joyce8/EMBER2024-capa huggingface dataset:
Function at 0x236f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r14d, r14d
lea rdx, [0x00065080]
xor r8d, r8d
lea r15d, [r14 + 1]
mov byte [rsp + 0x60], 0x46
mov byte [rsp + 0x61], 0x41
mov r9d, r15d
mov ecx, r15d
mov r13d, r14d
mov byte [rsp + 0x62], 0x54
mov byte [rsp + 0x63], 0x31
mov byte [rsp + 0x68], 0x46
mov byte [rsp + 0x69], 0x41
mov byte [rsp + 0x6a], 0x54
mov byte [rsp + 0x6b], 0x33
mov byte [rsp + 0x70], 0x4e
mov byte [rsp + 0x71], 0x54
mov byte [rsp + 0x72], 0x46
mov byte [rsp + 0x73], 0x53
call fcn.00023388
mov r11d, eax
cmp eax, r14d
je 0x2391d
mov esi, dword [rsp + 0x60]
mov ebx, dword [rsp + 0x68]
mov edi, dword [rsp + 0x70]
mov r12d, r14d
lea rbp, [0x00065242]
lea r10, [0x00065480]
cmp dword [rbp + 8], r14d
jne 0x23798
cmp r12d, 4
jge 0x238bd
cmp r12d, 4
jge 0x238bd
mov al, byte [rbp - 4]
cmp al, 0x80
je 0x237f4
test al, al
js 0x237f4
mov al, byte [rbp]
cmp al, 0xf
je 0x237b8
cmp al, 5
jne 0x2380e
mov r8d, dword [rbp + 4]
lea rdx, [0x00065280]
mov r9d, r15d
mov ecx, r15d
call fcn.00023388
mov r11d, eax
cmp eax, r14d
je 0x23816
mov eax, 0xaa55
lea r10, [0x00065480]
cmp word [0x0006547e], ax
jne 0x238b1
jmp 0x238a2
mov al, byte [rbp]
mov r13d, r15d
cmp al, 6
je 0x2381d
cmp al, 0x1b
je 0x2381d
cmp al, 0xc
je 0x2381d
cmp al, 0x1c
je 0x2381d
cmp al, 7
je 0x2381d
cmp al, 0xee
jne 0x238b1
xor eax, eax
jmp 0x23920
mov r8d, dword [rbp + 4]
mov r9d, r15d
mov rdx, r10
mov ecx, r15d
call fcn.00023388
mov r11d, eax
cmp eax, r14d
je 0x23816
mov ecx, 2
movzx eax, r14w
lea r10, [0x00065480]
movzx edx, ax
cmp dword [rdx + r10], 0x444c544e
jne 0x2385f
cmp dword [rdx + r10 + 1], 0x52444c54
je 0x23884
cmp dword [rdx + r10], 0x544f4f42
jne 0x23874
cmp dword [rdx + r10 + 3], 0x52474d54
je 0x23889
add ax, r15w
mov edx, 0x1fc
cmp ax, dx
jae 0x2388c
jmp 0x23847
mov ecx, r14d
jmp 0x2388c
mov ecx, r15d
mov dword [0x0004d308], ecx
cmp edi, dword [0x00065483]
je 0x238a2
cmp ebx, dword [0x000654d2]
jne 0x238a7
mov r11d, r15d
jmp 0x238b1
cmp esi, dword [0x000654b6]
cmove r11d, r15d
add rbp, 0x10
add r12d, r15d
jmp 0x23788
cmp r11d, r14d
je 0x2391d
cmp r13d, r14d
je 0x2390e
mov edx, dword [0x00065256]
cmp edx, r14d
je 0x2391d
mov r8d, dword [0x00065246]
mov eax, dword [0x0006524a]
mov r11d, r14d
add r8d, eax
cmp edx, r8d
sete r11b
cmp r11d, r14d
jne 0x2391d
mov eax, r8d
and eax, 0xfffff000
cmp eax, r8d
je 0x23903
add eax, 0x1000
cmp edx, eax
mov r11d, r14d
sete r11b
jmp 0x2391d
lea rcx, [0x00065080]
call fcn.0002393c
mov r11d, eax
mov eax, r11d
mov rbx, qword [rsp + 0x78]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x2393c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
lea rcx, [0x00065680]
lea rdx, [0x00065080]
mov r8d, 0x200
xor r12d, r12d
mov byte [rsp + 0x60], 0x46
mov byte [rsp + 0x61], 0x41
mov byte [rsp + 0x62], 0x54
mov byte [rsp + 0x63], 0x31
mov byte [rsp + 0x68], 0x46
mov byte [rsp + 0x69], 0x41
mov byte [rsp + 0x6a], 0x54
mov byte [rsp + 0x6b], 0x33
mov byte [rsp + 0x70], 0x4e
mov byte [rsp + 0x71], 0x54
mov byte [rsp + 0x72], 0x46
mov byte [rsp + 0x73], 0x53
call fcn.00040300
mov ebx, dword [rsp + 0x60]
mov edi, dword [rsp + 0x68]
mov esi, dword [rsp + 0x70]
xor r13d, r13d
lea rbp, [0x0006583e]
lea r14d, [r12 + 1]
cmp dword [rbp + 0xc], 0
jne 0x239ce
cmp r13d, 4
jge 0x23a3f
cmp r13d, 4
jge 0x23a3f
mov al, byte [rbp + 4]
cmp al, 6
je 0x239f3
cmp al, 0x1b
je 0x239f3
cmp al, 0xc
je 0x239f3
cmp al, 0x1c
je 0x239f3
cmp al, 7
je 0x239f3
cmp al, 0xee
jne 0x23a28
xor eax, eax
jmp 0x23a42
mov r8d, dword [rbp + 8]
lea rdx, [0x00065480]
mov r9d, r14d
mov ecx, r14d
call fcn.00023388
mov r12d, eax
test eax, eax
je 0x23a42
cmp esi, dword [0x00065483]
je 0x23a31
cmp edi, dword [0x000654d2]
je 0x23a31
cmp ebx, dword [0x000654b6]
je 0x23a31
add rbp, 0x10
add r13d, r14d
jmp 0x239c2
mov r12d, r14d
mov dword [0x00064c5c], r14d
mov byte [rbp], 0x80
mov eax, r12d
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x25804
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
xor edx, edx
mov rsi, rcx
lea r8d, [rdx + 0x48]
mov rcx, rbx
call fcn.000407c0
and qword [rbx + 0x38], 0
xor r8d, r8d
lea rcx, [rbx + 0x20]
lea edx, [r8 + 1]
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
and dword [rbx + 0x40], 0
lea rax, [0x00025754]
mov qword [rsp + 0x30], rbx
lea rcx, [rbx + 0x10]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov dword [rsi], eax
test eax, eax
jns 0x25886
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
jmp 0x258bf
mov rcx, qword [rbx + 0x10]
and qword [rsp + 0x28], 0
lea rax, [rbx + 0x18]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [rsi], eax
test eax, eax
jns 0x258bc
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x25877
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x2694c
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x90
mov rax, qword [0x0004b108]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ebx, ebx
mov r12, rcx
cmp dword [0x00065a58], ebx
je 0x2699b
movdqu xmm0, xmmword [0x00062080]
lea eax, [rbx + 1]
movdqu xmmword [rcx], xmm0
jmp 0x26a8b
mov ebp, 0x2000
mov r8d, 0x33363053
mov ecx, 1
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r14, rax
cmp rax, rbx
je 0x26a7f
mov edx, ebp
mov rcx, rax
call fcn.0002c46c
movsxd rdi, eax
cmp edi, ebx
jl 0x26a12
lea r13, [r14 + rdi]
sub ebp, edi
mov rcx, r13
mov edx, ebp
call fcn.0002c52c
movsxd r11, eax
cmp r11d, ebx
jle 0x269ee
mov byte [r13], 0x7c
jl 0x26a12
add r13, r11
sub ebp, r11d
add edi, r11d
mov edx, ebp
mov rcx, r13
call fcn.0002c7a0
cmp eax, ebx
jle 0x26a0c
mov byte [r13], 0x7c
jl 0x26a12
add edi, eax
jmp 0x26a15
or edi, 0xffffffff
cmp edi, ebx
jl 0x26a89
je 0x26a89
lea rcx, [rsp + 0x20]
mov r8d, edi
mov rdx, r14
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
call fcn.0002e248
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.0002e304
mov dword [0x00065a58], 1
mov ebx, 1
movdqu xmm5, xmmword [r12]
movdqu xmmword [0x00062080], xmm5
jmp 0x26a89
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.00040240
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x26fa8
Capabilities:
Hash data with md5

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
sub rsp, 0x110
mov rax, qword [0x0004b108]
xor rax, rsp
mov qword [rsp + 0x100], rax
xor ebx, ebx
mov esi, 0x400
mov r8d, 0x33363053
lea r13d, [rbx + 1]
mov rdx, rsi
mov ecx, r13d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x271a4
lea r8d, [rbx + 0x38]
lea rcx, [rsp + 0x48]
xor edx, edx
call fcn.000407c0
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x48]
mov edx, esi
mov rcx, rdi
call fcn.00026ac0
test eax, eax
je 0x27199
mov eax, dword [rsp + 0x34]
lea ecx, [r13 + 0x7f]
mov r8d, 0x33363053
cmp eax, ecx
mov ebx, r13d
cmovb eax, ecx
mov ecx, r13d
lea ebp, [rax + rax]
cmp ebp, esi
cmova ebp, esi
mov edx, ebp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
je 0x27199
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x48]
mov edx, ebp
mov rcx, rax
call fcn.00026dcc
test eax, eax
jne 0x27080
mov eax, r13d
jmp 0x271a6
mov r8d, dword [rsp + 0x30]
and dword [rsp + 0x94], 0
and dword [rsp + 0x90], 0
lea rcx, [rsp + 0x80]
mov rdx, rsi
mov dword [rsp + 0x80], 0x67452301
mov dword [rsp + 0x84], 0xefcdab89
mov dword [rsp + 0x88], 0x98badcfe
mov dword [rsp + 0x8c], 0x10325476
call fcn.0002e248
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xf0]
call fcn.0002e304
mov r9d, dword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
lea rax, [0x00044a10]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0x10
call fcn.0002ba48
test eax, eax
jne 0x2718e
lea rax, [rsp + 0xf0]
lea rcx, [rsp + 0xe0]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x27140
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x27140
xor eax, eax
jmp 0x27145
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x2718e
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x27189
lea rdx, [rsp + 0x40]
call fcn.00029ed8
test eax, eax
je 0x2718e
cmp qword [rsp + 0x40], 0
je 0x27189
xor ecx, ecx
movabs rax, 0xfffff78000000014
mov ebx, 2
mov rax, qword [rax]
cmp rax, qword [rsp + 0x40]
setg cl
test ecx, ecx
jne 0x2718e
mov ebx, 3
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.00040240
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret
Function at 0x271f8
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xb0
mov rax, qword [0x0004b108]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, qword [rsp + 0x100]
xor ebx, ebx
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov rbp, r9
mov esi, r8d
mov r12, rdx
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
lea r8, [0x000271dc]
lea edx, [rbx + 0xf]
mov dword [rsp + 0x54], ebx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x40], 0x67452301
mov dword [rsp + 0x44], 0xefcdab89
mov dword [rsp + 0x48], 0x98badcfe
mov dword [rsp + 0x4c], 0x10325476
call fcn.0002acf8
cmp eax, ebx
jne 0x27283
xor eax, eax
jmp 0x272bb
cmp esi, ebx
jbe 0x27297
lea rcx, [rsp + 0x40]
mov r8d, esi
mov rdx, r12
call fcn.0002e248
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.0002e304
cmp rdi, rbx
je 0x272b6
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x30], eax
sete bl
mov dword [rdi], ebx
mov eax, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.00040240
add rsp, 0xb0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x272e0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0xc0
mov rax, qword [0x0004b108]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov eax, dword [rcx + 8]
and dword [rsp + 0x64], 0
and dword [rsp + 0x60], 0
mov qword [rcx + 0xcbc], rax
mov dword [rcx + 0xcc4], 4
mov r13d, 1
mov dword [rcx + 0xcc8], r13d
mov dword [rcx + 0xccc], r13d
mov eax, dword [rcx + 0xc]
and dword [rcx + 0xce4], 0
mov dword [rcx + 0xcdc], 8
mov dword [rcx + 0xce0], r13d
mov qword [rcx + 0xcd4], rax
mov eax, dword [rcx + 0x20]
and dword [rcx + 0xcf4], 0
and dword [rcx + 0xcfc], 0
mov rsi, rdx
mov qword [rcx + 0xcec], rax
mov rbp, rcx
mov dword [rcx + 0xcf8], r13d
lea edx, [r13 + 0x47]
mov ecx, r13d
mov r8d, 0x33363053
mov dword [rsp + 0x50], 0x67452301
mov dword [rsp + 0x54], 0xefcdab89
mov dword [rsp + 0x58], 0x98badcfe
mov dword [rsp + 0x5c], 0x10325476
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x27413
lea r8d, [r13 + 0x47]
lea rdx, [rbp + 0xcbc]
mov rcx, rax
call fcn.00040300
lea r11, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], r11
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea r9, [0x000271dc]
lea r8d, [r13 + 2]
mov rdx, rbx
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.0002a838
xor edx, edx
mov rcx, rbx
test eax, eax
jne 0x2743d
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.00040240
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop rdi
pop rsi
ret
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.0002e304
mov eax, r13d
jmp 0x27415
Function at 0x27920
Capabilities:
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0xa0
xor ebx, ebx
mov dword [rax - 0x68], 0x67452301
mov dword [rax - 0x64], 0xefcdab89
mov dword [rax - 0x60], 0x98badcfe
mov dword [rax - 0x5c], 0x10325476
mov dword [rax - 0x58], 0xc3d2e1f0
mov dword [rax - 0x50], ebx
mov dword [rax - 0x54], ebx
lea rax, [rax - 0x78]
mov qword [rsp + 0x28], rax
mov rbp, r9
mov edi, r8d
mov rsi, rdx
lea rax, [rsp + 0x34]
lea edx, [rbx + 0xf]
lea r9, [rsp + 0x40]
lea r8, [0x00027904]
mov qword [rsp + 0x20], rax
call fcn.0002acf8
cmp eax, ebx
jne 0x2799a
xor eax, eax
jmp 0x279eb
cmp edi, ebx
jbe 0x279ae
lea rcx, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
call fcn.00027f9c
lea rcx, [rsp + 0x40]
call fcn.0002804c
lea rdx, [rsp + 0x40]
mov rcx, rbp
mov r8d, 0x14
call fcn.00040300
mov r11, qword [rsp + 0xd0]
cmp r11, rbx
je 0x279e6
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x34], eax
sete bl
mov dword [r11], ebx
mov eax, 1
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x27a0c
Capabilities:
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
sub rsp, 0x120
mov rax, qword [0x0004b108]
xor rax, rsp
mov qword [rsp + 0x118], rax
xor ebx, ebx
mov esi, 0x400
mov r8d, 0x33363053
lea r13d, [rbx + 1]
mov rdx, rsi
mov ecx, r13d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x27c2c
lea r8d, [rbx + 0x38]
lea rcx, [rsp + 0xb0]
xor edx, edx
call fcn.000407c0
lea r9, [rsp + 0x34]
lea r8, [rsp + 0xb0]
mov edx, esi
mov rcx, rdi
call fcn.00026ac0
test eax, eax
je 0x27c21
mov eax, dword [rsp + 0x34]
lea ecx, [r13 + 0x7f]
mov r8d, 0x33363053
cmp eax, ecx
mov ebx, r13d
cmovb eax, ecx
mov ecx, r13d
lea ebp, [rax + rax]
cmp ebp, esi
cmova ebp, esi
mov edx, ebp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
je 0x27c21
lea r9, [rsp + 0x30]
lea r8, [rsp + 0xb0]
mov edx, ebp
mov rcx, rax
call fcn.00026dcc
test eax, eax
jne 0x27aed
mov eax, r13d
jmp 0x27c2e
mov r8d, dword [rsp + 0x30]
and dword [rsp + 0x68], 0
and dword [rsp + 0x64], 0
lea rcx, [rsp + 0x50]
mov rdx, rsi
mov dword [rsp + 0x50], 0x67452301
mov dword [rsp + 0x54], 0xefcdab89
mov dword [rsp + 0x58], 0x98badcfe
mov dword [rsp + 0x5c], 0x10325476
mov dword [rsp + 0x60], 0xc3d2e1f0
call fcn.00027f9c
lea rcx, [rsp + 0x50]
call fcn.0002804c
mov r9d, dword [rsp + 0xd8]
mov r8, qword [rsp + 0xe0]
lea rcx, [rsp + 0x50]
lea r11, [rsp + 0x100]
lea rdx, [rsp + 0x38]
mov rax, qword [rcx]
mov dword [rsp + 0x38], 0x14
mov qword [r11], rax
mov rax, qword [rcx + 8]
mov qword [r11 + 8], rax
mov eax, dword [rcx + 0x10]
lea rcx, [rsp + 0xe8]
mov dword [r11 + 0x10], eax
lea rax, [0x00044e50]
mov qword [rsp + 0x20], rax
call fcn.0002ba48
test eax, eax
jne 0x27c16
lea rax, [rsp + 0x100]
lea rcx, [rsp + 0xe8]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x27bc5
mov rdx, qword [rax + 8]
cmp rdx, qword [rcx + 8]
jne 0x27bc5
mov edx, dword [rax + 0x10]
cmp edx, dword [rcx + 0x10]
jne 0x27bc5
xor eax, eax
jmp 0x27bca
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x27c16
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x27c11
lea rdx, [rsp + 0x40]
call fcn.00029ed8
test eax, eax
je 0x27c16
cmp qword [rsp + 0x40], 0
je 0x27c11
xor ecx, ecx
movabs rax, 0xfffff78000000014
mov ebx, 2
mov rax, qword [rax]
cmp rax, qword [rsp + 0x40]
setg cl
test ecx, ecx
jne 0x27c16
mov ebx, 3
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.00040240
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret
Function at 0x28120
Capabilities:
Encode data using xor

Disassembly:
movsxd rax, edx
xor r8d, r8d
mov r10, rcx
shr rax, 2
cmp eax, r8d
jle 0x2815f
movsxd r9, eax
mov edx, dword [r10 + r8*4]
rol edx, 0x10
mov ecx, edx
mov eax, edx
shl edx, 8
shr ecx, 8
shl eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, edx
mov dword [r10 + r8*4], ecx
inc r8
cmp r8, r9
jl 0x28135
repz ret

Function at 0x29b34
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
lea rax, [r11 - 0x28]
mov rbp, r9
mov r12, r8
mov qword [r11 - 0x30], rax
xor esi, esi
xor r9d, r9d
xor r8d, r8d
mov ebx, edx
mov r13, rcx
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, 0xc0000023
jne 0x29bf3
mov edx, dword [rsp + 0x30]
lea ecx, [rsi + 1]
mov r8d, 0x33363053
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
cmp rax, rsi
je 0x29bf3
mov ecx, dword [rsp + 0x30]
lea rax, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
xor r8d, r8d
mov rcx, r13
mov edx, ebx
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, esi
jne 0x29be8
mov ebx, dword [rdi + 0xc]
shr ebx, 1
mov dword [rsp + 0x30], ebx
lea eax, [rbx + 1]
cmp dword [rbp], eax
jb 0x29be8
mov r8d, dword [rdi + 0xc]
lea rdx, [rdi + 0x10]
mov rcx, r12
mov dword [rbp], ebx
call fcn.00040300
mov word [r12 + rbx*2], si
mov esi, 1
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov eax, esi
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x29c14
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x50
mov rbp, rcx
lea rcx, [rax - 0x20]
mov r12, r9
mov rsi, r8
xor edi, edi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rsp + 0x30]
lea r8d, [rdi + 2]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], r11
xor r9d, r9d
mov rcx, rbp
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000023
jne 0x29cf9
mov edx, dword [rsp + 0x30]
lea ecx, [rdi + 1]
mov r8d, 0x33363053
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, rdi
je 0x29cf9
mov ecx, dword [rsp + 0x30]
lea rax, [rsp + 0x30]
lea r8d, [rdi + 2]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x38]
mov rcx, rbp
mov r9, rbx
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, edi
jne 0x29cee
cmp rsi, rdi
je 0x29cc0
mov eax, dword [rbx + 4]
mov dword [rsi], eax
mov rsi, qword [rsp + 0x80]
mov eax, dword [rbx + 8]
cmp dword [rsi], eax
jae 0x29cd3
mov dword [rsi], eax
jmp 0x29cee
lea rdx, [rbx + 0xc]
mov r8, rax
mov rcx, r12
call fcn.00040300
mov r11d, dword [rbx + 8]
mov edi, 1
mov dword [rsi], r11d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, edi
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
Function at 0x29d1c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x80
mov rbp, rcx
lea rdx, str.ServiceName
lea rcx, [rax - 0x20]
mov r12, r9
mov rsi, r8
xor edi, edi
xor ebx, ebx
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x58]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
test eax, eax
jne 0x29eaf
lea rax, [rsp + 0x30]
lea r8d, [rdi + 2]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], ebx
xor r9d, r9d
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000023
jne 0x29e94
mov edx, dword [rsp + 0x30]
lea ecx, [rdi + 1]
mov r8d, 0x33363053
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x29e94
lea rax, [rsp + 0x30]
lea r8d, [rdi + 2]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
jne 0x29e94
test rsi, rsi
je 0x29df7
mov eax, dword [rbx + 4]
mov dword [rsi], eax
mov eax, dword [rbx + 4]
test eax, eax
je 0x29e6e
cmp eax, 2
jbe 0x29e08
cmp eax, 7
jne 0x29e6e
lea rax, [rbx + 0xc]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x50], rax
movzx eax, word [rbx + 8]
mov r8b, 1
mov word [rsp + 0x4a], ax
mov word [rsp + 0x48], ax
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
test eax, eax
jne 0x29e94
mov rcx, qword [rsp + 0xb0]
movzx eax, word [rsp + 0x38]
cmp dword [rcx], eax
jb 0x29e61
movzx r8d, word [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov dword [rcx], eax
mov rcx, r12
call fcn.00040300
mov edi, 1
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
jmp 0x29e94
mov rcx, qword [rsp + 0xb0]
mov eax, dword [rbx + 8]
cmp dword [rcx], eax
jb 0x29e94
mov dword [rcx], eax
mov r8d, dword [rbx + 8]
lea rdx, [rbx + 0xc]
mov rcx, r12
call fcn.00040300
mov edi, 1
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
test rbx, rbx
je 0x29eaf
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea r11, [rsp + 0x80]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x2a01c
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x60
and qword [r11 - 0x28], 0
lea rax, [r11 + 0x10]
mov ebx, r9d
mov qword [r11 - 0x30], rax
lea rax, [r11 - 0x18]
mov dword [rsp + 0x30], ebx
mov qword [r11 - 0x40], r8
mov qword [r11 + 0x10], rdx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [r11 - 0x48], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
jne 0x2a067
cmp ebx, dword [rsp + 0x58]
jne 0x2a067
mov eax, 1
jmp 0x2a069
xor eax, eax
add rsp, 0x60
pop rbx
ret
Function at 0x2a078
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rdx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
je 0x2a0a7
xor eax, eax
jmp 0x2a0b4
mov rax, qword [rsp + 0x48]
mov qword [rbx], rax
mov eax, 1
add rsp, 0x60
pop rbx
ret