joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1a9ac
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, rcx
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x1a9ed
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
xor bl, bl
mov qword [rsp + 0x20], rax
jmp 0x1aa0d
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1aa06
xor al, al
jmp 0x1ab08
mov rax, qword [rsp + 0x20]
mov bl, 1
mov rcx, rax
call fcn.00039bee
mov rdx, rax
test rax, rax
jne 0x1aa2e
test bl, bl
je 0x1a9ff
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1a9ff
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x0003ad90]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [0x0003ad90]
call qword [sym.imp.ntoskrnl.exe__strnicmp]
test eax, eax
sete dil
test bl, bl
je 0x1aa6c
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
and qword [rsp + 0x20], 0
test dil, dil
je 0x1a9ff
mov rcx, rsi
call fcn.00025f0c
mov rbx, rax
test rax, rax
je 0x1a9ff
lea r8, [0x0003ada0]
lea rcx, [rsp + 0x30]
movabs r9, 0xfffff78000000030
mov edx, 0x32
call fcn.0002e3a0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
mov rdx, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe__wcsnicmp]
test eax, eax
sete dil
test dil, dil
je 0x1aafd
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_wcsrchr]
test rax, rax
je 0x1aafd
lea rcx, [rax + 2]
lea rdx, [0x0003adc0]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
sete dil
mov rcx, rbx
call fcn.00035504
mov al, dil
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.00039b80
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1d900
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
and qword [rax + 0x18], 0
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
jne 0x1d947
lea rdx, [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1d947
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessSectionBaseAddress]
mov rcx, qword [rsp + 0x48]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, rdi
call fcn.00032480
mov rsi, rax
test rax, rax
jne 0x1d95b
xor eax, eax
jmp 0x1d9c5
mov edx, 0x400
mov ecx, 1
call fcn.0003548c
mov rdi, rax
test rax, rax
je 0x1d957
xor edx, edx
mov r8d, 0x400
mov rcx, rax
call fcn.0003a1a0
lea r11, [rsp + 0x50]
mov r9, rdi
mov qword [rsp + 0x28], r11
mov r8d, 2
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], 0x3fe
call fcn.0001d694
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
jns 0x1d9c2
mov rcx, rdi
call fcn.00035504
jmp 0x1d957
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1de20
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x70
mov rdi, rdx
lea rcx, [rsp + 0x50]
mov rdx, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
test eax, eax
js 0x1dec9
lea rcx, [rsp + 0x60]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov edi, eax
test eax, eax
js 0x1debc
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
mov r9d, 1
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
xor ecx, ecx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x0003a8d0]
call qword [sym.imp.ntoskrnl.exe_RtlWriteRegistryValue]
lea rcx, [rsp + 0x40]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov eax, edi
add rsp, 0x70
pop rdi
ret

Function at 0x1df20
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0xb0
xor edi, edi
lea rax, [0x0001ded8]
mov qword [r11 - 0x78], rax
mov dword [rsp + 0x48], 4
mov qword [r11 - 0x60], rdi
lea rax, [0x0003a800]
lea edx, [rdi + 0x10]
lea ecx, [rdi + 1]
mov qword [r11 - 0x68], rax
mov dword [rsp + 0x60], edi
mov qword [r11 - 0x50], rdi
mov dword [rsp + 0x70], edi
mov qword [r11 - 0x40], rdi
mov dword [r11 - 0x38], edi
mov qword [r11 - 0x30], rdi
mov qword [r11 - 0x28], rdi
mov dword [r11 - 0x20], edi
mov qword [r11 - 0x18], rdi
mov dword [r11 - 0x10], edi
call fcn.0003548c
mov rbx, rax
mov qword [rsp + 0x58], rax
cmp rax, rdi
jne 0x1df97
xor eax, eax
jmp 0x1dfe1
xor eax, eax
lea rdx, [0x0003a4c0]
lea rcx, [rsp + 0x30]
mov qword [rbx], rax
mov qword [rbx + 8], rax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0x40]
lea rdx, [0x0003a8d0]
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp eax, edi
jge 0x1dfdc
mov rcx, rbx
call fcn.00035504
jmp 0x1df93
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rdi
ret
Function at 0x1dff8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0xa0
xor ebp, ebp
lea rax, [0x0001ded8]
mov rdi, rdx
mov qword [r11 - 0x78], rax
mov dword [rsp + 0x38], 4
mov qword [r11 - 0x60], rbp
lea rax, [0x0003a800]
mov esi, ecx
lea edx, [rbp + 0x10]
mov qword [r11 - 0x68], rax
mov dword [rsp + 0x50], ebp
mov qword [r11 - 0x50], rbp
mov dword [rsp + 0x60], ebp
mov qword [r11 - 0x40], rbp
mov dword [rsp + 0x70], ebp
lea ecx, [rbp + 1]
mov qword [r11 - 0x30], rbp
mov qword [r11 - 0x28], rbp
mov dword [r11 - 0x20], ebp
mov qword [r11 - 0x18], rbp
mov dword [r11 - 0x10], ebp
call fcn.0003548c
mov rbx, rax
mov qword [rsp + 0x48], rax
cmp rax, rbp
jne 0x1e07c
xor eax, eax
jmp 0x1e0c4
xor eax, eax
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rbx], rax
mov rdx, rdi
mov ecx, esi
mov qword [rbx + 8], rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp eax, ebp
jge 0x1e0ab
mov rcx, rbx
call fcn.00035504
jmp 0x1e078
cmp word [rbx], bp
jne 0x1e0c1
cmp qword [rbx + 8], rbp
je 0x1e0a1
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
jmp 0x1e0a1
mov rax, rbx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1e2b4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0xb0
xor edi, edi
lea rax, [0x0001ded8]
lea r8, [r11 - 0x78]
mov qword [r11 - 0x78], rax
mov dword [rsp + 0x48], 4
lea rax, [0x0003b9b0]
mov qword [r11 - 0x68], rax
lea rax, [rsp + 0x30]
lea rdx, [0x0003a8d0]
mov qword [r11 - 0x60], rax
mov dword [rsp + 0x60], edi
xor eax, eax
mov qword [r11 - 0x50], rdi
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor ecx, ecx
mov qword [r11 - 0x80], rax
mov qword [r11 - 0x40], rdi
mov dword [r11 - 0x38], edi
mov qword [r11 - 0x30], rdi
mov qword [r11 - 0x28], rdi
mov dword [r11 - 0x20], edi
mov qword [r11 - 0x18], rdi
mov dword [r11 - 0x10], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp eax, edi
jge 0x1e346
mov al, 1
jmp 0x1e390
mov rdx, qword [rsp + 0x58]
mov ebx, 1
lea rdi, [0x0003a4c0]
mov rsi, qword [rdx + 8]
mov rcx, rbx
repe cmpsw word [rsi], word [rdi]
je 0x1e385
mov rsi, qword [rdx + 8]
lea rdi, [0x0003b7a0]
lea ecx, [rbx + 1]
xor eax, eax
repe cmpsw word [rsi], word [rdi]
je 0x1e37d
sbb eax, eax
sbb eax, 0xffffffff
neg eax
sbb al, al
and al, bl
mov bl, al
mov rcx, rdx
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov al, bl
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1e3ac
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0xb0
xor edi, edi
lea rax, [0x0001ded8]
lea r8, [r11 - 0x78]
mov qword [r11 - 0x78], rax
mov dword [rsp + 0x48], 4
lea rax, [0x0003b9f0]
mov qword [r11 - 0x68], rax
lea rax, [rsp + 0x30]
lea rdx, [0x0003a8d0]
mov qword [r11 - 0x60], rax
mov dword [rsp + 0x60], edi
xor eax, eax
mov qword [r11 - 0x50], rdi
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor ecx, ecx
mov qword [r11 - 0x80], rax
mov qword [r11 - 0x40], rdi
mov dword [r11 - 0x38], edi
mov qword [r11 - 0x30], rdi
mov qword [r11 - 0x28], rdi
mov dword [r11 - 0x20], edi
mov qword [r11 - 0x18], rdi
mov dword [r11 - 0x10], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp eax, edi
jge 0x1e43e
mov al, 1
jmp 0x1e488
mov rdx, qword [rsp + 0x58]
mov ebx, 1
lea rdi, [0x0003a4c0]
mov rsi, qword [rdx + 8]
mov rcx, rbx
repe cmpsw word [rsi], word [rdi]
je 0x1e47d
mov rsi, qword [rdx + 8]
lea rdi, [0x0003b7a0]
lea ecx, [rbx + 1]
xor eax, eax
repe cmpsw word [rsi], word [rdi]
je 0x1e475
sbb eax, eax
sbb eax, 0xffffffff
neg eax
sbb al, al
and al, bl
mov bl, al
mov rcx, rdx
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov al, bl
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1e638
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0xb0
xor ebx, ebx
lea rax, [0x0001ded8]
lea r8, [r11 - 0x78]
mov qword [r11 - 0x78], rax
mov dword [rsp + 0x48], 4
lea rax, [0x0003ba80]
mov qword [r11 - 0x68], rax
lea rax, [rsp + 0x30]
lea rdx, [0x0003a8d0]
mov qword [r11 - 0x60], rax
mov dword [rsp + 0x60], ebx
xor eax, eax
mov qword [r11 - 0x50], rbx
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor ecx, ecx
mov qword [r11 - 0x80], rax
mov qword [r11 - 0x40], rbx
mov dword [r11 - 0x38], ebx
mov qword [r11 - 0x30], rbx
mov qword [r11 - 0x28], rbx
mov dword [r11 - 0x20], ebx
mov qword [r11 - 0x18], rbx
mov dword [r11 - 0x10], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp eax, ebx
jge 0x1e6ca
xor al, al
jmp 0x1e711
mov rdx, qword [rsp + 0x58]
lea rdi, [0x0003a4c0]
mov ecx, 1
mov rsi, qword [rdx + 8]
repe cmpsw word [rsi], word [rdi]
je 0x1e706
mov rsi, qword [rdx + 8]
xor eax, eax
lea rdi, [0x0003b7a0]
lea ecx, [rax + 2]
repe cmpsw word [rsi], word [rdi]
je 0x1e6fe
sbb eax, eax
sbb eax, 0xffffffff
neg eax
sbb al, al
and al, 1
mov bl, al
mov rcx, rdx
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov al, bl
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x207f8
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x98
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x84], 1
mov dword [rsp + 0x80], 0
lea r9, [rsp + 0x78]
mov r8d, 0x40
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [rsp + 0x7c], eax
cmp dword [rsp + 0x7c], 0
jl 0x20871
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x24]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov eax, dword [rsp + 0x88]
shl eax, 5
mov ecx, dword [rsp + 0x24]
shl ecx, 4
add ecx, dword [rsp + 0x84]
add ecx, eax
mov eax, dword [rsp + 0x20]
lea eax, [rcx + rax*2]
add eax, dword [rsp + 0x70]
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x80]
shr eax, 8
add eax, 0xff
mov ecx, dword [rsp + 0x80]
and ecx, eax
mov eax, dword [rsp + 0x80]
shr eax, 0x10
add eax, 0xff
and ecx, eax
mov eax, dword [rsp + 0x80]
shr eax, 0x18
add eax, 0xff
and ecx, eax
and ecx, 0xff
mov eax, dword [rsp + 0x80]
add eax, ecx
mov dword [rsp + 0x80], eax
mov ecx, dword [rsp + 0x80]
and ecx, 0xff
mov eax, dword [rsp + 0x80]
shr eax, 8
and eax, 0xff
imul ecx, eax
mov eax, dword [rsp + 0x80]
add eax, ecx
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x80]
add rsp, 0x98
ret

Function at 0x21524
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor edi, edi
mov ebx, ecx
lea rcx, [r11 - 0x58]
lea r8d, [rdi + 0x40]
xor edx, edx
call fcn.0003a1a0
mov dword [rsp + 0xa0], ebx
lea ecx, [rdi + 1]
lea rdx, [rsp + 0xa4]
mov eax, ecx
xor eax, 0x64
add eax, ecx
inc ecx
imul eax, dword [rdx - 4]
mov dword [rdx], eax
add rdx, 4
cmp ecx, 0x10
jb 0x2156a
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x20]
mov r8d, 0x40
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], 0x67452301
mov dword [rsp + 0x6c], 0xefcdab89
mov dword [rsp + 0x70], 0x98badcfe
mov dword [rsp + 0x74], 0x10325476
mov dword [rsp + 0x78], 0xc3d2e1f0
call fcn.0001fc88
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.0001fd54
lea r11, [rsp + 0x80]
mov eax, 5
xor edi, dword [r11]
add r11, 4
sub rax, 1
jne 0x215e6
lea rax, [rsp + 0x80]
mov edx, 0x14
movzx ecx, byte [rax]
inc rax
add edi, ecx
sub rdx, 1
jne 0x21600
mov eax, edi
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.00039b80
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rdi
ret
Function at 0x22ef0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x450
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov ebp, dword [rcx]
xor r14d, r14d
mov rsi, rcx
mov dword [rsp + 0x20], r14d
mov r13d, r14d
cmp ebp, r14d
je 0x230a8
mov dword [rcx], r14d
lea edi, [r14 + 5]
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov r12d, 0xc0000004
cmp eax, r12d
jne 0x230a8
mov edx, dword [rsp + 0x20]
mov ecx, 1
call fcn.0003548c
mov rbx, rax
cmp rax, r14
je 0x230a8
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, r12d
jne 0x22f9d
mov rcx, rbx
call fcn.00035504
jmp 0x22f5f
cmp eax, r14d
jl 0x230a0
mov rcx, qword [0x0004f2a0]
mov rdi, rbx
lea r12, [rsi + 0x224]
cmp qword [rdi + 0x40], r14
je 0x2308d
mov rax, qword [rdi + 0x50]
mov qword [rsp + 0x28], rax
cmp rcx, r14
je 0x2308d
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r9, rcx
call fcn.0001ad54
cmp al, r14b
je 0x23086
mov rcx, qword [rdi + 0x50]
call fcn.00025f0c
mov r11, rax
cmp rax, r14
je 0x23086
movsxd rdx, r13d
mov r9d, 0x104
mov rcx, rdx
imul rdx, rdx, 0x214
imul rcx, rcx, 0x214
lea r8, [rcx + rsi + 0x1c]
mov rcx, rax
sub rcx, rdx
sub rcx, rsi
lea rax, [r9 + 0x7ffffefa]
cmp rax, r14
je 0x23051
movzx eax, word [rcx + r8 - 0x1c]
cmp ax, r14w
je 0x23051
mov word [r8], ax
add r8, 2
sub r9, 1
jne 0x2302b
cmp r9, r14
jne 0x2305a
sub r8, 2
mov word [r8], r14w
mov rax, qword [rdi + 0x50]
mov rcx, r11
mov qword [r12 - 0x210], rax
mov eax, dword [rsp + 0x38]
inc r13d
mov dword [r12], eax
inc dword [rsi]
add r12, 0x214
call fcn.00035504
mov rcx, qword [0x0004f2a0]
cmp dword [rsi], ebp
jae 0x230a0
cmp dword [rdi], r14d
je 0x230a0
mov eax, dword [rdi]
add rdi, rax
jmp 0x22fb7
mov rcx, rbx
call fcn.00035504
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.00039b80
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x24744
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x390
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov r14, rcx
xor ebx, ebx
lea rcx, [r11 - 0x256]
xor edx, edx
mov r8d, 0x21a
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x160], bx
call fcn.0003a1a0
lea rcx, [rsp + 0x72]
xor edx, edx
mov r8d, 0xee
mov word [rsp + 0x70], bx
call fcn.0003a1a0
lea rcx, [0x0003c180]
call fcn.0001e4a4
mov r12, rax
cmp rax, rbx
jne 0x247cc
xor al, al
jmp 0x24987
lea rcx, [rsp + 0x50]
mov rdx, r14
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r15d, 1
mov edx, 0x810
mov ecx, r15d
call fcn.0003548c
mov rsi, rax
cmp rax, rbx
je 0x2497c
mov r13d, ebx
xor edx, edx
lea rax, [rsp + 0x30]
mov r9, rsi
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, r12
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, ebx
jl 0x24974
add r13d, r15d
cmp dword [rsi + 4], r15d
jne 0x24969
movzx edi, word [rsi + 8]
lea rbp, [rsi + 0xc]
mov word [rsp + 0x40], di
mov qword [rsp + 0x48], rbp
mov word [rsp + 0x42], di
cmp di, 2
jbe 0x24921
cmp word [rbp], 0x21
jne 0x24921
lea rdx, [0x0003c190]
lea rcx, [rsp + 0x40]
call fcn.000356c8
cmp al, bl
je 0x24882
mov rcx, r14
call fcn.00032554
jmp 0x24965
cmp word [rbp], 0x21
jne 0x24921
mov eax, 0xee
mov word [rsp + 0x70], bx
mov word [rsp + 0x160], bx
cmp di, ax
jae 0x248c4
movzx edi, di
lea rdx, [rbp + 2]
lea rcx, [rsp + 0x70]
add rdi, 0xfffffffffffffffe
mov r8, rdi
call fcn.00039c50
shr rdi, 1
mov word [rsp + rdi*2 + 0x70], bx
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x70]
mov r8d, 0x10e
call fcn.00025ab4
cmp al, bl
je 0x24969
cmp word [rsp + 0x160], bx
je 0x24965
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x160]
repne scasw ax, word [rdi]
mov rdx, r14
not rcx
sub rcx, r15
mov r8, rcx
lea rcx, [rsp + 0x160]
call qword [sym.imp.ntoskrnl.exe__wcsnicmp]
cmp eax, ebx
je 0x24971
mov al, bl
jmp 0x24965
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x60], xmm0
cmp di, r15w
jbe 0x24952
cmp di, word [rsp + 0x50]
jbe 0x24952
movzx eax, di
shr eax, 1
sub eax, r15d
cmp word [rbp + rax*2], 0x5c
jne 0x24952
sub di, 2
mov word [rsp + 0x60], di
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov r8b, r15b
call qword [sym.imp.ntoskrnl.exe_RtlPrefixUnicodeString]
cmp al, bl
jne 0x24971
mov edx, r13d
jmp 0x247fe
mov bl, r15b
mov rcx, rsi
call fcn.00035504
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.00039b80
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x249c0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x50
cmp word [rcx], 0x21
mov rsi, rcx
jne 0x24a52
lea rcx, [0x0003c180]
call fcn.0001e4a4
xor ebx, ebx
mov rbp, rax
cmp rax, rbx
jne 0x24a02
mov eax, 0xc000014d
jmp 0x24b3d
lea rcx, [rsp + 0x30]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
lea rdx, [rsp + 0x30]
mov r9d, 1
repne scasw ax, word [rdi]
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, rbp
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x24b3b
mov edx, 0x800
mov ecx, 1
call fcn.0003548c
xor ebx, ebx
mov rbp, rax
cmp rax, rbx
jne 0x24a75
mov eax, 0xc000009a
jmp 0x24b3d
cmp word [rsi], bx
jne 0x24a84
mov edi, 0xc000003b
jmp 0x24b33
mov r8d, 0x400
mov rdx, rax
mov rcx, rsi
call fcn.00032180
cmp eax, ebx
mov edi, eax
jl 0x24b33
or rcx, 0xffffffffffffffff
lea rdx, [0x0003bd40]
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe__wcsnicmp]
cmp eax, ebx
jne 0x24acd
mov edi, 0xc0000039
jmp 0x24b33
lea rcx, [0x0003c180]
call fcn.0001e4a4
mov r12, rax
cmp rax, rbx
jne 0x24ae8
mov edi, 0xc000014d
jmp 0x24b33
lea rcx, [rsp + 0x40]
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
lea rdx, [rsp + 0x40]
mov r9d, 1
repne scasw ax, word [rdi]
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, r12
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, r12
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, rbp
call fcn.00035504
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
Function at 0x24b60
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rdx, rcx
xor r13d, r13d
lea rcx, [rax - 0x38]
mov dword [rax + 0x10], r13d
mov dword [rax + 0x18], r13d
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [0x0003c180]
call fcn.0001e4a4
mov rdi, rax
cmp rax, r13
jne 0x24ba8
mov eax, 0xc000014d
jmp 0x24d15
mov edx, 0x810
mov ecx, 1
call fcn.0003548c
mov rbp, rax
cmp rax, r13
jne 0x24bd2
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc000009a
jmp 0x24d15
mov edx, 0x418
mov ecx, 1
call fcn.0003548c
mov rsi, rax
cmp rax, r13
jne 0x24bf3
mov ebx, 0xc000009a
jmp 0x24d02
mov ebx, 0xc0000001
mov r12d, r13d
xor edx, edx
jmp 0x24ccd
inc r12d
cmp dword [rbp + 4], 1
jne 0x24cca
movzx ecx, word [rbp + 8]
lea rax, [rbp + 0xc]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
mov qword [rsp + 0x28], rax
mov r9, rsi
mov r8d, 1
mov rcx, rdi
mov dword [rsp + 0x20], 0x418
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jl 0x24cca
cmp dword [rsi + 0xc], r13d
je 0x24cca
mov edx, dword [rsi + 8]
add rdx, rsi
mov qword [rsp + 0x38], rdx
movzx ecx, word [rsi + 0xc]
mov word [rsp + 0x30], cx
movzx eax, word [rsi + 0xc]
mov word [rsp + 0x32], ax
cmp cx, 2
jbe 0x24c9b
movzx eax, cx
shr rax, 1
cmp word [rdx + rax*2 - 2], r13w
jne 0x24c9b
mov eax, 0xfffe
add cx, ax
mov word [rsp + 0x30], cx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
cmp eax, r13d
jne 0x24cca
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov ebx, eax
cmp eax, r13d
cmovge ebx, r13d
mov edx, r12d
lea rax, [rsp + 0x98]
mov r9, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, r13d
jge 0x24c02
mov rcx, rsi
call fcn.00035504
mov rcx, rbp
call fcn.00035504
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret