joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ecd0
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14001ef0e
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x140069040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x140059dd0]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x14001eed6
mov rcx, rbp
call fcn.14001dfa0
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x14001eda1
movsxd rdx, dword [rbp + 0x31c0]
mov r8, qword [rbp + 0x31c8]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x14001ed91
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x14001ed89
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x14001ed8c
mov rdx, rcx
test rdx, rdx
jne 0x14001ed60
cmp r8, r10
je 0x14001eda1
cmp dword [r8], r9d
jne 0x14001eda1
mov rcx, qword [r8 + 8]
jmp 0x14001eda3
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb8]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x14001ee37
cmp qword [rcx + 0x18], 0
jne 0x14001ee2c
mov qword [rcx + 0x18], rbx
jmp 0x14001ee37
cmp qword [rcx + 0x20], 0
jne 0x14001ee37
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xb0], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14001ee6c
nop
mov r9, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14001ee60
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.140002ce0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x14001eec8
cmp r9b, 0x23
jne 0x14001eeab
cmp byte [r8], r9b
jne 0x14001eeab
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x14001ee98
not ecx
call fcn.14000bb00
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x14001ed20
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400512f0
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x140051fd4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005201e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005201e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005201e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005201e
cmp dword [rcx + 0x84], 0xe
jbe 0x14005201e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140052020
xor al, al
add rsp, 0x28
ret
Function at 0x124c4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
and qword [rsp + 0x60], 0
cmp dword [rcx + 0x86a14], 0
mov rdi, rcx
mov ebx, 0xc0000001
jne 0x1254b
mov dword [rcx + 0x86a14], 1
call fcn.00044b64
lea rcx, [0x00092580]
call fcn.0004505c
lea rax, [0x0001172c]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rcx, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov ecx, eax
mov ebx, eax
mov eax, 0xc0000000
and ecx, eax
cmp ecx, eax
jne 0x1254b
lea rcx, [0x000925a0]
mov edx, ebx
call fcn.0004505c
lea rcx, [0x000925e0]
call fcn.0004505c
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x160cc
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
mov byte [rsp + 0x10], dl
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor ebp, ebp
xor ebx, ebx
mov esi, 0xc0000001
test rcx, rcx
je 0x1628b
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1628b
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x1628b
mov edx, 0x20b
lea r12d, [rbp + 1]
cmp word [rax + 0x18], dx
jne 0x1612b
mov r14b, r12b
jmp 0x1613d
mov edx, 0x10b
cmp word [rax + 0x18], dx
jne 0x1628b
xor r14b, r14b
mov edx, dword [rax + 0x28]
mov eax, edx
add rax, rcx
je 0x1628b
lea rcx, [rsp + 0x70]
xor r15b, r15b
xor edi, edi
xor r13d, r13d
test rcx, rcx
je 0x161d5
and qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rdi, rax
test rax, rax
je 0x161d5
mov r8d, r12d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmProbeAndLockPages]
xor r9d, r9d
mov r8d, r12d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x28], 0x40000010
and dword [rsp + 0x20], ebx
mov r15b, r12b
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPagesSpecifyCache]
mov r13, rax
test rax, rax
je 0x161d5
mov edx, 4
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmProtectMdlSystemAddress]
mov ecx, 0xc0000000
mov esi, eax
and eax, ecx
cmp eax, ecx
je 0x161d5
mov rbp, rdi
mov rbx, r13
mov r12d, esi
shr r12d, 0x1e
cmp r12d, 3
jne 0x16215
test rdi, rdi
je 0x1620f
test r13, r13
je 0x161f8
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
test r15b, r15b
je 0x16206
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
cmp r12d, 3
je 0x1628b
cmp byte [rsp + 0x78], 0
je 0x1623f
test r14b, r14b
je 0x16233
mov byte [rbx], 0xb8
mov eax, 0xffffc300
mov word [rbx + 4], ax
mov byte [rbx + 2], 0
jmp 0x16266
movabs rax, 0x8c200000000b8
jmp 0x16263
test r14b, r14b
je 0x16259
mov eax, 0x22b8
mov word [rbx], ax
mov dword [rbx + 4], 0xc3c0
mov byte [rbx + 6], 0
jmp 0x16266
movabs rax, 0x8c2c0000022b8
mov qword [rbx], rax
test rbp, rbp
je 0x16289
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_MmUnlockPages]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
xor esi, esi
mov eax, esi
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x177fc
Capabilities:
Install driver
Persist via windows service
Query or enumerate registry key
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x520
mov rax, qword [0x000a7100]
xor rax, rsp
mov qword [rsp + 0x510], rax
mov rbx, rcx
mov rdi, rdx
mov esi, 0x258
lea rcx, [r11 - 0x288]
xor edx, edx
mov r8, rsi
call fcn.00091d10
mov r9, rdi
lea r11, [rsp + 0x550]
mov edi, 0x12c
lea rcx, [rsp + 0x2b0]
mov r8, rsi
mov rdx, rdi
mov qword [rsp + 0x20], r11
call sub.ntoskrnl.exe__vsnwprintf_s
lea rcx, [rsp + 0x50]
mov r8, rsi
xor edx, edx
call fcn.00091d10
lea r8, [0x00093320]
lea rcx, [rsp + 0x50]
mov r9, rbx
mov rdx, rdi
call fcn.00014458
mov ebx, 1
lea rdx, [rsp + 0x50]
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_RtlCheckRegistryKey]
mov edi, 0xc0000000
and eax, edi
cmp eax, edi
jne 0x178c7
lea rdx, [rsp + 0x50]
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov ecx, eax
and ecx, edi
cmp ecx, edi
je 0x179a9
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x2b0]
repne scasw ax, word [rdi]
lea r9d, [rax + 2]
lea rax, [rsp + 0x2b0]
not rcx
lea r8, [0x000926e0]
lea rdx, [rsp + 0x50]
sub rcx, rbx
add ecx, r9d
mov dword [rsp + 0x28], ecx
mov ecx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_RtlWriteRegistryValue]
mov edi, 4
lea rax, [rsp + 0x30]
lea r8, [0x00093390]
lea rdx, [rsp + 0x50]
mov r9d, edi
mov ecx, ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_RtlWriteRegistryValue]
lea rax, [rsp + 0x30]
lea r8, [0x000933b0]
lea rdx, [rsp + 0x50]
mov r9d, edi
mov ecx, ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_RtlWriteRegistryValue]
lea rax, [rsp + 0x30]
lea r8, [0x000933c0]
lea rdx, [rsp + 0x50]
mov r9d, edi
mov ecx, ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x30], 3
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_RtlWriteRegistryValue]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwLoadDriver]
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.000916b0
add rsp, 0x520
pop rdi
pop rsi
pop rbx
ret
Function at 0x185f8
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x000a7100]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov bpl, r9b
mov r9, rdx
mov rsi, r8
mov rbx, rcx
or rdi, 0xffffffffffffffff
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 0x40
mov byte [rsp + 0x38], 0x6a
mov byte [rsp + 0x39], 1
mov byte [rsp + 0x3a], 0x68
mov byte [rsp + 0x3b], al
mov byte [rsp + 0x3c], al
mov byte [rsp + 0x3d], al
mov byte [rsp + 0x3e], al
mov byte [rsp + 0x3f], 0xe8
mov byte [rsp + 0x40], al
mov byte [rsp + 0x41], al
mov byte [rsp + 0x42], al
mov byte [rsp + 0x43], al
mov byte [rsp + 0x44], 0x33
mov byte [rsp + 0x45], 0xc0
mov byte [rsp + 0x46], 0xc3
mov byte [rsp + 0x47], 0x90
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov edx, 0xc0000000
and eax, edx
cmp eax, edx
je 0x186f9
mov rcx, rdi
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
mov rdx, rsi
not rcx
lea r8, [rcx - 1]
mov rcx, qword [rsp + 0x30]
add rcx, 0x20
call fcn.00091720
mov rax, qword [rsp + 0x30]
movdqu xmm5, xmmword [rsp + 0x38]
movdqu xmmword [rax], xmm5
mov rax, qword [rsp + 0x30]
mov byte [rax + 1], bpl
mov rcx, qword [rsp + 0x30]
lea eax, [rcx + 0x20]
mov dword [rcx + 3], eax
mov rax, qword [rsp + 0x30]
sub ebx, eax
sub ebx, 0xc
mov dword [rax + 8], ebx
mov rax, qword [rsp + 0x30]
mov byte [rax + 0x10], 0x90
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.000916b0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x18720
Capabilities:
Allocate or change rwx memory

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x000a7100]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov dil, r9b
mov r9, rdx
mov rbx, r8
mov rsi, rcx
lea rdx, [r11 - 0x48]
xor r8d, r8d
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x28], 0x40
mov byte [rsp + 0x38], 0x48
mov byte [rsp + 0x39], 0x83
mov byte [rsp + 0x3a], 0xec
mov byte [rsp + 0x3b], 0x28
mov byte [rsp + 0x3c], 0xba
mov byte [rsp + 0x3d], 1
mov byte [rsp + 0x3e], al
mov byte [rsp + 0x3f], al
mov byte [rsp + 0x40], al
mov byte [rsp + 0x41], 0x48
mov byte [rsp + 0x42], 0x8d
mov byte [rsp + 0x43], 0xd
mov byte [rsp + 0x44], 0x13
mov byte [rsp + 0x45], al
mov byte [rsp + 0x46], al
mov byte [rsp + 0x47], al
mov byte [rsp + 0x48], 0x48
mov byte [rsp + 0x49], 0xb8
mov byte [rsp + 0x4a], al
mov byte [rsp + 0x4b], al
mov byte [rsp + 0x4c], al
mov byte [rsp + 0x4d], al
mov byte [rsp + 0x4e], al
mov byte [rsp + 0x4f], al
mov byte [rsp + 0x50], al
mov byte [rsp + 0x51], al
mov byte [rsp + 0x52], 0xff
mov byte [rsp + 0x53], 0xd0
mov byte [rsp + 0x54], 0x48
mov byte [rsp + 0x55], 0x83
mov byte [rsp + 0x56], 0xc4
mov byte [rsp + 0x57], 0x28
mov byte [rsp + 0x58], 0xc3
mov byte [rsp + 0x59], 0x90
mov byte [rsp + 0x5a], al
mov qword [r11 - 0x48], rax
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov edx, 0xc0000000
and eax, edx
cmp eax, edx
je 0x18867
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov r8d, 0x23
call fcn.00091720
mov rax, qword [rsp + 0x30]
or rcx, 0xffffffffffffffff
mov byte [rax + 5], dil
mov rax, qword [rsp + 0x30]
mov rdi, rbx
mov qword [rax + 0x12], rsi
xor eax, eax
mov rdx, rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, qword [rsp + 0x30]
add rcx, 0x23
call fcn.00091720
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.000916b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x19cc4
Capabilities:
Allocate or change rwx memory

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x000a7100]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov r9, rdx
mov rsi, r8
mov rbx, rcx
or rdi, 0xffffffffffffffff
lea rdx, [r11 - 0x48]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 0x40
mov byte [rsp + 0x38], 0x68
mov byte [rsp + 0x39], al
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x3b], al
mov byte [rsp + 0x3c], al
mov byte [rsp + 0x3d], 0x68
mov byte [rsp + 0x3e], al
mov byte [rsp + 0x3f], al
mov byte [rsp + 0x40], al
mov byte [rsp + 0x41], al
mov byte [rsp + 0x42], 0x6a
mov byte [rsp + 0x43], al
mov byte [rsp + 0x44], 0x6a
mov byte [rsp + 0x45], al
mov byte [rsp + 0x46], 0xe8
mov byte [rsp + 0x47], al
mov byte [rsp + 0x48], al
mov byte [rsp + 0x49], al
mov byte [rsp + 0x4a], al
mov byte [rsp + 0x4b], 0xba
mov byte [rsp + 0x4c], al
mov byte [rsp + 0x4d], al
mov byte [rsp + 0x4e], al
mov byte [rsp + 0x4f], al
mov byte [rsp + 0x50], 0xc7
mov byte [rsp + 0x51], 2
mov byte [rsp + 0x52], 0x7e
mov byte [rsp + 0x53], 0x1e
mov byte [rsp + 0x54], 0x37
mov byte [rsp + 0x55], 0xc0
mov byte [rsp + 0x56], 0xba
mov byte [rsp + 0x57], al
mov byte [rsp + 0x58], al
mov byte [rsp + 0x59], al
mov byte [rsp + 0x5a], al
mov byte [rsp + 0x5b], 0x89
mov byte [rsp + 0x5c], 2
mov byte [rsp + 0x5d], 0xc2
mov byte [rsp + 0x5e], 4
mov byte [rsp + 0x5f], al
mov qword [r11 - 0x48], rax
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov edx, 0xc0000000
and eax, edx
cmp eax, edx
je 0x19e8b
xor eax, eax
mov rcx, rdi
mov rdi, rsi
repne scasw ax, word [rdi]
mov rax, qword [rsp + 0x30]
not rcx
lea rdx, [rcx - 1]
mov ecx, 0x3d0
add dx, dx
mov word [rax + 0x200], dx
mov rax, qword [rsp + 0x30]
movzx r8d, dx
mov word [rax + 0x202], cx
mov rcx, qword [rsp + 0x30]
mov rdx, rsi
lea eax, [rcx + 0x210]
mov dword [rcx + 0x204], eax
mov rcx, qword [rsp + 0x30]
add rcx, 0x210
call fcn.00091720
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov r8d, 0x28
call fcn.00091720
mov rdx, qword [rsp + 0x30]
lea eax, [rdx + 0x5e0]
mov dword [rdx + 1], eax
mov rcx, qword [rsp + 0x30]
lea eax, [rcx + 0x200]
mov dword [rcx + 6], eax
mov rax, qword [rsp + 0x30]
sub ebx, eax
sub ebx, 0x13
mov dword [rax + 0xf], ebx
mov rcx, qword [rsp + 0x30]
lea eax, [rcx + 0x5e8]
mov dword [rcx + 0x14], eax
mov rcx, qword [rsp + 0x30]
lea eax, [rcx + 0x5ec]
mov dword [rcx + 0x1f], eax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.000916b0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1a13c
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x80
and qword [rax - 0x70], 0
mov r12, rdx
lea rdx, [rax + 0x20]
mov rsi, rcx
mov dword [rax - 0x78], 0xc0000001
mov qword [rax - 0x68], 0x1000
mov byte [rax + 0x20], 0
call fcn.00035e20
mov r15d, 0xc0000000
mov r8d, eax
mov ebx, eax
and r8d, r15d
cmp r8d, r15d
je 0x1a2e4
cmp byte [rsp + 0xc8], 0
je 0x1a2e4
lea rdx, [rsp + 0x38]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
and eax, r15d
cmp eax, r15d
jne 0x1a1d1
lea rcx, [0x00093400]
mov r8d, ebx
mov rdx, rsi
call fcn.0004505c
jmp 0x1a2f3
mov rcx, qword [rsp + 0x38]
call sub.ntoskrnl.exe_PsGetProcessPeb
mov rcx, qword [rsp + 0x38]
mov r13, rax
call sub.ntoskrnl.exe_PsGetProcessWow64Process
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov rbp, rax
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov qword [rsp + 0x48], 0xffffffffff676980
xor edi, edi
lea rdx, [0x00093840]
mov r8, rbp
mov rcx, r13
call fcn.0002dd18
test rax, rax
jne 0x1a249
lea r8, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_KeDelayExecutionThread]
inc edi
cmp edi, 0x64
jb 0x1a206
lea rcx, [0x00093860]
call fcn.0004505c
mov ebx, 0xc0000225
jmp 0x1a2d7
lea rdx, [0x00093880]
mov r8b, 1
mov rcx, rax
call fcn.0002d5d4
test rax, rax
jne 0x1a269
lea rcx, [0x00093890]
jmp 0x1a23a
mov r8, r12
lea rdx, [rsp + 0x40]
mov rcx, rax
test rbp, rbp
je 0x1a280
call fcn.00019cc4
jmp 0x1a285
call fcn.00019eb8
mov rdi, rax
test rax, rax
jne 0x1a29b
lea rcx, [0x000934e0]
call fcn.0004505c
jmp 0x1a2d7
lea rax, [rsp + 0x30]
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rdi
mov rcx, rsi
mov byte [rsp + 0x20], 1
call fcn.0001842c
mov ebx, eax
and eax, r15d
cmp eax, r15d
jne 0x1a2d7
lea rcx, [0x00093500]
mov rdx, rdi
call fcn.0004505c
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x1a2f3
lea rcx, [0x00093810]
mov rdx, rsi
call fcn.0004505c
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1a303
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1a328
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and qword [rax + 0x20], 0
mov ebx, ecx
mov rsi, r9
mov rbp, rdx
mov edi, r8d
mov dword [rax - 0x20], 0x40
lea r9, [rax - 0x18]
lea rdx, [rax + 0x20]
or rcx, 0xffffffffffffffff
xor r8d, r8d
mov qword [rax - 0x18], rbx
mov dword [rax - 0x28], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov ecx, 0xc0000000
and eax, ecx
cmp eax, ecx
je 0x1a3d5
mov rcx, qword [rsp + 0x68]
mov r8, rbx
xor edx, edx
mov dword [rsi], ecx
call fcn.00091d10
mov rcx, qword [rsp + 0x68]
mov r8, rdi
mov rdx, rbp
call fcn.00091720
mov ecx, dword [rsp + 0x68]
lea rdx, [0x000acd10]
add ecx, edi
mov r8d, 0x4b1
mov dword [rsi + 4], edi
call fcn.00091720
mov r11d, dword [rsp + 0x68]
mov rdx, rsi
lea ecx, [r11 + rdi + 0x4b1]
mov r8d, 0x20
call fcn.00091720
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1a3f8
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and qword [rax + 0x20], 0
mov ebx, ecx
mov rdi, r9
mov rbp, rdx
mov esi, r8d
mov dword [rax - 0x20], 0x40
lea r9, [rax - 0x18]
lea rdx, [rax + 0x20]
or rcx, 0xffffffffffffffff
xor r8d, r8d
mov qword [rax - 0x18], rbx
mov dword [rax - 0x28], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov ecx, 0xc0000000
and eax, ecx
cmp eax, ecx
je 0x1a4a9
mov rcx, qword [rsp + 0x68]
mov r8, rbx
xor edx, edx
mov qword [rdi], rcx
call fcn.00091d10
mov rcx, qword [rsp + 0x68]
mov r8, rsi
mov rdx, rbp
call fcn.00091720
mov rax, qword [rsp + 0x68]
lea rdx, str._USVWATAUAVAWH
lea rcx, [rsi + rax]
mov r8d, 0x518
mov dword [rdi + 8], esi
call fcn.00091720
mov r11, qword [rsp + 0x68]
mov rdx, rdi
lea rcx, [rsi + r11 + 0x518]
mov r8d, 0x3c
call fcn.00091720
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x261f4
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x70
lea r12, [0x000941b0]
mov ebx, 0xc0000001
mov esi, 0xc0000000
mov edi, ebx
test r12, r12
je 0x262d9
lea r13, [0x00094190]
test r13, r13
je 0x262d9
lea rcx, [rsp + 0x20]
mov rdx, r12
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x30]
mov rdx, r13
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x48], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x68], 0
lea rax, [rsp + 0x20]
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x90]
mov edx, 0xf003f
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x30
mov dword [rsp + 0x58], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov ecx, eax
mov edi, eax
and ecx, esi
cmp ecx, esi
jne 0x262a9
mov r9d, eax
lea rcx, [0x00097530]
jmp 0x262ce
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov edi, eax
and eax, esi
cmp eax, esi
jne 0x262d9
mov r9d, edi
lea rcx, [0x00097590]
mov r8, r13
mov rdx, r12
call fcn.0004505c
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x262f5
call qword [sym.imp.ntoskrnl.exe_ZwClose]
and qword [rsp + 0x90], 0
mov eax, edi
and eax, esi
cmp eax, esi
jne 0x2630d
lea rcx, [0x000944e0]
mov edx, edi
call fcn.0004505c
jmp 0x26319
lea rcx, [0x00094540]
call fcn.0004505c
test r12, r12
je 0x263b2
lea rcx, [rsp + 0x30]
mov rdx, r12
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x48], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x68], 0
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x90]
mov edx, 0xf003f
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x30
mov dword [rsp + 0x58], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov ecx, eax
mov ebx, eax
and ecx, esi
cmp ecx, esi
jne 0x2638a
mov r8d, eax
lea rcx, [0x000975d0]
jmp 0x263aa
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov ebx, eax
and eax, esi
cmp eax, esi
jne 0x263b2
mov r8d, ebx
lea rcx, [0x00097600]
mov rdx, r12
call fcn.0004505c
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x263ce
call qword [sym.imp.ntoskrnl.exe_ZwClose]
and qword [rsp + 0x90], 0
mov eax, ebx
and eax, esi
cmp eax, esi
jne 0x263e6
lea rcx, [0x00094590]
mov edx, ebx
call fcn.0004505c
jmp 0x263f2
lea rcx, [0x000945e0]
call fcn.0004505c
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x2d10c
Capabilities:
Check for software breakpoints

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
xor edx, edx
mov rbp, rcx
mov r10, rdx
cmp rcx, rdx
je 0x2d197
cmp r9, rdx
je 0x2d197
mov r11, qword [rsp + 0x38]
cmp r11, rdx
je 0x2d197
mov eax, dword [rsp + 0x30]
cmp eax, r8d
jne 0x2d14d
mov edx, 0xc0000225
jmp 0x2d19c
mov eax, edx
lea r12d, [r8 - 1]
mov rsi, r9
mov ebx, edx
mov rcx, rdx
cmp r8d, edx
jbe 0x2d17a
mov dil, byte [rcx + rbp]
cmp dil, 0xcc
je 0x2d170
cmp dil, byte [rsi + rcx]
jne 0x2d17a
inc ebx
inc rcx
cmp ebx, r8d
jb 0x2d160
cmp ebx, r12d
jae 0x2d18c
inc eax
inc rsi
cmp eax, dword [rsp + 0x30]
jbe 0x2d156
jmp 0x2d192
mov r10d, eax
add r10, r9
mov qword [r11], r10
jmp 0x2d19c
mov edx, 0xc000000d
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov eax, edx
pop r12
ret