joyce8/EMBER2024-capa huggingface dataset:
Function at 0x193bc
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x70
xor r14d, r14d
xor eax, eax
lea rcx, [r11 - 0x50]
mov word [r11 - 0x68], r14w
mov qword [r11 - 0x66], rax
lea r8d, [r14 + 0x28]
xor edx, edx
mov rdi, r14
mov qword [r11 + 8], r14
mov dword [rsp + 0x3a], eax
mov word [rsp + 0x3e], ax
mov dword [r11 - 0x58], r14d
call fcn.000554c0
lea rdx, [0x00055b50]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0xa8], r14
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0xa8]
mov edx, 0x20019
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x30
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x58], 0x40
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, r14d
jl 0x195ee
cmp qword [rsp + 0xa8], r14
jne 0x19478
mov ebx, 0xc000000d
jmp 0x195de
mov rcx, qword [rsp + 0xa8]
lea rdx, [rsp + 0xa0]
call fcn.0001915c
cmp eax, r14d
mov ebx, eax
jge 0x194b5
mov rcx, qword [rsp + 0xa0]
cmp rcx, r14
je 0x195de
mov edx, 0x72656778
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x195de
mov r12, qword [rsp + 0xa0]
mov ebp, r14d
cmp dword [r12 + 0x14], r14d
jbe 0x195cd
mov r13, qword [rsp + 0xa8]
mov dword [rsp + 0xa0], r14d
cmp r13, r14
je 0x195aa
lea rax, [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov edx, ebp
mov rcx, r13
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, r14d
mov ebx, eax
jge 0x1951c
cmp eax, 0x80000005
je 0x1951c
cmp eax, 0xc0000023
jne 0x19592
cmp eax, 0xc0000034
je 0x195aa
mov eax, dword [rsp + 0xa0]
cmp eax, r14d
je 0x19592
mov rdx, rax
xor ecx, ecx
mov r8d, 0x72656778
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
cmp rax, r14
je 0x195aa
mov edx, dword [rsp + 0xa0]
lea rax, [rsp + 0xa0]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
xor r8d, r8d
mov edx, ebp
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, r14d
mov ebx, eax
jge 0x1958f
mov edx, 0x72656778
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rdi, r14
jmp 0x19592
mov ebx, r14d
cmp ebx, r14d
jl 0x195aa
mov edx, dword [rdi + 0xc]
cmp edx, 0x14
jbe 0x195af
lea rcx, [rdi + 0x10]
call fcn.00019228
jmp 0x195af
cmp rdi, r14
je 0x195c0
mov edx, 0x72656778
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rdi, r14
inc ebp
cmp ebp, dword [r12 + 0x14]
jb 0x194cb
mov edx, 0x72656778
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ebx, r14d
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x19b6c
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x70
and qword [rax - 0x48], 0
and dword [rax + 0x20], 0
mov rdi, rdx
mov rdx, rcx
lea rcx, [rax - 0x48]
mov rsi, r8
call fcn.00029d00
mov ebx, eax
test eax, eax
js 0x19c5d
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x19c52
mov rax, qword [rsp + 0x58]
xor ecx, ecx
mov r8d, 0x31313232
mov edx, eax
mov dword [rsi], eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rdi], rax
test rax, rax
je 0x19c4d
mov r8d, dword [rsi]
and dword [rsp + 0x38], 0
xor ecx, ecx
mov dword [rsp + 0x3c], ecx
xor edx, edx
mov rcx, rax
call fcn.000554c0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x19c30
mov r9d, dword [rsi]
mov r8, qword [rdi]
lea rax, [rsp + 0x98]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.00029c28
mov ebx, eax
jmp 0x19c35
mov ebx, 0xc0000001
test ebx, ebx
jns 0x19c52
and dword [rsi], 0
mov rcx, qword [rdi]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
and qword [rdi], 0
jmp 0x19c52
mov ebx, 0xc0000001
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r11, [rsp + 0x70]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x19c78
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x70
and qword [r11 + 0x10], 0
mov dword [rsp + 0x40], 0x30
and qword [r11 - 0x30], 0
mov dword [rsp + 0x58], 0x40
and qword [r11 - 0x18], 0
and qword [r11 - 0x10], 0
lea rax, [0x00083ad8]
lea r8, [r11 - 0x38]
lea rcx, [r11 + 0x10]
mov edx, 0xf003f
xor bl, bl
mov qword [r11 - 0x28], rax
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x19db3
