joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003cf0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140003d20
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140003d98
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140003d37
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140003d39
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140003d92
test ecx, ecx
jle 0x140003d72
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140003d92
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140003d92
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140003db4
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140003dd4
xor eax, eax
jmp 0x140003ebd
cmp qword [rcx + 0x68], 0
je 0x140003de6
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140003ebd
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140003dfd
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140003dff
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140003e31
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140003eb7
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140003e68
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140003e92
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x140003eb7
cmp rdi, rbx
ja 0x140003e6f
test rdi, rdi
je 0x140003eb7
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400043a4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140075040]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x1400043dd
xor eax, eax
jmp 0x1400044fd
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x140004417
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x140004417
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x1400044fd
cmp qword [rbx + 0x80], 0
je 0x1400044fb
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140004452
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140004473
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
jmp 0x1400044f8
lea rax, [rbp - 0x40]
mov byte [rbp - 0x30], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x2f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x30]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400044c1
sub eax, 1
je 0x1400044c1
cmp eax, 2
jne 0x1400044fb
movsx ecx, byte [rbp - 0x30]
jmp 0x14000445f
mov r14, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x1400044ec
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x1400044fb
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x38], rax
cmovne edi, esi
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140041740
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140004938
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140075040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400049a7
cmp byte [rcx + 0x71], 0
je 0x1400049a7
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400049fc
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400049c1
sub eax, 1
je 0x1400049c5
cmp eax, 2
jne 0x1400049fc
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140041740
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400049f3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400049fc
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400049a9
xor al, al
jmp 0x1400049a9

Function at 0x140006ee8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
not r8d
movzx eax, byte [rcx]
inc rcx
movzx r9d, r8b
xor r9, rax
shr r8d, 8
lea rax, [0x140069fd0]
xor r8d, dword [rax + r9*4]
sub rdx, 1
jne 0x140006eeb
not r8d
mov eax, r8d
ret

Function at 0x140006f14
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x140006f6e
mov r11b, 0x23
lea rdi, [0x140069fd0]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x140006f58
cmp rdx, 2
jb 0x140006f58
cmp byte [r10], r11b
jne 0x140006f58
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x140006f36
jmp 0x140006faf
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x140006faf
mov r11b, 0x23
lea rdi, [0x140069fd0]
cmp dl, r11b
jne 0x140006f93
cmp byte [r10], r11b
jne 0x140006f93
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x140006f81
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x1400312e4
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
mov r11, rdx
mov eax, 0x5e6ea9af
mul r8d
mov ebx, r8d
xor r9d, r9d
shr edx, 0xb
mov r10d, 1
imul eax, edx, 0x15b0
sub ebx, eax
test r8d, r8d
je 0x1400313d6
xor ecx, ecx
cmp ebx, 7
jbe 0x140031383
lea edx, [rcx + 7]
movzx eax, byte [r11]
add ecx, 8
add r10d, eax
add edx, 8
movzx eax, byte [r11 + 1]
add r9d, r10d
add r10d, eax
movzx eax, byte [r11 + 2]
add r9d, r10d
add r10d, eax
movzx eax, byte [r11 + 3]
add r9d, r10d
add r10d, eax
movzx eax, byte [r11 + 4]
add r9d, r10d
add r10d, eax
movzx eax, byte [r11 + 5]
add r9d, r10d
add r10d, eax
movzx eax, byte [r11 + 6]
add r9d, r10d
add r10d, eax
movzx eax, byte [r11 + 7]
add r9d, r10d
add r10d, eax
add r11, 8
add r9d, r10d
cmp edx, ebx
jb 0x14003131e
cmp ecx, ebx
jae 0x1400313a0
mov eax, ebx
sub eax, ecx
mov ecx, eax
movzx eax, byte [r11]
inc r11
add r10d, eax
add r9d, r10d
sub rcx, 1
jne 0x14003138d
mov eax, 0x80078071
mul r10d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r10d, eax
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul ecx, edx, 0xffff000f
add r9d, ecx
sub r8d, ebx
mov ebx, 0x15b0
jne 0x140031314
mov rbx, qword [rsp + 8]
shl r9d, 0x10
lea eax, [r10 + r9]
ret
Function at 0x140033350
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
Function at 0x140042380
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400423ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400423ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400423ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400423ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400423ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400423cc
xor al, al
add rsp, 0x28
ret
Function at 0x140002d90
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, edx
mov rdi, rcx
mov edx, 4
call fcn.140002358
mov r8d, ebx
mov edx, 4
shl r8d, 0x10
mov rcx, rdi
not r8d
and r8d, eax
call fcn.140002368
mov rdx, qword [rdi + 0xc0]
xor r8d, r8d
shl ebx, 0x18
add rdx, 4
mov dword [rsp + 0x28], 0xc350
mov r9d, ebx
mov rcx, rdi
mov dword [rsp + 0x20], 0x1f4
call fcn.14000238c
mov ebx, eax
test eax, eax
jns 0x140002e08
lea rdx, [0x14000b410]
lea rcx, [0x14000b3a0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140002e18
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov edi, edx
mov rsi, rcx
and edi, dword [rcx + 0x188]
jne 0x140002e40
xor eax, eax
jmp 0x140002eea
mov ebx, edi
mov edx, 4
shl ebx, 0x10
call fcn.140002358
mov r8d, eax
mov edx, 4
mov eax, ebx
mov rcx, rsi
not eax
and r8d, eax
or r8d, ebx
call fcn.140002368
mov edx, 0x3e8
mov rcx, rsi
call fcn.140002d14
mov rdx, qword [rsi + 0xc0]
mov ebx, edi
shl ebx, 0x18
add rdx, 4
mov r9d, ebx
mov dword [rsp + 0x28], 0xc350
mov r8d, ebx
mov dword [rsp + 0x20], 0x1f4
mov rcx, rsi
call fcn.14000238c
mov ebp, eax
test eax, eax
jns 0x140002ebd
lea rdx, [0x14000b380]
lea rcx, [0x14000b3a0]
call sub.ntoskrnl.exe_DbgPrint
mov edx, 4
mov rcx, rsi
call fcn.140002358
mov ecx, ebx
and ecx, eax
cmp ecx, ebx
je 0x140002ee8
mov r8d, eax
lea rcx, [0x14000b3d0]
mov edx, edi
call sub.ntoskrnl.exe_DbgPrint
mov ebp, 0xc000009e
mov eax, ebp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140002f00
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov rsi, rcx
and ebx, dword [rcx + 0x188]
jne 0x140002f20
xor eax, eax
jmp 0x140002f88
mov edx, ebx
call fcn.1400030ac
mov edi, eax
lfence
mov edx, ebx
test eax, eax
jns 0x140002f40
lea rcx, [0x14000b520]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140002f86
mov rcx, rsi
call fcn.140002d90
mov edi, eax
lfence
mov edx, ebx
test eax, eax
jns 0x140002f64
mov r8d, eax
lea rcx, [0x14000b550]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140002f86
mov rcx, rsi
call fcn.140002d4c
test al, al
je 0x140002f86
mov r8d, edi
lea rcx, [0x14000b580]
mov edx, ebx
call sub.ntoskrnl.exe_DbgPrint
mov edi, 0xc000009e
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002f98
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov edi, edx
mov rsi, rcx
mov edx, 4
call fcn.140002358
mov r8d, edi
mov edx, 4
not r8d
mov rcx, rsi
and r8d, eax
call fcn.140002368
mov rdx, qword [rsi + 0xc0]
mov r9d, edi
add rdx, 4
mov dword [rsp + 0x28], 0xc350
xor r8d, r8d
mov dword [rsp + 0x20], 0x1f4
mov rcx, rsi
call fcn.14000238c
mov ebx, eax
lfence
test eax, eax
jns 0x140003016
lea rdx, [0x14000b490]
lea rcx, [0x14000b3a0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140003097
mov edx, 4
mov rcx, rsi
call fcn.140002358
lfence
test edi, eax
je 0x140003042
mov r8d, eax
lea rcx, [0x14000b4b0]
mov edx, edi
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc000009e
jmp 0x140003099
mov edx, 4
mov rcx, rsi
call fcn.140002358
mov r8d, edi
mov edx, 4
shl r8d, 8
mov rcx, rsi
not r8d
and r8d, eax
call fcn.140002368
mov edx, edi
mov rcx, rsi
call fcn.140002d4c
test al, al
jne 0x140003097
lfence
mov edx, edi
mov rcx, rsi
call fcn.1400030ac
mov edx, edi
lea rcx, [0x14000b4f0]
call sub.ntoskrnl.exe_DbgPrint
mov ebx, 0xc000009e
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400030ac
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov edi, edx
mov esi, edx
shl edi, 8
mov r14d, 4
mov ebx, edi
mov edx, r14d
not ebx
mov rbp, rcx
call fcn.140002358
and eax, ebx
mov edx, r14d
or eax, edi
mov rcx, rbp
mov r8d, eax
call fcn.140002368
mov edx, r14d
mov rcx, rbp
call fcn.140002358
mov r8d, eax
mov edx, r14d
mov eax, esi
mov rcx, rbp
not eax
and r8d, eax
or r8d, esi
call fcn.140002368
mov edx, r14d
mov rcx, rbp
call fcn.140002358
and eax, ebx
mov edx, r14d
or eax, edi
mov rcx, rbp
mov r8d, eax
call fcn.140002368
mov rdx, qword [rbp + 0xc0]
mov r9d, esi
add rdx, r14
mov dword [rsp + 0x28], 0xc350
mov r8d, esi
mov dword [rsp + 0x20], 0x1f4
mov rcx, rbp
call fcn.14000238c
mov ebx, eax
lfence
test eax, eax
jns 0x140003179
lea rdx, [0x14000b430]
lea rcx, [0x14000b3a0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400031a2
mov edx, r14d
mov rcx, rbp
call fcn.140002358
mov ecx, eax
and ecx, esi
cmp ecx, esi
je 0x1400031a2
mov r8d, eax
lea rcx, [0x14000b450]
mov edx, esi
call sub.ntoskrnl.exe_DbgPrint
mov ebx, 0xc000009e
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140003488
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
and dword [rcx + 0x30c], 0
mov rbx, rcx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov rax, qword [rbx + 0x48]
lea rcx, [rbx + 0xd8]
mov qword [rsp + 0x28], rcx
lea rsi, [rbx + 0xd0]
lea rcx, [rsp + 0x40]
xorps xmm0, xmm0
mov qword [rsp + 0x20], rcx
lea r8, [rbx + 0xc0]
mov rcx, qword [rbx + 0x28]
lea rdx, [rbx + 0xb0]
mov r9, rsi
movups xmmword [rsp + 0x40], xmm0
call qword [0x14000d228]
lfence
test eax, eax
js 0x140003725
mov rax, qword [rbx + 0x50]
mov edx, 1
mov rcx, qword [rbx + 0x28]
call qword [0x14000d228]
test eax, eax
js 0x140003722
and qword [rbx + 0x3e0], 0
lea rcx, [rbx + 0x3e8]
xor edx, edx
mov dword [rbx + 0x30c], 1
lea r8d, [rdx + 0x50]
call fcn.14000ae80
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbx + 0x3a0], xmm0
movups xmmword [rbx + 0x3b0], xmm0
movups xmmword [rbx + 0x3c0], xmm1
movups xmmword [rbx + 0x3d0], xmm0
mov ecx, dword [rbx + 0x118]
and dword [rbx + 0x310], 0
mov dword [rbx + 0x3a0], 0x81000
lea eax, [rcx - 4]
cmp eax, 2
jbe 0x1400035d6
cmp ecx, 2
jne 0x14000358e
lea rdx, [0x14000b750]
jmp 0x14000367c
cmp ecx, 3
jne 0x14000359f
lea rdx, [0x14000b7a0]
jmp 0x14000367c
cmp ecx, 1
jne 0x1400035b0
lea rdx, [0x14000b7f0]
jmp 0x14000367c
test ecx, ecx
jne 0x1400035c0
lea rdx, [0x14000b840]
jmp 0x14000367c
lea rcx, [0x14000b890]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000010
jmp 0x140003722
call fcn.1400097b4
mov edi, eax
test eax, eax
je 0x140003675
cmp dword [rbx + 0x118], 4
jne 0x140003636
lea rdx, [0x14000b5b0]
lea rcx, [rsp + 0x60]
call fcn.1400094a4
test eax, eax
js 0x14000362d
lfence
mov rcx, qword [rsp + 0x60]
call fcn.140009474
mov edx, edi
lea rcx, [0x14000b610]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x14000b5b0]
mov dword [rbx + 0x310], edi
jmp 0x14000367f
cmp dword [rbx + 0x118], 4
je 0x140003675
lea rdx, [0x14000b650]
lea rcx, [rsp + 0x60]
call fcn.1400094a4
test eax, eax
js 0x140003675
lfence
mov rcx, qword [rsp + 0x60]
call fcn.140009474
mov edx, edi
lea rcx, [0x14000b6b0]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [0x14000b650]
mov dword [rbx + 0x310], edi
jmp 0x14000367f
lea rdx, [0x14000b700]
lfence
mov rcx, rbx
call fcn.1400092d8
test eax, eax
js 0x140003722
lfence
mov rcx, qword [rsi]
add rcx, 4
call fcn.140002388
mov rcx, qword [rsi]
bts eax, 0x1e
add rcx, 4
mov edx, eax
call fcn.140002d48
mov rcx, qword [rsi]
add rcx, 4
call fcn.140002388
mov rcx, qword [rsi]
bts eax, 0x1f
add rcx, 4
mov edx, eax
call fcn.140002d48
xor edx, edx
mov rcx, rbx
call fcn.1400031c0
test eax, eax
js 0x140003722
mov eax, dword [rbx + 0x118]
sub eax, 4
lfence
mov rcx, rbx
cmp eax, 2
jbe 0x1400036f7
call fcn.140008d1c
jmp 0x1400036fc
call fcn.140008ed0
lfence
test eax, eax
js 0x140003725
jmp 0x14000370f
mov edx, 0x64
call fcn.140002d14
cmp dword [rbx + 0x320], 0
mov rcx, rbx
je 0x140003705
mov dl, 1
call fcn.1400031c0
lfence
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400038ac
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
and qword [rbp + 0x30], 0
lea rdx, [0x14000b8a0]
mov rsi, rcx
lea rcx, [rbp - 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp - 0x28], 0
lea rax, [rbp - 0x50]
xorps xmm0, xmm0
mov qword [rbp - 0x20], rax
lea r8, [rbp - 0x30]
mov dword [rbp - 0x30], 0x30
mov edx, 0x20019
mov dword [rbp - 0x18], 0x240
lea rcx, [rbp + 0x30]
movdqu xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jns 0x140003919
lfence
jmp 0x1400039ce
mov edi, 0x110
mov r8d, 0x5341534d
mov edx, edi
mov ecx, 0x400
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp byte [0x140018e70], 0
mov rbx, rax
jne 0x14000399a
test rax, rax
je 0x14000399f
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.14000ae80
lea rdx, [0x14000b930]
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x40]
mov r9, rbx
mov dword [rsp + 0x20], edi
mov r8d, 2
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov edi, eax
test eax, eax
js 0x1400039be
cmp dword [rbx + 8], 0x100
jbe 0x1400039a6
mov edi, 0x80000005
jmp 0x1400039be
test rbx, rbx
jne 0x14000394f
mov edi, 0xc0000017
jmp 0x1400039cc
lfence
xor eax, eax
lea rdx, [rbx + 0xc]
mov qword [rsi], rax
mov rcx, rsi
mov r8d, dword [rbx + 8]
call fcn.14000b080
mov edx, 0x5341534d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400039e4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
and qword [rbp + 0x30], 0
lea rdx, [0x14000b8a0]
mov rsi, rcx
lea rcx, [rbp - 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp - 0x28], 0
lea rax, [rbp - 0x50]
xorps xmm0, xmm0
mov qword [rbp - 0x20], rax
lea r8, [rbp - 0x30]
mov dword [rbp - 0x30], 0x30
mov edx, 0x20019
mov dword [rbp - 0x18], 0x240
lea rcx, [rbp + 0x30]
movdqu xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jns 0x140003a51
lfence
jmp 0x140003b06
mov edi, 0x110
mov r8d, 0x5341534d
mov edx, edi
mov ecx, 0x400
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp byte [0x140018e70], 0
mov rbx, rax
jne 0x140003ad2
test rax, rax
je 0x140003ad7
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.14000ae80
lea rdx, [0x14000b910]
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x40]
mov r9, rbx
mov dword [rsp + 0x20], edi
mov r8d, 2
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov edi, eax
test eax, eax
js 0x140003af6
cmp dword [rbx + 8], 0x100
jbe 0x140003ade
mov edi, 0x80000005
jmp 0x140003af6
test rbx, rbx
jne 0x140003a87
mov edi, 0xc0000017
jmp 0x140003b04
lfence
xor eax, eax
lea rdx, [rbx + 0xc]
mov qword [rsi], rax
mov rcx, rsi
mov r8d, dword [rbx + 8]
call fcn.14000b080
mov edx, 0x5341534d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret