joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1ebf8
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x80
and dword [rsp + 0x50], 0
mov eax, 0x74
xor edx, edx
mov word [rsp + 0x40], ax
mov eax, 0x76
mov rsi, rcx
mov word [rsp + 0x42], ax
lea rax, [0x00055eb0]
lea r8d, [rdx + 0x28]
mov qword [r11 - 0x40], rax
mov eax, 0x1a
lea rcx, [r11 - 0x30]
mov word [rsp + 0x30], ax
mov eax, 0x1c
mov word [rsp + 0x32], ax
lea rax, [0x00055fc0]
mov qword [r11 - 0x50], rax
call fcn.000554c0
and qword [rsp + 0xa0], 0
xor edi, edi
and dword [rsp + 0x90], edi
test rsi, rsi
je 0x1edd3
and qword [rsp + 0x58], rdi
and qword [rsp + 0x70], rdi
and qword [rsp + 0x78], rdi
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xa0]
mov edx, 0x20019
mov dword [rsp + 0x50], 0x30
mov dword [rsp + 0x68], 0x40
mov qword [rsp + 0x60], rax
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov ebx, eax
test eax, eax
js 0x1edeb
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x1edeb
lea rax, [rsp + 0x90]
lea r8d, [rdi + 2]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], edi
xor r9d, r9d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
cmp eax, 0x80000005
je 0x1ed0e
cmp eax, 0xc0000023
jne 0x1edc3
mov eax, dword [rsp + 0x90]
xor ecx, ecx
mov r8d, 0x33333130
add eax, 0x10
mov edx, eax
mov dword [rsp + 0x90], eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
jne 0x1ed41
mov ebx, 0xc000009a
jmp 0x1edc3
mov r8d, dword [rsp + 0x90]
xor edx, edx
mov rcx, rax
call fcn.000554c0
mov eax, dword [rsp + 0x90]
mov rcx, qword [rsp + 0xa0]
lea r11, [rsp + 0x90]
lea rdx, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x28], r11
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
test eax, eax
js 0x1edc3
cmp dword [rdi + 4], 3
jne 0x1edc3
mov eax, dword [rdi + 8]
test eax, eax
je 0x1edc3
cmp eax, 0x20
ja 0x1edbe
xor ecx, ecx
test eax, eax
je 0x1edc3
lea rdx, [rdi + 0xc]
mov al, byte [rdx]
inc ecx
inc rdx
xor al, 0x43
mov byte [rsi], al
inc rsi
cmp ecx, dword [rdi + 8]
jb 0x1eda9
jmp 0x1edc3
mov ebx, 0xc0000023
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x1edd8
mov ebx, 0xc000000d
test rdi, rdi
je 0x1edeb
mov edx, 0x33333130
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1ff7c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x90
mov eax, 0x98
xor ebx, ebx
mov rsi, rcx
mov word [rsp + 0x40], ax
mov eax, 0x9a
lea rcx, [r11 - 0x30]
mov word [rsp + 0x42], ax
lea rax, [0x00056040]
lea r8d, [rbx + 0x28]
mov qword [r11 - 0x50], rax
mov eax, 0xa4
xor edx, edx
mov word [rsp + 0x50], ax
mov eax, 0xa6
mov qword [r11 + 0x18], rbx
mov word [rsp + 0x52], ax
lea rax, [0x000560e0]
mov dword [rsp + 0x60], ebx
mov qword [r11 - 0x40], rax
mov eax, 0x18
mov word [rsp + 0x30], ax
mov eax, 0x1a
mov word [rsp + 0x32], ax
lea rax, [0x00056190]
mov qword [r11 - 0x60], rax
call fcn.000554c0
mov dword [rsp + 0xa0], ebx
cmp rsi, rbx
je 0x201b5
lea rax, [rsp + 0x40]
lea edi, [rbx + 0x30]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0xb0]
mov edx, 0x20019
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x40
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
jge 0x200ad
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0xb0]
mov edx, 0x20019
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x40
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
jl 0x201b1
mov rcx, qword [rsp + 0xb0]
xor r9d, r9d
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea r8d, [r9 + 2]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0x80000005
je 0x200ea
cmp eax, 0xc0000023
jne 0x201a3
mov eax, dword [rsp + 0xa0]
xor ecx, ecx
mov r8d, 0x30313131
add eax, 0x10
mov edx, eax
mov dword [rsp + 0xa0], eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
cmp rax, rbx
je 0x201a3
mov r8d, dword [rsp + 0xa0]
xor edx, edx
mov rcx, rax
call fcn.000554c0
mov ecx, dword [rsp + 0xa0]
lea r11, [rsp + 0xa0]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0xb0]
lea rdx, [rsp + 0x30]
mov r9, rdi
mov r8d, 2
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, ebx
jl 0x20198
cmp dword [rdi + 8], ebx
jbe 0x20198
mov ebx, 0x208
xor edx, edx
mov rcx, rsi
mov r8, rbx
call fcn.000554c0
cmp dword [rdi + 8], ebx
cmovb ebx, dword [rdi + 8]
test bl, 1
je 0x20187
add ebx, 0xfffffffd
lea rdx, [rdi + 0xc]
mov r8d, ebx
mov rcx, rsi
call fcn.000550e0
mov bl, 1
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
jmp 0x201b7
xor al, al
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x28500
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x3d0
mov rax, qword [0x00065100]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
mov rax, qword [rdx]
mov rsi, rcx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov ebx, r8d
mov qword [rsp + 0x20], rax
call fcn.000280d4
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x30]
call fcn.00028160
test ebx, ebx
jle 0x2865f
lea ebp, [rbx - 1]
mov r12d, 0x20
shr ebp, 3
inc ebp
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.000280d4
lea rcx, [rsp + 0x30]
call fcn.000282a8
xor ebx, ebx
lea rdi, [rsp + 0xc0]
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov r8, r12
call fcn.000550e0
lea rcx, [rsp + 0x70]
call fcn.00028358
xor r11d, r11d
mov al, byte [rdi + r11]
inc r11
xor byte [rsp + r11 + 0x6f], al
cmp r11, 0x30
jl 0x285ac
lea rcx, [rsp + 0x70]
call fcn.00028408
lea rcx, [rsp + 0x70]
call fcn.000283b0
xor r11d, r11d
mov al, byte [rsp + r11 + 0x70]
inc r11
xor byte [rsp + r11 + 0x2f], al
cmp r11, r12
jl 0x285d5
cmp rbx, 0xf
je 0x28629
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x30]
mov r8, r12
call fcn.000550e0
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r8, r12
call fcn.000550e0
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0xa0]
mov r8, r12
call fcn.000550e0
inc rbx
add rdi, 0x30
cmp rbx, 0x10
jl 0x2858d
lea rcx, [rsp + 0x30]
call fcn.00028300
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.00028118
add rsi, 8
sub rbp, 1
jne 0x2856c
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.00055060
lea r11, [rsp + 0x3d0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x28690
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x3d0
mov rax, qword [0x00065100]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
mov rax, qword [rdx]
mov rsi, rcx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov ebx, r8d
mov qword [rsp + 0x20], rax
call fcn.000280d4
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x30]
call fcn.00028160
test ebx, ebx
jle 0x287ee
lea ebp, [rbx - 1]
mov r12d, 0x20
shr ebp, 3
inc ebp
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.000280d4
lea rcx, [rsp + 0x30]
call fcn.000282a8
mov ebx, 0xf
lea rdi, [rsp + 0x390]
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov r8, r12
call fcn.000550e0
lea rcx, [rsp + 0x70]
call fcn.00028358
xor r11d, r11d
mov al, byte [rdi + r11]
inc r11
xor byte [rsp + r11 + 0x6f], al
cmp r11, 0x30
jl 0x2873f
lea rcx, [rsp + 0x70]
call fcn.00028408
lea rcx, [rsp + 0x70]
call fcn.000283b0
xor r11d, r11d
mov al, byte [rsp + r11 + 0x70]
inc r11
xor byte [rsp + r11 + 0x2f], al
cmp r11, r12
jl 0x28768
test rbx, rbx
je 0x287bb
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x30]
mov r8, r12
call fcn.000550e0
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r8, r12
call fcn.000550e0
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0xa0]
mov r8, r12
call fcn.000550e0
sub rdi, 0x30
sub rbx, 1
jns 0x28720
lea rcx, [rsp + 0x30]
call fcn.00028300
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.00028118
add rsi, 8
sub rbp, 1
jne 0x286fc
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.00055060
lea r11, [rsp + 0x3d0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x29798
Capabilities:
Hash data with md5

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x80
mov dword [rax + 0x10], 0x67452301
mov dword [rax + 8], 0xefcdab89
mov dword [rax + 0x18], 0x98badcfe
mov dword [rax + 0x20], 0x10325476
mov eax, edx
mov rdi, r8
shr eax, 0x1d
mov esi, edx
mov rbp, rcx
mov dword [rsp + 0x34], eax
mov eax, edx
mov r12d, 0x40
and eax, 0x1fffffff
shl eax, 3
mov dword [rsp + 0x30], eax
mov eax, edx
shr eax, 6
test eax, eax
je 0x2983c
mov ebx, eax
lea rcx, [rsp + 0x40]
mov rdx, rbp
mov r8, r12
call fcn.000550e0
lea r11, [rsp + 0xc8]
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], r11
call fcn.0002881c
add rbp, r12
sub rbx, 1
jne 0x297f4
lea rcx, [rsp + 0x40]
mov r8, r12
xor edx, edx
call fcn.000554c0
mov ebx, esi
lea rcx, [rsp + 0x40]
and ebx, 0x3f
mov rdx, rbp
mov r8, rbx
call fcn.000550e0
and esi, 0x3f
mov byte [rsp + rbx + 0x40], 0x80
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x40]
cmp sil, 0x37
jbe 0x298d5
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
call fcn.0002881c
lea rcx, [rsp + 0x40]
mov r8, r12
xor edx, edx
call fcn.000554c0
mov r11, qword [rsp + 0x30]
lea r9, [rsp + 0xc0]
mov qword [rsp + 0x78], r11
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x40]
jmp 0x298df
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
call fcn.0002881c
mov eax, dword [rsp + 0xb8]
mov dword [rdi], eax
mov eax, dword [rsp + 0xb0]
mov dword [rdi + 4], eax
mov eax, dword [rsp + 0xc0]
mov dword [rdi + 8], eax
mov eax, dword [rsp + 0xc8]
mov dword [rdi + 0xc], eax
xor eax, eax
add rsp, 0x80
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x29930
Capabilities:
Hash data with md5

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x90
mov dword [rax - 0x78], 0x67452301
mov dword [rax + 0x20], 0xefcdab89
mov dword [rax + 8], 0x98badcfe
mov dword [rax + 0x10], 0x10325476
xor ebp, ebp
mov eax, edx
shr eax, 0x1d
mov r12, r8
mov edi, edx
mov dword [rsp + 0x4c], eax
mov eax, edx
mov rsi, rcx
and eax, 0x1fffffff
lea r13d, [rbp + 0x40]
shl eax, 3
mov dword [rsp + 0x48], eax
mov eax, edx
shr eax, 6
cmp eax, ebp
jbe 0x299d6
mov ebx, eax
lea rcx, [rsp + 0x50]
mov rdx, rsi
mov r8, r13
call fcn.000550e0
lea r11, [rsp + 0xc8]
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], r11
call fcn.0002881c
add rsi, r13
sub rbx, 1
jne 0x29991
lea rcx, [rsp + 0x50]
mov r8, r13
xor edx, edx
call fcn.000554c0
mov ebx, edi
lea rcx, [rsp + 0x50]
and ebx, 0x3f
mov rdx, rsi
mov r8, rbx
call fcn.000550e0
and edi, 0x3f
mov byte [rsp + rbx + 0x50], 0x80
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
cmp dil, 0x37
jbe 0x29a6c
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
call fcn.0002881c
lea rcx, [rsp + 0x50]
mov r8, r13
xor edx, edx
call fcn.000554c0
mov r11, qword [rsp + 0x48]
lea r9, [rsp + 0xc0]
mov qword [rsp + 0x88], r11
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
jmp 0x29a79
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
call fcn.0002881c
mov ecx, dword [rsp + 0xc8]
mov r10d, ecx
mov eax, ecx
mov r11d, 0xff00
shr eax, 0x10
mov ebx, 0xff0000
and r10d, ebx
or r10d, eax
mov eax, ecx
shl ecx, 0x10
and eax, r11d
shr r10d, 8
or eax, ecx
mov ecx, dword [rsp + 0xc0]
shl eax, 8
mov r8d, ecx
or r10d, eax
mov eax, ecx
and r8d, ebx
shr eax, 0x10
mov dword [rsp + 0x30], r10d
or r8d, eax
mov eax, ecx
shl ecx, 0x10
and eax, r11d
shr r8d, 8
or eax, ecx
mov ecx, dword [rsp + 0xd8]
shl eax, 8
mov edx, ecx
or r8d, eax
mov eax, ecx
and edx, ebx
shr eax, 0x10
mov dword [rsp + 0x28], r8d
lea r8, str._08X_08X_08X_08X
or edx, eax
mov eax, ecx
shl ecx, 0x10
and eax, r11d
shr edx, 8
or eax, ecx
mov ecx, dword [rsp + 0x40]
shl eax, 8
mov r9d, ecx
or edx, eax
mov eax, ecx
and r9d, ebx
shr eax, 0x10
mov dword [rsp + 0x20], edx
mov edx, 0x21
or r9d, eax
mov eax, ecx
shl ecx, 0x10
and eax, r11d
shr r9d, 8
or eax, ecx
mov rcx, r12
shl eax, 8
or r9d, eax
call fcn.00012738
mov rbx, qword [rsp + 0xd0]
cmp eax, ebp
cmovl ebp, eax
mov eax, ebp
add rsp, 0x90
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x29c28
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x60
test r8, r8
jne 0x29c3a
mov eax, 0xc0000001
jmp 0x29c84
mov rax, cr8
test al, al
jne 0x29c33
and qword [rsp + 0x40], 0
mov rbx, qword [rsp + 0x90]
mov qword [rsp + 0x38], rdx
and dword [rbx], 0
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
js 0x29c84
mov ecx, dword [rsp + 0x58]
mov dword [rbx], ecx
add rsp, 0x60
pop rbx
ret
Function at 0x29c90
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov r10, qword [rsp + 0x98]
xor ebx, ebx
mov dword [r10], r9d
cmp rdx, rbx
jne 0x29caf
mov eax, 0xc0000001
jmp 0x29cf4
mov rax, cr8
cmp al, bl
jne 0x29ca8
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x50]
xor r9d, r9d
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov rcx, qword [rsp + 0x90]
cmp eax, ebx
cmovge ebx, dword [rsp + 0x58]
mov dword [rcx], ebx
add rsp, 0x60
pop rbx
ret

Function at 0x29d3c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x68
test rcx, rcx
jne 0x29d4c
mov eax, 0xc0000001
jmp 0x29d99
mov rax, cr8
test al, al
jne 0x29d45
mov rdx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x38], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x48], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
add rsp, 0x68
ret

Function at 0x29fe8
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0xb0
xor ebp, ebp
mov edi, r8d
mov rbx, rcx
mov rsi, rdx
lea rcx, [rax - 0x40]
lea r8d, [rbp + 0x28]
xor edx, edx
mov qword [rax + 8], rbp
mov dword [rax - 0x48], ebp
call fcn.000554c0
xor eax, eax
mov dword [rsp + 0x70], ebp
mov dword [rsp + 0x74], eax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x62], rax
mov dword [rsp + 0x6a], eax
mov word [rsp + 0x6e], ax
mov dword [rsp + 0xec], eax
mov word [rsp + 0x60], bp
mov dword [rsp + 0xe8], ebp
cmp rbx, rbp
jne 0x2a059
mov eax, 0xc000000d
jmp 0x2a141
lea rcx, [rsp + 0x60]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 5
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], 1
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0xd0]
mov edx, 0x10000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], rbp
mov dword [rsp + 0x98], 0x240
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xa8], rbp
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
cmp eax, ebp
jl 0x2a141
mov rcx, qword [rsp + 0xd0]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov rcx, qword [rsp + 0xd0]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0xd8]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
Function at 0x2aa2c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, dword [rsp + 0x60]
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test eax, eax
je 0x2aa66
cmp eax, 0x80000005
je 0x2aa66
cmp eax, 0xc0000023
je 0x2aa66
xor al, al
jmp 0x2aab6
mov edx, dword [r9]
xor ecx, ecx
mov r8d, 0x34343434
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r9, rax
mov qword [rbx], rax
test rax, rax
je 0x2aa62
mov eax, dword [rdi]
mov r8d, 2
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
jns 0x2aab4
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and qword [rbx], 0
jmp 0x2aa62
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x2aad4
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
xor esi, esi
mov r12, r9
mov rbp, r8
mov r13d, edx
mov r14, rcx
cmp eax, esi
je 0x2ab1c
cmp eax, 0x80000005
je 0x2ab1c
cmp eax, 0xc0000023
je 0x2ab1c
xor al, al
jmp 0x2abb3
mov rbx, qword [rsp + 0x78]
xor ecx, ecx
mov r8d, 0x33333333
mov edx, dword [rbx]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
cmp rax, rsi
je 0x2ab15
mov ebx, dword [rbx]
xor edx, edx
mov rcx, rax
mov r8, rbx
call fcn.000554c0
mov r9, rdi
xor r8d, r8d
mov edx, r13d
mov rcx, r14
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, esi
jge 0x2ab74
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x2ab15
mov r8d, 0x78
cmp dword [rdi + 0xc], r8d
ja 0x2aba5
xor edx, edx
mov rcx, rbp
call fcn.000554c0
mov r8d, dword [rdi + 0xc]
lea rdx, [rdi + 0x10]
mov rcx, rbp
call fcn.000550e0
mov r11d, dword [rdi + 0xc]
mov sil, 1
mov dword [r12], r11d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, sil
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
ret
Function at 0x2abd8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov r13, rcx
lea rcx, [rax - 0x30]
mov ebp, r9d
mov r12, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor edi, edi
lea r11, [rsp + 0x30]
lea rdx, [rsp + 0x38]
lea r8d, [rdi + 2]
mov qword [rsp + 0x28], r11
xor r9d, r9d
mov rcx, r13
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000034
jne 0x2ac36
xor al, al
jmp 0x2acdf
cmp eax, edi
je 0x2ac48
cmp eax, 0x80000005
je 0x2ac48
cmp eax, 0xc0000023
jne 0x2ac2f
mov edx, dword [rsp + 0x30]
xor ecx, ecx
mov r8d, 0x34343434
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, rdi
je 0x2ac2f
mov eax, dword [rsp + 0x30]
mov rsi, qword [rsp + 0x90]
lea rdx, [rsp + 0x38]
mov r9, rbx
mov r8d, 2
mov rcx, r13
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, edi
jge 0x2aca2
mov edx, 0x34343434
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x2ac2f
cmp dword [rbx + 8], ebp
ja 0x2acce
mov r8, rbp
xor edx, edx
mov rcx, r12
call fcn.000554c0
mov r8d, dword [rbx + 8]
lea rdx, [rbx + 0xc]
mov rcx, r12
call fcn.000550e0
mov r11d, dword [rbx + 8]
mov dil, 1
mov dword [rsi], r11d
mov edx, 0x34343434
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, dil
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x2ad74
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x00065100]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor edi, edi
mov rbx, rcx
lea rcx, [rsp + 0x52]
lea r8d, [rdi + 0x76]
xor edx, edx
mov dword [rsp + 0x48], edi
mov word [rsp + 0x50], di
call fcn.000554c0
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rbx
call fcn.0002ad00
cmp al, dil
jne 0x2adcc
xor al, al
jmp 0x2ae7e
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, 0x8000001a
je 0x2ae5c
lea rcx, [rsp + 0x38]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov rcx, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
call fcn.0002aad4
cmp al, dil
je 0x2ae5c
mov rdx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.0002ad00
cmp al, dil
je 0x2ae42
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov rcx, qword [rsp + 0x40]
cmp rcx, rdi
je 0x2adcc
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0x40], rdi
jmp 0x2adcc
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
cmp rcx, rdi
je 0x2ae79
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp ebx, edi
setge al
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.00055060
mov rbx, qword [rsp + 0xf8]
add rsp, 0xe0
pop rdi
ret