joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004914
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rdi, rdx
mov rbx, rcx
lea rdx, [0x14001cd70]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rbp + 0x20]
mov r9d, 0x15
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x10]
mov byte [rsp + 0x28], 0
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jns 0x140004974
lfence
jmp 0x140004a17
lea rdx, [0x14001cda0]
lea rcx, [rbp - 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x20]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov ebx, eax
test eax, eax
jns 0x1400049a8
lfence
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x140004a15
mov rax, qword [rbp + 0x20]
or dword [rax + 0x30], 0x10
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_IoRegisterShutdownNotification]
mov ebx, eax
test eax, eax
jns 0x1400049cf
lfence
lea rcx, [rbp - 0x20]
call qword [sym.imp.ntoskrnl.exe_IoDeleteSymbolicLink]
jmp 0x14000499c
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_IoRegisterLastChanceShutdownNotification]
mov ebx, eax
test eax, eax
jns 0x1400049ee
lfence
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_IoUnregisterShutdownNotification]
jmp 0x1400049c3
mov r8, qword [rbp + 0x20]
lea rdx, [0x140006560]
lea rcx, [0x140023820]
call fcn.1400193b4
mov ebx, eax
lfence
test eax, eax
js 0x1400049e2
mov rax, qword [rbp + 0x20]
mov qword [rdi], rax
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x140009090
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
and qword [r11 - 0x30], 0
lea rax, [rbp + 0x28]
mov r9d, 0x2001f
mov qword [r11 - 0x38], rax
lea r8, [0x14001ceb0]
xor ecx, ecx
lea rdx, [0x140023800]
call fcn.1400198c8
test eax, eax
js 0x140009234
mov ecx, dword [0x140023240]
mov esi, 0x400
mov edx, esi
mov r8d, 0x61436146
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x14000922a
xor r14d, r14d
xor edx, edx
jmp 0x1400091f4
cmp eax, 0xc0000023
je 0x140009113
cmp eax, 0x80000005
jne 0x140009170
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [rbp + 0x20]
mov r8d, 0x61436146
mov ecx, dword [0x140023240]
add eax, 0xff
and eax, 0xffffff00
mov edx, eax
mov esi, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x14000922a
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
mov r9, rbx
mov r8d, 2
mov dword [rsp + 0x20], esi
mov edx, r14d
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
inc r14d
test eax, eax
js 0x1400091f1
lfence
mov edx, dword [rbx + 8]
lea rdi, [rbx + 0xc]
mov rcx, rdi
call fcn.140007d10
test al, al
je 0x1400091f1
lfence
mov eax, dword [rdi + 0x30]
shr eax, 0x1b
not al
test al, 1
je 0x1400091e9
lfence
mov rcx, rdi
call fcn.140007ca8
lea rcx, [rdi + 0x10]
lea rdx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlStringFromGUID]
test eax, eax
js 0x1400091e9
lfence
mov eax, dword [rdi + 4]
lea rdx, [rbp - 0x10]
mov rcx, qword [rbp + 0x28]
mov r9d, 3
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov rcx, rdi
call fcn.140008910
mov edx, r14d
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
mov r9, rbx
mov r8d, 2
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, 0x8000001a
jne 0x140009105
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret

Function at 0x14000f078
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rdx + 0x30], r8d
mov rbx, rdx
test r8d, r8d
mov rsi, rcx
mov edi, r8d
cmove eax, r9d
mov rcx, rbx
mov qword [rdx + 0x38], rax
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
cmp byte [rsp + 0x50], 0
jne 0x14000f0c4
mov rcx, qword [rsi + 0x308]
mov r8, rbx
mov edx, edi
call fcn.140010abc
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140014568
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, qword [rcx + 0x40]
mov rdi, rdx
and qword [rsp + 0x20], 0
mov rsi, rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbx + 0xa0]
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
cmp byte [rbx + 0x7b], 0
jne 0x1400145b8
mov al, byte [rbx + 0x80]
test al, al
je 0x1400145b8
lea rcx, [rbx + 0x1e0]
call fcn.14000cc7c
mov rcx, qword [rbx + 0x18]
mov rdx, rdi
call fcn.140019cd8
mov rdx, rdi
mov rcx, rsi
mov ebx, eax
call fcn.14001444c
xor edx, edx
mov dword [rdi + 0x30], ebx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14001664c
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x40
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x68]
mov rdx, rcx
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov byte [0x1400235d0], 1
mov r9d, 0x2001f
lea r8, [0x14001d100]
call fcn.1400198c8
mov ebx, eax
test eax, eax
js 0x1400166d3
lea rdx, [0x14001d120]
mov dword [rsp + 0x60], 0x40000000
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov r9d, 4
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x140017814
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x40
lea r8, [rsp + 0x58]
mov rbx, rcx
lea rdx, [0x14001d390]
call fcn.14001a98c
test eax, eax
js 0x1400178a8
mov rax, qword [rsp + 0x58]
cmp dword [rax + 4], 1
jne 0x14001789b
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
lea r8, [0x14001d3a0]
xor ecx, ecx
lea rdx, [0x140023800]
call fcn.1400198c8
test eax, eax
js 0x14001789b
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x30]
add rdx, 0xc
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rdx, [0x14001d390]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
add rsp, 0x40
pop rbx
ret

Function at 0x140017964
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x40
and qword [r11 - 0x20], 0
lea rax, [r11 + 0x18]
mov dil, dl
mov qword [r11 - 0x28], rax
xor edx, edx
lea r8, [0x14001cfe0]
mov r9d, 0x2001f
call fcn.1400198c8
mov ebx, eax
test eax, eax
js 0x1400179e3
cmp byte [0x1400238f9], 0
je 0x1400179b4
mov rcx, qword [rsp + 0x60]
call fcn.140017814
mov ebx, eax
test dil, dil
jne 0x1400179d8
lea rdx, [0x14001d3b0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140019310
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x70
and qword [rax - 0x30], 0
mov rdi, r8
and qword [rax - 0x28], 0
lea r8, [rax - 0x38]
mov qword [rax - 0x48], rdx
xorps xmm0, xmm0
mov qword [rax - 0x50], rcx
xor r9d, r9d
and qword [rax - 0x58], 0
lea rcx, [rax + 0x20]
mov edx, 0x1fffff
mov dword [rax - 0x38], 0x30
mov dword [rax - 0x20], 0x200
movdqu xmmword [rax - 0x18], xmm0
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov ebx, eax
test eax, eax
js 0x1400193a1
test rdi, rdi
je 0x140019393
and qword [rsp + 0x28], 0
xor r9d, r9d
mov rcx, qword [rsp + 0x98]
xor r8d, r8d
mov edx, 0x1fffff
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov ebx, eax
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x14001a98c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and dword [rax + 0x20], 0
mov rbp, rcx
lea rcx, [rax - 0x18]
mov rsi, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r9d, r9d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
and dword [rsp + 0x20], 0
mov rcx, rbp
lea r8d, [r9 + 2]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
cmp eax, 0x80000005
je 0x14001a9e8
cmp eax, 0xc0000023
jne 0x14001aa4f
mov edx, dword [rsp + 0x68]
mov r8d, 0x62696c52
mov ecx, dword [0x140023240]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x14001aa4a
mov ecx, dword [rsp + 0x68]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], ecx
mov r9, rdi
mov rcx, rbp
mov r8d, 2
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
test eax, eax
js 0x14001aa3a
mov qword [rsi], rdi
jmp 0x14001aa4f
lfence
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x14001aa4f
mov ebx, 0xc000009a
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14001bb2c
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x1400231e0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, r8
mov dword [rsp + 0x20], 0x67452301
mov r8d, edx
mov dword [rsp + 0x24], 0xefcdab89
mov rdx, rcx
mov dword [rsp + 0x28], 0x98badcfe
xor eax, eax
mov qword [rsp + 0x2c], 0x10325476
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x34], rax
call fcn.14001bc70
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14001bba8
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14001c5f0
add rsp, 0xd0
pop rbx
ret
Function at 0x14001e308
Capabilities:
Delete registry value
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x1400231e0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, qword [rcx + 0x60]
mov r15, r8
mov r14, rdx
mov rbp, r9
mov rdi, rcx
mov r9, rbx
mov rdx, r15
mov rcx, r14
lea r8, [rbx + 0xb8]
xor esi, esi
call fcn.14001e4d0
test eax, eax
js 0x14001e4b4
lfence
mov r8, qword [rdi + 0x60]
mov rdx, rbp
add r8, 0x180
mov rcx, rbx
call fcn.14001e748
test al, al
je 0x14001e4b4
mov r9b, byte [rbx + 0xe]
lea r11d, [rsi + 4]
test r11b, r9b
je 0x14001e4ab
and r9b, 0x10
jne 0x14001e39e
mov al, byte [rbx + 0x28]
cmp al, 0x53
je 0x14001e396
cmp al, 0x58
jne 0x14001e39e
mov bpl, 1
mov r10b, 3
jmp 0x14001e3a4
xor bpl, bpl
mov r10b, 2
mov eax, dword [rbx + 4]
movabs r8, 0xfffff78000000014
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 8]
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x30]
mov r8, qword [r8]
mov qword [rdi + 0x68], r8
test rcx, rcx
jle 0x14001e426
cmp rcx, r8
jg 0x14001e426
sub r8, rcx
mov eax, 0x446f8657
sar r8, 0x20
mul r8d
sub r8d, edx
shr r8d, 1
add r8d, edx
shr r8d, 7
cmp r8d, dword [rbx + 0x10]
lfence
jae 0x14001e435
mov qword [rdi + 0x70], rcx
test r9b, r9b
movzx eax, r10b
cmovne eax, r11d
mov byte [rdi + 0x5d], al
mov eax, dword [rbx + 0x10]
mov dword [rdi + 0x78], eax
mov eax, dword [rbx + 0x10]
sub eax, r8d
movzx ecx, ax
mov esi, ecx
or esi, 0x90000000
test bpl, bpl
cmove esi, ecx
test bpl, bpl
je 0x14001e4b4
mov byte [rdi + 0x5f], 1
jmp 0x14001e4b4
mov eax, dword [rbx + 4]
lea rdx, [0x14001fd70]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x38]
mov eax, dword [rbx + 8]
mov dword [rsp + 0x4c], eax
mov eax, dword [rbx + 0x10]
mov dword [rsp + 0x50], eax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], 0xc
mov r9d, 3
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
test bpl, bpl
jne 0x14001e42f
lfence
mov rdx, r15
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x38]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
jmp 0x14001e4b4
mov byte [rdi + 0x5d], sil
mov esi, 0x80000000
mov eax, esi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001c5f0
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001e51c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, rcx
mov rbp, r9
lea rcx, [rax - 0x20]
mov rdi, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov esi, dword [rsp + 0x80]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x38]
mov r9, rdi
mov r8d, 2
mov rcx, rbx
lea eax, [rsi + 0x10]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
test eax, eax
js 0x14001e5a7
mov ecx, dword [rsp + 0x88]
cmp dword [rdi + 4], ecx
jne 0x14001e5a2
cmp dword [rdi + 8], esi
jne 0x14001e5a2
test rbp, rbp
je 0x14001e5a7
lfence
mov r8d, esi
lea rdx, [rdi + 0xc]
mov rcx, rbp
call fcn.14001c880
jmp 0x14001e5a7
mov ebx, 0xc000003e
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x14001e654
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
mov rbx, r8
lea rcx, [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp - 0x30], 0
lea rax, [rbp - 0x48]
xorps xmm0, xmm0
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x38]
mov dword [rbp - 0x38], 0x30
mov edx, 0x20019
mov dword [rbp - 0x20], 0x240
lea rcx, [rbp - 0x50]
movdqu xmmword [rbp - 0x18], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x14001e730
lea rdx, [0x14001fd40]
lea rcx, [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp - 0x50]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x48]
mov r9, rbx
mov dword [rsp + 0x20], 0xc8
mov r8d, 2
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x14001e726
mov r9d, 3
cmp dword [rbx + 4], r9d
jne 0x14001e726
mov ecx, 0xb8
cmp dword [rbx + 8], ecx
jne 0x14001e726
lfence
mov dword [rsp + 0x28], ecx
lea rax, [rbx + 0xc]
mov rcx, rdi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400267a0
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x40]
mov rsi, rdx
mov rbp, rcx
mov rdx, qword [rdi + 0xc0]
test rdx, rdx
je 0x1400267de
lea rcx, [0x140023408]
call fcn.14000746c
and qword [rdi + 0xc0], 0
mov rcx, qword [rdi + 0x18]
mov rdx, rsi
call fcn.140019cd8
mov rcx, qword [rdi + 0x18]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_IoDetachDevice]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
xor edx, edx
mov dword [rsi + 0x30], ebx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140026850
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r14, qword [rdx + 0xb8]
mov rbp, rdx
mov rbx, qword [rcx + 0x40]
mov rdi, rcx
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
and qword [rsp + 0x20], 0
lea rcx, [rbx + 0x58]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
xor r15b, r15b
cmp byte [r14 + 8], r15b
jne 0x1400268be
cmp dword [rbx + 0x70], 1
jne 0x1400268be
mov eax, dword [rdi + 0x30]
bt eax, 0xe
jb 0x1400268be
bts eax, 0xd
mov r15b, 1
mov dword [rdi + 0x30], eax
mov rcx, qword [rbx + 0x18]
mov rdx, rbp
call fcn.140019cd8
mov esi, eax
test eax, eax
js 0x1400268ee
cmp byte [r14 + 8], 0
je 0x1400268dd
lock inc dword [rbx + 0x70]
jmp 0x1400268e1
lock dec dword [rbx + 0x70]
cmp byte [r14 + 8], 0
je 0x1400268f9
cmp dword [rbx + 0x70], 1
jmp 0x1400268f2
cmp r15b, 1
jne 0x1400268f9
btr dword [rdi + 0x30], 0xd
xor r8d, r8d
lea rcx, [rbx + 0x58]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
xor edx, edx
mov dword [rbp + 0x30], esi
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x140026940
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
and dword [rax + 0x18], 0
mov edi, r9d
mov rsi, r8
mov r14d, edx
mov r15d, ecx
test r8, r8
jne 0x14002697c
test r9d, r9d
je 0x14002697c
mov eax, 0xc000000d
jmp 0x140026a2f
lea ebp, [r9 + 0x10]
mov ecx, 1
mov edx, ebp
mov r8d, 0x4b787541
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithQuotaTag]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140026a28
lea r9, [rsp + 0x50]
mov dword [rax + 0xc], edi
mov r8d, ebp
mov dword [rax], r15d
mov rdx, rax
mov dword [rax + 4], 1
mov ecx, 0x4c
mov dword [rax + 8], r14d
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
nop dword [rax + rax]
mov edi, eax
mov eax, 0x80000000
lea ecx, [rdi + rax]
test eax, ecx
jne 0x1400269e8
cmp edi, 0xc0000023
jne 0x140026a15
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400269f7
mov eax, dword [rbx + 0xc]
mov dword [rcx], eax
test edi, edi
js 0x140026a15
test rsi, rsi
je 0x140026a15
mov r8d, dword [rsp + 0x50]
lea rdx, [rbx + 0x10]
add r8d, 0xfffffff0
mov rcx, rsi
call fcn.14001c880
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
nop dword [rax + rax]
jmp 0x140026a2d
mov edi, 0xc000009a
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140026a4c
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp dword [0x140023628], ebx
mov dword [rsp + 0x30], ebx
jne 0x140026aac
xor r9d, r9d
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
nop dword [rax + rax]
cmp dword [rsp + 0x30], 5
jae 0x140026a87
mov ebx, 0xc00000bb
jmp 0x140026aac
lea rcx, [0x140021740]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
nop dword [rax + rax]
mov ecx, 1
mov qword [0x140023620], rax
xchg dword [0x140023628], ecx
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1400276bc
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400231e0]
xor rax, rsp
mov qword [rbp - 0x10], rax
and qword [rsp + 0x28], 0
xor eax, eax
mov qword [rdx], rax
mov rsi, rdx
mov qword [r8], rax
mov rdi, r8
mov rdx, rcx
lea r8, [0x140028660]
movabs rax, 0xfffff78000000014
mov r9d, 0x2001f
xor ecx, ecx
mov rax, qword [rax]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
call fcn.1400198c8
mov ebx, eax
test eax, eax
js 0x1400277c4
lea rdx, [0x140028680]
mov dword [rbp - 0x50], 0x18
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x28]
mov eax, dword [rbp - 0x50]
lea rdx, [rbp - 0x38]
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov r9d, 3
test eax, eax
js 0x14002778b
cmp dword [rbp - 0x20], 8
jne 0x14002778b
cmp dword [rbp - 0x24], r9d
jne 0x14002778b
lfence
mov rax, qword [rbp - 0x1c]
mov qword [rsi], rax
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x40]
mov dword [rsp + 0x28], 8
lea rdx, [rbp - 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ebx, eax
test eax, eax
js 0x1400277ba
mov rax, qword [rbp - 0x40]
mov qword [rdi], rax
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001c5f0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movsxd rax, dword [rcx + 0x3c]
xor r10d, r10d
mov esi, edx
mov rbx, rcx
mov r8d, dword [rax + rcx + 0x88]
mov edi, dword [r8 + rcx + 0x1c]
mov r11d, dword [r8 + rcx + 0x20]
mov r14d, dword [r8 + rcx + 0x24]
add r11, rcx
add r14, rcx
lea rbp, [rcx + rdi]
test edi, edi
je 0x14000112c
nop word [rax + rax]
mov edx, dword [r11]
mov rax, 0xffffffffffffffff
add rdx, rbx
lea r8d, [rax + 0x36]
inc rax
cmp byte [rdx + rax], 0
jne 0x1400010f1
xor r9d, r9d
test rax, rax
je 0x14000111b
movsx ecx, byte [rdx]
lea r8d, [r8 + r8*2]
inc r9d
lea rdx, [rdx + 1]
add r8d, ecx
movsxd rcx, r9d
cmp rcx, rax
jb 0x140001102
cmp r8d, esi
je 0x140001145
inc r10d
add r11, 4
cmp r10d, edi
jb 0x1400010e0
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
movzx ecx, word [r14 + r10*2]
mov eax, dword [rbp + rcx*4]
add rax, rbx
jmp 0x14000112e
Function at 0x140002f50
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002f9a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002f9a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002f9a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002f9a
cmp dword [rcx + 0x84], 0xe
jbe 0x140002f9a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002f9c
xor al, al
add rsp, 0x28
ret

Function at 0x140009628
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140009424

Function at 0x14000d014
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14000d02a
mov al, 1
jmp 0x14000d08a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14000d03b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14000d088
mov ecx, dword [rcx + 0x18]
nop
call fcn.14000f6ec
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000d088
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14000d088
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14000d088
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14000d08a
xor al, al
add rsp, 0x20
pop rbx
ret