and dword [rsp + 0x80], 0
lea rdx, [0x00055940]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x88]
xor r9d, r9d
lea r11, [rsp + 0x80]
lea r8d, [r9 + 2]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], r11
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
jns 0x19db3
cmp eax, 0xc0000023
jne 0x19db3
mov edx, dword [rsp + 0x80]
xor ecx, ecx
mov r8d, 0x33333939
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x19db3
mov r8d, dword [rsp + 0x80]
xor edx, edx
mov rcx, rax
call fcn.000554c0
mov ecx, dword [rsp + 0x80]
lea r11, [rsp + 0x80]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x88]
lea rdx, [rsp + 0x30]
mov r9, rdi
mov r8d, 2
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x19da8
cmp dword [rdi + 4], 4
jne 0x19da8
mov eax, 1
movzx ebx, bl
cmp dword [rdi + 0xc], eax
cmove ebx, eax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x19dc6
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x19ddc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
lea rax, [0x00019acc]
mov rbx, rcx
mov r8d, 0x5772626b
mov qword [rdx + 0xf0], rax
movzx eax, word [rcx]
xor ecx, ecx
add eax, 2
movsxd rdx, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor edi, edi
mov rcx, rax
mov qword [0x00082968], rax
cmp rax, rdi
jne 0x19e2c
mov eax, 0xc0000001
jmp 0x1a074
movzx eax, word [rbx]
xor edx, edx
add eax, 2
movsxd r8, eax
call fcn.000554c0
movzx r8d, word [rbx]
mov rdx, qword [rbx + 8]
mov rcx, qword [0x00082968]
call fcn.000550e0
movzx r11d, word [rbx]
lea rdx, str.Bfjnjc_t
lea rcx, [rsp + 0x30]
mov word [0x00082962], r11w
mov word [0x00082960], r11w
mov qword [0x00084638], rdi
mov dword [rsp + 0x90], edi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [0x00082960]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x98]
mov edx, 0xf003f
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x40
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, edi
jl 0x19fb3
mov rcx, qword [rsp + 0x98]
xor r9d, r9d
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea r8d, [r9 + 2]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000023
jne 0x19fa5
mov edx, dword [rsp + 0x90]
xor ecx, ecx
mov r8d, 0x5772626b
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
mov qword [0x00082970], rax
cmp rax, rdi
je 0x19f92
mov r8d, dword [rsp + 0x90]
xor edx, edx
mov rcx, rax
call fcn.000554c0
mov ecx, dword [rsp + 0x90]
lea r11, [rsp + 0x90]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x98]
lea rdx, [rsp + 0x30]
mov r9, rbx
mov r8d, 2
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, edi
mov ebx, eax
jge 0x19fa5
mov rcx, qword [0x00082970]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [0x00082970], rdi
mov eax, ebx
jmp 0x1a074
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x19e22
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rbx, [0x00084640]
xor edx, edx
mov r8d, 0x208
mov rcx, rbx
call fcn.000554c0
mov rcx, qword [0x00082970]
mov edx, 0x104
add rcx, 0xc
mov r8, rcx
sub r8, rbx
lea rax, [rdx + 0x7ffffefa]
cmp rax, rdi
je 0x1a003
movzx eax, word [r8 + rbx]
cmp ax, di
je 0x1a003
mov word [rbx], ax
add rbx, 2
sub rdx, 1
jne 0x19fe0
cmp rdx, rdi
jne 0x1a00c
sub rbx, 2
lea r8, [0x00082978]
lea rdx, [0x00082c80]
mov word [rbx], di
call fcn.00019b6c
mov rdx, qword [0x00082970]
lea rcx, [rsp + 0x40]
add rdx, 0xc
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor edx, edx
lea rbx, [0x00083268]
lea r8d, [rdx + 0x21]
mov rcx, rbx
call fcn.000554c0
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.00029328
mov edx, 1
mov rcx, rbx
call fcn.0001e268
mov rcx, qword [0x00082870]
call qword [sym.imp.ntoskrnl.exe_IoRegisterShutdownNotification]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x1a268
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
and qword [rsp + 0x78], 0
mov rdx, rcx
lea rcx, [rsp + 0x78]
xor bl, bl
call fcn.00029d00
test eax, eax
js 0x1a2cb
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1a2db
mov rax, cr8
test al, al
jne 0x1a2d0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
js 0x1a2cb
cmp dword [rsp + 0x48], 0
movzx ebx, bl
mov eax, 1
cmove ebx, eax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1a2db
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
add rsp, 0x60
pop rbx
ret
Function at 0x1a2ec
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x2e0
mov rax, qword [0x00065100]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
xor eax, eax
xor r12d, r12d
lea esi, [rax + 1]
mov dword [rsp + 0x6c], eax
mov qword [rsp + 0x70], rax
lea rax, [fcn.0001ad2c]
mov dword [rsp + 0x68], r12d
mov qword [rsp + 0x60], r12
cmp rax, r12
je 0x1a468
mov ebp, 0xc0
mov r8d, 0x456e6d46
xor ecx, ecx
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, r12
je 0x1a458
lea rdx, [0x00055e50]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x40], 0x21
mov dword [rsp + 0x38], esi
lea rax, [rsp + 0xa8]
mov dword [rsp + 0x30], 7
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x78]
lea rcx, [rsp + 0x60]
mov edx, 0x10000001
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x78], 0x30
mov qword [rsp + 0x80], r12
mov dword [rsp + 0x90], 0x240
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], r12
mov qword [rsp + 0xa0], r12
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
cmp eax, r12d
jl 0x1a445
mov rcx, qword [rsp + 0x60]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x48], r12
mov byte [rsp + 0x40], r12b
mov dword [rsp + 0x38], 3
lea rax, [rsp + 0x68]
mov dword [rsp + 0x30], ebp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryDirectoryFile]
cmp eax, 0x80000006
jne 0x1a496
cmp rbx, r12
je 0x1a458
mov edx, 0x456e6d46
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x60]
cmp rcx, r12
je 0x1a468
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.00055060
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
cmp eax, 0x80000005
jne 0x1a4d0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r11d, ebp
xor ecx, ecx
shl r11d, 2
mov r8d, 0x456e6d46
mov edx, r11d
mov ebp, r11d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, r12
je 0x1a458
jmp 0x1a401
cmp eax, r12d
jne 0x1a401
mov sil, r12b
mov rdi, rbx
test byte [rdi + 0x38], 0x10
jne 0x1a523
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 0x208
call fcn.000554c0
mov r8d, dword [rdi + 0x3c]
lea rdx, [rdi + 0x5e]
lea rcx, [rsp + 0xc0]
call fcn.000550e0
lea rdx, [rsp + 0xc0]
lea rcx, [0x00055e50]
call fcn.0001ad2c
cmp dword [rdi], r12d
je 0x1a401
mov eax, dword [rdi]
lea rcx, [rax + rax*2]
shl rcx, 5
add rdi, rcx
jmp 0x1a4df
Function at 0x1a544
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
sub rsp, 0x2a0
mov rax, qword [0x00065100]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor ebx, ebx
lea rax, [fcn.0001a788]
xor edi, edi
and dword [rsp + 0x30], ebx
and qword [rsp + 0x38], rbx
test rax, rax
je 0x1a758
lea rdx, [0x00055de0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x48], rbx
and qword [rsp + 0x60], rbx
and qword [rsp + 0x68], rbx
lea rax, [rsp + 0x70]
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x38]
mov edx, 0x1f0000
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x30
mov dword [rsp + 0x58], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov r12d, 0x456e6d52
test eax, eax
js 0x1a726
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea esi, [rbx + 2]
mov edx, esi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
cmp eax, 0xc0000023
jne 0x1a726
mov edx, dword [rsp + 0x30]
mov r8d, r12d
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x1a726
mov r9d, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov r8, rdi
mov edx, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
test eax, eax
js 0x1a726
xor esi, esi
cmp dword [rdi + 0x14], ebx
jbe 0x1a726
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor r8d, r8d
mov edx, esi
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, 0xc0000023
jne 0x1a708
mov edx, dword [rsp + 0x30]
mov r8d, r12d
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x1a71b
mov ecx, dword [rsp + 0x30]
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
mov edx, esi
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
test eax, eax
js 0x1a708
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x208
call fcn.000554c0
mov r8d, dword [rbx + 0xc]
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x80]
call fcn.000550e0
lea rdx, [rsp + 0x80]
lea rcx, [0x00055de0]
call fcn.0001a788
test rbx, rbx
je 0x1a71b
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor ebx, ebx
inc esi
cmp esi, dword [rdi + 0x14]
jb 0x1a661
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1a736
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test rdi, rdi
je 0x1a747
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test rbx, rbx
je 0x1a758
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.00055060
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret
Function at 0x1cc04
Capabilities:
Install driver

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
push r12
push r13
sub rsp, 0x30
mov r12d, edx
mov r13, rcx
xor ebx, ebx
mov edx, 0x208
xor ecx, ecx
mov r8d, 0x41424344
mov qword [rsp + 0x68], rbx
mov edi, 0xc0000001
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbp, rax
cmp rax, rbx
je 0x1ccf8
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.000554c0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x68]
mov r8d, r12d
call fcn.0002a3f0
cmp al, bl
je 0x1cccb
mov r8d, r12d
mov edx, 0x208
mov rcx, rbp
call fcn.0002a790
cmp al, bl
je 0x1cccb
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
mov rdx, r13
call fcn.0001c9ac
cmp eax, ebx
mov edi, eax
jl 0x1cccb
lea rcx, [rsp + 0x20]
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x20]
xor r8d, r8d
call fcn.00016b54
cmp eax, ebx
mov edi, eax
jl 0x1cccb
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ZwLoadDriver]
mov edi, eax
cmp qword [rsp + 0x68], rbx
je 0x1cced
cmp edi, ebx
jge 0x1cce0
mov rcx, qword [rsp + 0x68]
call fcn.00029d3c
mov rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbp, qword [rsp + 0x58]
cmp edi, ebx
mov rbx, qword [rsp + 0x50]
setge al
add rsp, 0x30
pop r13
pop r12
pop rdi
ret

Function at 0x1e268
Capabilities:
Delete registry value
Encode data using xor
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
xor ebx, ebx
mov esi, edx
mov rdi, rcx
cmp rcx, rbx
je 0x1e347
mov r13d, esi
mov r8d, 0x33333130
xor ecx, ecx
imul r13d, r13d, 0x22
mov edx, r13d
mov r12d, r13d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbp, rax
cmp rax, rbx
jne 0x1e2bd
mov ebx, 0xc000009a
jmp 0x1e343
mov r8, r12
mov edx, 0x65
mov rcx, rax
call fcn.000554c0
cmp esi, ebx
jbe 0x1e2fa
mov r8, rsi
mov edx, ebx
mov r9d, 0x20
mov cl, byte [rdi]
mov eax, edx
inc edx
xor cl, 0x22
inc rdi
sub r9, 1
mov byte [rax + rbp], cl
jne 0x1e2dc
add ebx, 0x22
sub r8, 1
jne 0x1e2d4
lea r8, [0x00055f30]
lea rdx, [0x00055eb0]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_RtlDeleteRegistryValue]
lea r8, [0x00055f30]
lea rdx, [0x00055eb0]
mov r9d, 3
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_RtlWriteRegistryValue]
xor edx, edx
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x1e34c
mov eax, 0xc000000d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x1e770
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x00065100]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov edi, 0x20
lea rcx, [r11 - 0x40]
xor edx, edx
mov r8, rdi
call fcn.000554c0
lea r8d, [rdi + 0x12]
lea rcx, [0x00084880]
xor edx, edx
call fcn.000554c0
xor eax, eax
xor esi, esi
lea r8d, [rdi + 8]
lea rcx, [rsp + 0x80]
xor edx, edx
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x58], si
mov qword [rsp + 0x5a], rax
mov dword [rsp + 0x62], eax
mov word [rsp + 0x66], ax
mov word [rsp + 0x48], si
mov qword [rsp + 0x4a], rax
mov dword [rsp + 0x52], eax
mov word [rsp + 0x56], ax
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x78], esi
call fcn.000554c0
lea rdx, [0x00055bf0]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00055c80]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x58]
lea r8, [rsp + 0x78]
lea rcx, [rsp + 0x38]
mov edx, 0x20019
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x78], 0x30
mov qword [rsp + 0x80], rsi
mov dword [rsp + 0x90], 0x40
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], rsi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, esi
jl 0x1e8ed
mov rbx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r8d, [rdi - 0x1e]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x48]
xor r9d, r9d
mov rcx, rbx
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000034
je 0x1e8e2
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.0002aa2c
cmp al, sil
jne 0x1e912
mov rcx, qword [rsp + 0x40]
cmp rcx, rsi
je 0x1e8e2
mov edx, 0x34343434
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.00055060
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov rbx, qword [rsp + 0x40]
lea rcx, [rsp + 0xb8]
cmp dword [rbx + 8], edi
lea rdx, [rbx + 0xc]
cmovb edi, dword [rbx + 8]
mov r8d, edi
call fcn.000550e0
mov edx, 0x34343434
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
cmp eax, esi
jl 0x1e8ed
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x68]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
cmp eax, esi
jne 0x1e8ed
movzx r8d, word [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
lea rcx, [0x00084880]
call fcn.000550e0
movzx r11d, word [rsp + 0x68]
lea rcx, [rsp + 0x68]
inc r11d
mov dword [0x000828ac], r11d
call qword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
jmp 0x1e8ed
Function at 0x1e9c4
Capabilities:
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
and dword [rsp + 0x50], 0
mov eax, 0x74
mov esi, edx
mov word [rsp + 0x40], ax
mov eax, 0x76
xor edx, edx
mov word [rsp + 0x42], ax
lea rax, [0x00055eb0]
mov rbp, rcx
mov qword [r11 - 0x50], rax
mov eax, 0x1a
lea r8d, [rdx + 0x28]
mov word [rsp + 0x30], ax
mov eax, 0x1c
lea rcx, [r11 - 0x40]
mov word [rsp + 0x32], ax
lea rax, [0x00055fc0]
mov qword [r11 - 0x60], rax
call fcn.000554c0
and qword [rsp + 0xb0], 0
xor ebx, ebx
and dword [rsp + 0xa0], ebx
test rbp, rbp
je 0x1ebc3
cmp esi, 1
jb 0x1ebc3
test esi, esi
je 0x1ea66
mov rax, rbp
mov rcx, rsi
xor byte [rax], 0x43
inc rax
sub rcx, 1
jne 0x1ea5a
and qword [rsp + 0x58], rbx
and qword [rsp + 0x70], rbx
and qword [rsp + 0x78], rbx
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xb0]
mov edx, 0x2001f
mov dword [rsp + 0x50], 0x30
mov dword [rsp + 0x68], 0x40
mov qword [rsp + 0x60], rax
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov edi, eax
test eax, eax
js 0x1ebdb
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x1ebdb
xor r9d, r9d
lea rax, [rsp + 0xa0]
lea rdx, [rsp + 0x30]
lea edi, [r9 + 2]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], ebx
mov r8d, edi
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0x80000005
je 0x1eafa
cmp eax, 0xc0000023
jne 0x1eb8c
mov eax, dword [rsp + 0xa0]
xor ecx, ecx
mov r8d, 0x33333130
add eax, 0x10
mov edx, eax
mov dword [rsp + 0xa0], eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x1eb8c
mov r8d, dword [rsp + 0xa0]
xor edx, edx
mov rcx, rax
call fcn.000554c0
mov ecx, dword [rsp + 0xa0]
lea r11, [rsp + 0xa0]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0xb0]
lea rdx, [rsp + 0x30]
mov r9, rbx
mov r8d, edi
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov edi, eax
test eax, eax
js 0x1eb8c
cmp dword [rbx + 4], 3
jne 0x1eb8c
cmp dword [rbx + 8], 0
jbe 0x1eb8c
mov r8d, dword [rbx + 8]
lea rdx, [rbx + 0xc]
mov rcx, rbp
call fcn.000555c0
test eax, eax
je 0x1ebb3
mov rcx, qword [rsp + 0xb0]
lea rdx, [rsp + 0x30]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov edi, eax
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x1ebc8
mov edi, 0xc000000d
test rbx, rbx
je 0x1ebdb
mov edx, 0x33333130
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret