
cmp eax, 0xc0000004
je 0x1401662f8
test esi, esi
jns 0x14016640f
mov ebx, dword [0x1402c15d8]
mov edx, 4
mov rcx, qword [0x1402c6140]
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov ecx, 0x40
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x1401663e8
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add ebx, ebx
cmp ebx, 0x10000000
ja 0x140166408
lfence
mov rcx, qword [0x1402c6140]
mov edx, 4
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov ecx, 0x40
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
je 0x140166394
test esi, esi
jns 0x14016640f
lfence
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140166423
mov eax, 0xc000009a
jmp 0x140166425
lfence
cmp ebx, 0x200000
ja 0x140166420
mov dword [0x1402c15d8], ebx
mov qword [r14], rdi
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140166760
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 0x200
mov rcx, qword [0x1402c6140]
mov r8d, ebx
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov ecx, 0x12
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x140166808
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add ebx, ebx
cmp ebx, 0x10000000
ja 0x140166828
lfence
mov rcx, qword [0x1402c6140]
mov edx, 4
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov ecx, 0x12
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
je 0x1401667b2
lfence
test esi, esi
jns 0x14016682f
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140166832
mov eax, 0xc000009a
jmp 0x140166834
mov qword [r14], rdi
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x140166860
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 0x200
mov rcx, qword [0x1402c6140]
mov r8d, ebx
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov ecx, 0x90
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
jne 0x140166908
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
add ebx, ebx
cmp ebx, 0x10000000
ja 0x140166928
lfence
mov rcx, qword [0x1402c6140]
mov edx, 4
mov r8d, ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov ecx, 0x90
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp eax, 0xc0000004
je 0x1401668b2
lfence
test esi, esi
jns 0x14016692f
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140166932
mov eax, 0xc000009a
jmp 0x140166934
mov qword [r14], rdi
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140166960
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov dword [rsp + 0x38], 0x100
mov rcx, qword [0x1402c6140]
mov edx, 4
mov r8d, 0x100
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r9, [rsp + 0x38]
mov r8d, 0x100
mov rdx, rax
mov ecx, 0x16
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
xor ebx, ebx
mov edi, eax
cmp eax, 0xc0000004
jne 0x140166a14
nop
cmp ebx, 8
jae 0x140166a1d
mov rcx, qword [0x1402c6140]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x38]
mov edx, 4
mov rcx, qword [0x1402c6140]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rax
mov ecx, 0x16
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
inc ebx
mov edi, eax
cmp eax, 0xc0000004
je 0x1401669c0
test edi, edi
js 0x140166a1d
mov qword [r14], rsi
jmp 0x140166a32
lfence
mov rcx, qword [0x1402c6140]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x140166a60
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov dword [rsp + 0x38], 0x100
mov rcx, qword [0x1402c6140]
mov edx, 4
mov r8d, 0x100
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r9, [rsp + 0x38]
mov r8d, 0x100
mov rdx, rax
mov ecx, 0x42
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
xor ebx, ebx
mov edi, eax
cmp eax, 0xc0000004
jne 0x140166b14
nop
cmp ebx, 8
jae 0x140166b1d
mov rcx, qword [0x1402c6140]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x38]
mov edx, 4
mov rcx, qword [0x1402c6140]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rax
mov ecx, 0x42
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
inc ebx
mov edi, eax
cmp eax, 0xc0000004
je 0x140166ac0
test edi, edi
js 0x140166b1d
mov qword [r14], rsi
jmp 0x140166b32
lfence
mov rcx, qword [0x1402c6140]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140167b20
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x10], edx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
movzx r13d, r8b
mov ebx, edx
mov r14, rcx
mov r15d, 0x400
mov rcx, qword [0x1402c6140]
mov r8d, r15d
mov edx, 4
mov r12, r9
mov dil, 1
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
nop dword [rax]
mov byte [rsp + 0x50], dil
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], r12
xor r9d, r9d
mov byte [rsp + 0x40], r13b
xor r8d, r8d
mov dword [rsp + 0x38], ebx
xor edx, edx
mov dword [rsp + 0x30], r15d
mov rcx, r14
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
mov ebx, eax
cmp eax, 0x103
jne 0x140167bc8
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
mov ebx, eax
cmovns ebx, dword [rsp + 0x60]
cmp ebx, 0x80000005
je 0x140167bd8
cmp ebx, 0xc0000004
jne 0x140167c12
mov rcx, qword [0x1402c6140]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [0x1402c6140]
lea eax, [r15 + r15]
mov r8d, eax
mov edx, 4
mov r15d, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, dword [rsp + 0xa8]
jmp 0x140167b6a
cmp ebx, 0x80000006
je 0x140167c8e
test ebx, ebx
js 0x140167c90
lfence
mov r8, qword [rsp + 0xc8]
mov rdx, rsi
mov rax, qword [rsp + 0xc0]
mov rcx, r14
xor ebp, ebp
mov rdi, rsi
call qword [case.0x14013f76a.0]
test al, al
je 0x140167c90
nop word [rax + rax]
mov eax, dword [rdi]
test eax, eax
je 0x140167c7f
mov r8, qword [rsp + 0xc8]
add ebp, eax
mov rax, qword [rsp + 0xc0]
mov rcx, r14
mov edi, ebp
add rdi, rsi
mov rdx, rdi
call qword [case.0x14013f76a.0]
test al, al
jne 0x140167c50
jmp 0x140167c90
mov ebx, dword [rsp + 0xa8]
xor dil, dil
jmp 0x140167b70
xor ebx, ebx
mov rcx, qword [0x1402c6140]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140167ce0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rbp, r8
mov r14, rdx
mov rdi, rcx
mov edx, 4
mov rcx, qword [0x1402c6140]
mov r8d, 0x2000
mov bl, 1
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
xor r15d, r15d
mov byte [rsp + 0x50], bl
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], r15
xor r9d, r9d
mov byte [rsp + 0x40], r15b
xor r8d, r8d
mov dword [rsp + 0x38], 0x21
xor edx, edx
mov dword [rsp + 0x30], 0x2000
mov rcx, rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
mov ebx, eax
cmp eax, 0x103
jne 0x140167d7f
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
mov ebx, eax
cmovns ebx, dword [rsp + 0x60]
nop
cmp ebx, 0x80000006
je 0x140167dba
test ebx, ebx
js 0x140167dbd
lfence
mov r8, qword [rsp + 0x68]
mov r9, rbp
mov rdx, rsi
mov rcx, rdi
mov rax, r14
call qword [case.0x14013f76a.0]
mov ebx, eax
cmp eax, 0x80000006
je 0x140167dba
test eax, eax
js 0x140167dbd
xor bl, bl
jmp 0x140167d21
mov ebx, r15d
mov rcx, qword [0x1402c6140]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x140167e00
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rbp, r8
mov r14, rdx
mov rdi, rcx
mov edx, 4
mov rcx, qword [0x1402c6140]
mov r8d, 0x2400
mov bl, 1
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
xor r15d, r15d
mov byte [rsp + 0x50], bl
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], r15
xor r9d, r9d
mov byte [rsp + 0x40], r15b
xor r8d, r8d
mov dword [rsp + 0x38], 0x1d
xor edx, edx
mov dword [rsp + 0x30], 0x2400
mov rcx, rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
mov ebx, eax
cmp eax, 0x103
jne 0x140167e9f
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
mov ebx, eax
cmovns ebx, dword [rsp + 0x60]
nop
cmp ebx, 0x80000006
je 0x140167eda
test ebx, ebx
js 0x140167edd
lfence
mov r8, qword [rsp + 0x68]
mov r9, rbp
mov rdx, rsi
mov rcx, rdi
mov rax, r14
call qword [case.0x14013f76a.0]
mov ebx, eax
cmp eax, 0x80000006
je 0x140167eda
test eax, eax
js 0x140167edd
xor bl, bl
jmp 0x140167e41
mov ebx, r15d
mov rcx, qword [0x1402c6140]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x140167f10
Capabilities:
Get file attributes

Disassembly:
mov r8, rdx
mov edx, 0x16
jmp fcn.140163600
Function at 0x14016b500
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword ss:[rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov ebx, 0x100
mov r15, r8
mov ebp, edx
mov dword [rsp + 0x68], ebx
mov r14, rcx
mov r8d, ebx
mov rcx, qword [0x1402c6140]
mov edx, 4
mov esi, 0x10
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
nop dword [rax]
lea rax, [rsp + 0x68]
mov r9d, ebx
mov r8, rdi
mov qword [rsp + 0x20], rax
mov edx, ebp
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtQueryKey]
mov ebx, eax
test eax, eax
jns 0x14016b5c8
xor edx, edx
mov r8, rdi
cmp eax, 0x80000005
jne 0x14016b5b4
mov rcx, qword [0x1402c6140]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword ds:[rsp + 0x68]
mov edx, 4
mov rcx, qword [0x1402c6140]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
add esi, 0xffffffff
je 0x14016b5c8
mov ebx, dword [rsp + 0x68]
jmp 0x14016b550
lfence
mov rcx, qword [0x1402c6140]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14016b5cb
mov qword [r15], rdi
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14016b600
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword ss:[rsp + 0x20], rbp
push rsi
push r14
push r15
sub rsp, 0x40
mov r15, r9
mov ebp, r8d
mov r14, rcx
mov esi, 0x10
test rdx, rdx
je 0x14016b662
mov r10, qword [rdx]
test r10, r10
je 0x14016b662
mov word [rsp + 0x30], r10w
lea eax, [r10 + 2]
mov word [rsp + 0x32], ax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x38], rax
cmp r10, 0xfffe
jbe 0x14016b66a
mov eax, 0xc0000106
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rsi
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov rcx, qword [0x1402c6140]
mov edx, 4
mov qword [rsp + 0x60], rbx
mov ebx, 0x100
mov r8d, ebx
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x68], ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
nop word [rax + rax]
lea rax, ds:[rsp + 0x68]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov r8d, ebp
mov dword [rsp + 0x20], ebx
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, eax
test eax, eax
jns 0x14016b71d
xor edx, edx
mov r8, rdi
cmp eax, 0x80000005
jne 0x14016b70b
mov rcx, qword [0x1402c6140]
nop
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x68]
mov edx, 4
mov rcx, qword [0x1402c6140]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
add esi, 0xffffffff
je 0x14016b71d
mov ebx, dword [rsp + 0x68]
jmp 0x14016b6a0
lfence
mov rcx, qword [0x1402c6140]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14016b720
mov qword [r15], rdi
mov rdi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rsi
ret
Function at 0x14016b740
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x48
test rdx, rdx
je 0x14016b776
movzx eax, word [rdx]
mov word [rsp + 0x30], ax
add ax, 2
cmp qword [rdx], 0xfffe
mov word [rsp + 0x32], ax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x38], rax
jbe 0x14016b77e
mov eax, 0xc0000106
add rsp, 0x48
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov eax, dword [rsp + 0x70]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r9
mov r9d, r8d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtSetValueKey]
add rsp, 0x48
ret

Function at 0x14016b7b0
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x38
test rdx, rdx
je 0x14016b7e6
movzx eax, word [rdx]
mov word [rsp + 0x20], ax
add ax, 2
cmp qword [rdx], 0xfffe
mov word [rsp + 0x22], ax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x28], rax
jbe 0x14016b7ee
mov eax, 0xc0000106
add rsp, 0x38
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
add rsp, 0x38
ret

Function at 0x14016b800
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r12, r8
mov dword [rsp + 0x30], 0x100
mov r14d, edx
mov rbp, rcx
mov rcx, qword [0x1402c6140]
mov edx, 4
mov r8d, 0x100
mov r15, r9
xor esi, esi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, r14d
xor edx, edx
mov rdi, rax
mov rcx, rbp
lea rax, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntdll.dll_NtEnumerateKey]
mov ebx, eax
cmp eax, 0x8000001a
je 0x14016b93f
nop
cmp ebx, 0x80000005
je 0x14016b890
cmp ebx, 0xc0000023
jne 0x14016b8e8
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x30]
mov edx, 4
mov rcx, qword [0x1402c6140]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, r14d
mov edx, esi
mov rdi, rax
mov rcx, rbp
lea rax, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtEnumerateKey]
mov ebx, eax
test ebx, ebx
js 0x14016b941
lfence
mov r8, r15
mov rdx, rdi
mov rcx, rbp
mov rax, r12
call qword [case.0x14013f76a.0]
test al, al
je 0x14016b941
lfence
lea rax, [rsp + 0x30]
inc esi
mov qword [rsp + 0x28], rax
mov r9, rdi
mov eax, dword [rsp + 0x30]
mov r8d, r14d
mov edx, esi
mov dword [rsp + 0x20], eax
mov rcx, rbp
call qword [sym.imp.ntdll.dll_NtEnumerateKey]
mov ebx, eax
cmp eax, 0x8000001a
jne 0x14016b880
xor ebx, ebx
mov rcx, qword [0x1402c6140]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret