joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7fff25dcb880
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, rcx
mov edx, 2
mov rcx, 0xfffffffffffffffe
call sym.KERNELBASE.dll_SetThreadPriority
mov esi, ebx
btr ebx, 0x1f
mov dword [rsp + 0x28], ebx
cmp ebx, 1
jbe 0x7fff25e019e2
cmp ebx, 2
je 0x7fff25dcb8f1
cmp ebx, 3
je 0x7fff25e019d0
cmp ebx, 4
je 0x7fff25e019be
jbe 0x7fff25e019a8
cmp ebx, 6
ja 0x7fff25e019a8
lea rcx, [0x7fff25fd0fc0]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
nop dword [rax + rax]
and dword [rsp + 0x24], 0
test ebx, ebx
je 0x7fff25dcb949
mov edi, dword [0x7fff25fd0f90]
mov dword [rsp + 0x20], edi
test edi, edi
je 0x7fff25dcb97e
sub edi, 1
jne 0x7fff25dcb924
test esi, esi
js 0x7fff25dcb95e
mov rcx, qword [0x7fff25fd2508]
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.ntdll.dll_RtlDecodePointer]
nop dword [rax + rax]
mov ecx, ebx
call qword [case.0x7fff25dc97c1.0]
test eax, eax
jne 0x7fff25dcb968
jmp 0x7fff25dcb913
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x20]
test byte [rcx + 0x18], 1
jne 0x7fff25dcb97e
jmp 0x7fff25dcb90d
lea eax, [rbx - 5]
cmp eax, 1
jbe 0x7fff25dcb97e
jmp 0x7fff25dcb924
cmp ebx, 2
jb 0x7fff25dcb97e
cmp ebx, 3
jbe 0x7fff25dcb97a
lea eax, [rbx - 5]
cmp eax, 1
ja 0x7fff25dcb97e
mov dword [rsp + 0x24], ebx
jmp 0x7fff25e01abb
mov eax, 0xff35c010
invalid
rol bl, 1
jae 0x7fff25e01956
invalid
mov cl, 0xf9
lodsd eax, dword [rsi]
outsd dx, dword [rsi]
mov ebp, 0x324c39e5
cli
invalid
add ch, byte [rdi + 0x26760e31]
and al, 0xfd
sub al, byte [rax + 0x28]
fistp word [rdx + 0x580c8e50]
scasb al, byte [rdi]
add dword [ecx - 0x14], ebp
popfq
invalid
pop rcx
sal byte [rdi + 0x330dd871], cl
jo 0x7fff25e01ab3
cwde
sbb byte [rcx - 0x18], bl
sbb ecx, ebp
nop
je 0x7fff25e01acf
or ch, byte [rcx]
movsb byte [rdi], byte [rsi]
invalid
sbb esp, dword [rax - 0x35]
pushfq
and eax, esi
iretd
test al, 0xf
mov edx, 0xca22c0ac
lodsb al, byte [rsi]
shl byte [rdx], 0xca
mov al, 0x2d
invalid
sub eax, 0x14137f1e
jp 0x7fff25e01a69
jg 0x7fff25e01aa5
push rcx
mov esi, 0x77d6ef46
pushfq
xor ecx, dword [rbp + 0x19e4d6e8]
in eax, 0xe6
push rsi
js 0x7fff25e01ab6
invalid
xlatb
and al, 0xed
pop rbp
xchg esi, eax
dec dword [rax]
lahf
out dx, al
invalid
Function at 0x7fff25dce190
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
lea rdx, str.Network_ComputerName
lea rcx, [rbp - 9]
mov qword [rbp + 0x7f], r14
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea rdx, str.RegistryMachineSystemCurrentControlSetControlComputerNameActiveComputerName
lea rcx, [rbp - 0x19]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea rax, [rbp - 0x19]
mov dword [rbp + 0x17], 0x30
mov qword [rbp + 0x27], rax
lea r8, [rbp + 0x17]
lea rax, [rbp + 0x77]
mov qword [rbp + 0x1f], r14
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x7f]
lea rax, [rbp - 9]
mov dword [rsp + 0x28], 1
xorps xmm0, xmm0
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov dword [rbp + 0x2f], 0x40
mov edx, 0x2001f
movdqu xmmword [rbp + 0x37], xmm0
call qword [sym.imp.ntdll.dll_NtCreateKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25dce2a1
cmp dword [rbp + 0x77], 2
je 0x7fff25e02648
lea rdx, [0x7fff25f0af88]
lea rcx, [rbp + 7]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], r14w
jne 0x7fff25dce268
mov rcx, qword [rbp + 0x7f]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [rbp + 7]
mov r9d, 1
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtSetValueKey]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x7fff25dce2b6
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov r9, rdi
mov qword [rsp + 0x20], rsi
lea r8, [0x7fff25f0af88]
xor ecx, ecx
lea rdx, str.RegistryMachineSystemCurrentControlSetControlComputerNameActiveComputerName
call fcn.7fff25d72c80
cmp eax, 0xc0000034
jne 0x7fff25dce24d
lea ebx, [rax - 0x33]
jmp 0x7fff25dce2a1
Function at 0x7fff25dce3b0
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov r14, rcx
mov edi, ebx
mov esi, ebx
test rcx, rcx
je 0x7fff25e02886
lea r9, [rax + 8]
xor r8d, r8d
xor edx, edx
mov ecx, 0x9d
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
jns 0x7fff25e028d1
cmp eax, 0xc0000004
jne 0x7fff25e028bc
mov rcx, qword gs:[0x60]
mov r8d, dword [rsp + 0x30]
mov edx, dword [0x7fff25fd0c80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x7fff25e028a0
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 0x9d
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x7fff25e028a7
mov eax, dword [rsi]
and eax, 1
mov dword [r14], eax
test rsi, rsi
je 0x7fff25dce485
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test edi, edi
jne 0x7fff25e0288b
mov rsi, qword [rsp + 0x40]
sete bl
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
mov edi, 0x57
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
test edi, edi
jmp 0x7fff25dce48d
mov edi, 8
jmp 0x7fff25e0288b
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov edi, eax
jmp 0x7fff25dce462
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov edi, eax
jmp 0x7fff25dce485
mov edi, 0xd
jmp 0x7fff25dce462

Function at 0x7fff25dce970
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x540
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call sub.ntdll.dll_RtlCaptureContext
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call sub.ntdll.dll_RtlLookupFunctionEntry
test rax, rax
je 0x7fff25dce9ea
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x7fff25dcea0a
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call sub.ntdll.dll_DbgPrint
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0x540
pop rbx
ret
Function at 0x7fff25e04f20
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
test edx, edx
jne 0x7fff25e04f6b
and dword [rbp - 0x18], edx
lea r9d, [rdx + 0x28]
lea rdx, [rbp - 0x48]
mov dword [rsp + 0x20], 4
lea r8, [rbp - 0x38]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov edx, dword [rbp - 0x18]
test dl, 1
je 0x7fff25e04fab
xor eax, eax
mov dword [rsp + 0x20], 4
xorps xmm0, xmm0
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x38]
mov dword [rbp - 0x18], 0x80
lea rdx, [rbp - 0x48]
mov rcx, rbx
lea r9d, [rax + 0x28]
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov r9d, 1
mov byte [rbp - 0x50], 1
lea r8, [rbp - 0x50]
mov dword [rsp + 0x20], 0xd
lea rdx, [rbp - 0x48]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.7fff25dce640
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rbp
ret

Function at 0x7fff25e0ec20
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and qword [rsp + 0x48], 0
mov rdi, rcx
lea rcx, [rsp + 0x48]
mov edx, 0x2001f
call fcn.7fff25d72aac
test eax, eax
jne 0x7fff25e0ec4a
xor eax, eax
jmp 0x7fff25e0ec9f
mov rbx, qword [rsp + 0x48]
lea rcx, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test ebx, ebx
jns 0x7fff25e0ec9a
mov ecx, 0xc
call sub.ntdll.dll_RtlSetLastWin32Error
jmp 0x7fff25e0ec46
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x7fff25e0fa64
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x30
and qword [rsp + 0x40], 0
lea rcx, [rsp + 0x40]
mov edx, 0x2001f
call fcn.7fff25d72aac
test eax, eax
je 0x7fff25e0fcc1
mov rbx, qword [rsp + 0x40]
lea rdx, [0x7fff25f9d010]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
nop dword [rax + rax]
xor edx, edx
xor ecx, ecx
call sym.KERNELBASE.dll_GetNamedLocaleHashNode
mov rbx, rax
test rax, rax
je 0x7fff25e0fc6d
mov edx, 0x1009
mov rcx, rax
call fcn.7fff25e0fcd0
mov edx, 0x28
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x29
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x1003
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x1f
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x20
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x1006
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x14
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x1b
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x1c
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x19
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0xe
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x16
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0xf
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x17
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0xc
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x11
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x12
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x1010
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x13
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x1014
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0xd
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x100c
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x100d
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x10
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x18
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x50
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x51
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x100a
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x79
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x40000003
mov rcx, rbx
call fcn.7fff25e0fcd0
mov edx, 0x40000005
mov rcx, rbx
call fcn.7fff25e0fcd0
mov rbx, qword [rsp + 0x40]
lea rdx, str.sCountry
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
call fcn.7fff25d617c0
mov rcx, rax
call fcn.7fff25e1a4ac
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x7fff25e0fcd0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x110
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x100], rax
lea eax, [rdx - 0x1f]
mov ebx, edx
mov rdi, rcx
cmp eax, 1
jbe 0x7fff25e0fd04
cmp edx, 0x1006
jne 0x7fff25e0fd74
mov rax, qword [rcx + 0x20]
mov ecx, dword [rax + 0x7c]
mov rax, qword [rdi + 0x28]
inc ecx
movzx edx, word [rax + rcx*2]
cmp edx, 1
je 0x7fff25e0fd74
mov eax, ebx
sub eax, 0x1f
je 0x7fff25e0fd44
sub eax, 1
je 0x7fff25e0fd3c
cmp eax, 0xfe6
jne 0x7fff25e0fd35
mov r9d, 0x2f
jmp 0x7fff25e0fd4a
mov r9d, dword [rsp + 0x40]
jmp 0x7fff25e0fd4a
mov r9d, 6
jmp 0x7fff25e0fd4a
mov r9d, 5
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 0x50
bts r9d, 0x1f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
call fcn.7fff25d5cd30
jmp 0x7fff25e0fd8d
mov edx, ebx
lea r8, [rsp + 0x60]
bts edx, 0x1f
mov r9d, 0x50
mov rcx, rdi
call sym.KERNELBASE.dll_GetLocaleInfoHelper
test eax, eax
je 0x7fff25e0fea5
lea r8, [rsp + 0x60]
mov edx, ebx
mov rcx, rdi
call fcn.7fff25e10678
test eax, eax
jne 0x7fff25e0fea5
cmp ebx, 0x17
ja 0x7fff25e0fe06
je 0x7fff25e0fdfd
sub ebx, 0xe
je 0x7fff25e0fdf4
sub ebx, 1
je 0x7fff25e0fdeb
sub ebx, 1
je 0x7fff25e0fde2
sub ebx, 4
je 0x7fff25e0fdd9
cmp ebx, 2
jne 0x7fff25e0fea5
lea rdi, str.sMonDecimalSep
jmp 0x7fff25e0fe4e
lea rdi, str.sCurrency
jmp 0x7fff25e0fe4e
lea rdi, str.sGrouping
jmp 0x7fff25e0fe4e
lea rdi, str.sThousand
jmp 0x7fff25e0fe4e
lea rdi, str.sDecimal
jmp 0x7fff25e0fe4e
lea rdi, str.sMonThousandSep
jmp 0x7fff25e0fe4e
sub ebx, 0x18
je 0x7fff25e0fe47
sub ebx, 0x10
je 0x7fff25e0fe3e
sub ebx, 1
je 0x7fff25e0fe35
sub ebx, 0x27
je 0x7fff25e0fe2c
cmp ebx, 1
jne 0x7fff25e0fea5
lea rdi, str.sNegativeSign
jmp 0x7fff25e0fe4e
lea rdi, str.sPositiveSign
jmp 0x7fff25e0fe4e
lea rdi, str.s2359
jmp 0x7fff25e0fe4e
lea rdi, str.s1159
jmp 0x7fff25e0fe4e
lea rdi, str.sMonGrouping
and qword [rsp + 0x40], 0
lea rcx, [rsp + 0x40]
mov edx, 0x2001f
call fcn.7fff25d72aac
test eax, eax
je 0x7fff25e0fea5
mov rbx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov rdx, rdi
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.7fff25dce640
mov rbx, qword [rsp + 0x130]
add rsp, 0x110
pop rdi
ret
Function at 0x7fff25e1d64c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, qword [rsp + 0x68]
mov rbx, r8
mov r9, r8
mov qword [rsp + 0x28], rdi
mov r8d, 2
mov dword [rsp + 0x20], 0xb6
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
xor r9d, r9d
test eax, eax
js 0x7fff25e1d6bc
cmp dword [rbx + 4], 1
lea r8, [rbx + 0xc]
mov rax, qword [rsp + 0x60]
mov qword [rax], r8
jne 0x7fff25e1d6bc
mov ecx, dword [rdi]
test cl, 1
jne 0x7fff25e1d6bc
cmp ecx, 0xe
jbe 0x7fff25e1d6bc
add ecx, 0xfffffff4
shr ecx, 1
dec ecx
mov dword [rdi], ecx
cmp word [r8 + rcx*2], r9w
sete r9b
mov eax, r9d
jmp 0x7fff25e1d6be
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x7fff25e23380
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rbp - 8], rax
mov ebx, 0x1000
mov r15, rdx
mov edx, ebx
mov r14, rcx
jmp 0x7fff25e233f3
lea r9, [rbp - 0x30]
mov r8d, ebx
mov rdx, rdi
mov ecx, 0x12
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jns 0x7fff25e23448
mov rcx, rdi
call sym.KERNELBASE.dll_LocalFree
cmp esi, 0xc0000004
jne 0x7fff25e23444
cmp dword [rbp - 0x30], ebx
jbe 0x7fff25e233eb
mov ebx, dword [rbp - 0x30]
jmp 0x7fff25e233f1
add ebx, 0x1000
mov edx, ebx
xor ecx, ecx
call sym.KERNELBASE.dll_LocalAlloc
mov rdi, rax
test rax, rax
jne 0x7fff25e233b0
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.7fff25dce640
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, esi
jmp 0x7fff25e23407
cmp dword [rbp - 0x30], 0x20
mov rbx, rdi
jbe 0x7fff25e234c0
and dword [rbp - 0x24], 0
mov edx, 0x3a
mov dword [rbp - 0x28], 0x20
mov eax, dword [rbx + 4]
mov qword [rbp - 0x20], rax
mov eax, dword [rbx + 8]
mov qword [rbp - 0x18], rax
mov eax, dword [rbx + 0xc]
mov qword [rbp - 0x10], rax
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.ntdll.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x7fff25e234a5
cmp rax, qword [rbx + 0x18]
jbe 0x7fff25e234a5
lea r8, [rax - 2]
mov rcx, r15
mov rax, r14
lea rdx, [rbp - 0x28]
call qword [case.0x7fff25dc97c1.0]
cmp dword [rbx], 0
je 0x7fff25e234c0
mov ecx, dword [rbp - 0x30]
cmp dword [rbx], ecx
ja 0x7fff25e234c0
sub ecx, dword [rbx]
mov dword [rbp - 0x30], ecx
mov eax, dword [rbx]
add rbx, rax
cmp ecx, 0x20
ja 0x7fff25e23451
mov rcx, rdi
call sym.KERNELBASE.dll_LocalFree
mov eax, 1
jmp 0x7fff25e23423
Function at 0x7fff25e3a6d0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push rbp
mov rbp, rsp
sub rsp, 0x70
and qword [rax - 0x48], 0
lea r8, [rbp - 0x30]
and dword [rax - 0x50], 0
mov rdi, rdx
and qword [rax - 0x58], 0
xorps xmm0, xmm0
and dword [rbp - 0x2c], 0
mov edx, 0x20106
and dword [rbp - 0x14], 0
xor r9d, r9d
and qword [rbp + 0x10], 0
and qword [rbp - 0x28], 0
mov qword [rbp - 0x20], rcx
lea rcx, [rbp + 0x10]
movdqu xmmword [rbp - 0x10], xmm0
mov dword [rbp - 0x30], 0x30
mov dword [rbp - 0x18], 0x240
call qword [sym.imp.ntdll.dll_ZwCreateKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25e3a782
mov rcx, qword [rbp + 0x10]
lea rax, [rbp + 0x20]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_ZwSetValueKey]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x10]
mov ebx, eax
call qword [sym.imp.ntdll.dll_ZwClose]
nop dword [rax + rax]
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x7fff25e45960
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r9d, r9d
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0x40]
lea ecx, [r9 + 0x51]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x7fff25e459dd
mov eax, dword [0x7fff25fd0de8]
imul rax, qword [rsp + 0x38]
mov edx, dword [rsp + 0x5c]
mov r8d, edx
mov qword [rbx], rax
and r8d, 4
mov eax, dword [0x7fff25fd0de8]
mov ecx, r8d
imul rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov eax, 1
or ecx, eax
and dl, al
cmove ecx, r8d
mov dword [rsi], ecx
jmp 0x7fff25e459e6
mov ecx, eax
call fcn.7fff25d6b370
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x7fff25e46ed0
Capabilities:
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, qword [rbp + 0x60]
mov rbx, r9
mov r15, qword [rbp + 0x68]
mov r14, r8
mov r12, rdx
mov rsi, rcx
test rdx, rdx
je 0x7fff25e46f58
mov r9d, 8
mov dword [rsp + 0x20], 0x17
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x50]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
jns 0x7fff25e46f40
mov ecx, eax
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25e47029
mov eax, dword [rbp - 0x40]
xor edx, edx
cmp dword [rbp - 0x3c], edx
setne dl
neg eax
sbb ecx, ecx
and ecx, 2
or ecx, edx
mov dword [r12], ecx
test r14, r14
je 0x7fff25e46f96
mov r9d, 0x28
mov dword [rsp + 0x20], 0x18
lea r8, [rbp - 0x30]
mov rcx, rsi
lea rdx, [rbp - 0x50]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25e46f32
mov eax, dword [rbp - 0x24]
mov ecx, 0xff
cmp eax, ecx
cmovae eax, ecx
mov dword [r14], eax
test rbx, rbx
jne 0x7fff25e46fa0
test rdi, rdi
je 0x7fff25e47007
mov r9d, 0x10
mov dword [rsp + 0x20], 0x19
lea r8, [rbp - 0x40]
mov rcx, rsi
lea rdx, [rbp - 0x50]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25e46f32
test rbx, rbx
je 0x7fff25e46fd7
mov eax, dword [rbp - 0x38]
mov dword [rbx], eax
test rdi, rdi
je 0x7fff25e47007
mov rcx, qword [rbp - 0x40]
movabs rax, 0x346dc5d63886594b
neg rcx
mul rcx
mov ecx, 0xfffffffe
shr rdx, 0xb
mov rax, rdx
shr rax, 0x20
adc eax, 0x1011b6d0
movzx eax, al
test eax, eax
jne 0x7fff25e47053
rol byte [rbp - 0x72b88a40], 0x4d
fdivr st(7)
adc eax, 0x1011b670
lea ecx, [rbp - 0x28]
call qword [0x7fff35f62685]
cmp eax, 0x17
jne 0x7fff25e47053
push 0x75
mov ecx, dword [rbp + 8]
call 0x7fff25dfd090
mov ecx, dword [rbp - 0x88]
or ecx, 1
mov dword [rbp - 0x88], ecx
mov byte [rbp - 4], 1
lea ecx, [rbp - 0x28]
call fcn.7fff25dfd160
mov byte [rbp - 4], 0
lea ecx, [rbp - 0x18]
call fcn.7fff25dfd160
mov eax, dword [rbp + 8]
invalid
invalid
inc dword [rbx - 0x7276fe37]
js 0x7fff25e47030
invalid
invalid

Function at 0x7fff25e4bbc0
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x58
cmp r8d, 0x20
jae 0x7fff25e4bbdf
mov ecx, 0x57
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor eax, eax
jmp 0x7fff25e4bc1f
mov qword [rsp + 0x30], rdx
mov r9d, 0x10
mov dword [rsp + 0x38], r8d
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x30]
mov dword [rsp + 0x20], 0x2a
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
jns 0x7fff25e4bc1a
mov ecx, eax
call fcn.7fff25d6b370
jmp 0x7fff25e4bbdb
mov eax, 1
add rsp, 0x58
ret
Function at 0x7fff25e4c2f0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], r9
sub rsp, 0x38
and dword [r8], 0
cmp dword [rsp + 0x60], 0
je 0x7fff25e4c317
mov ecx, 0x57
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x7fff25e4c351
mov qword [rsp + 0x28], r8
mov r9, rcx
mov dword [rsp + 0x20], edx
mov r8d, 8
lea rdx, [rsp + 0x58]
mov ecx, 0xaf
call qword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
nop dword [rax + rax]
test eax, eax
js 0x7fff25e4c34a
mov eax, 1
jmp 0x7fff25e4c353
mov ecx, eax
call fcn.7fff25d6b370
xor eax, eax
add rsp, 0x38
ret

Function at 0x7fff25e4c3c0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
test ecx, ecx
jne 0x7fff25e4c3f7
lea r8d, [rcx + 4]
xor r9d, r9d
mov ecx, 0xdd
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x7fff25e4c3f7
test byte [rsp + 0x30], 2
je 0x7fff25e4c3f7
mov eax, 1
jmp 0x7fff25e4c3f9
xor eax, eax
add rsp, 0x28
ret