joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1788c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x00039100]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov r15d, dword [rcx]
mov rbx, qword [rcx + 4]
xor r12d, r12d
mov rdi, rcx
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x28], rbx
cmp r15d, r12d
je 0x17a47
mov dword [rcx], r12d
lea ebp, [r12 + 5]
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov ecx, ebp
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov r13d, 0xc0000004
cmp eax, r13d
jne 0x17a47
mov edx, dword [rsp + 0x20]
mov ecx, 1
call fcn.0002e424
mov rsi, rax
mov qword [rsp + 0x30], rax
cmp rax, r12
je 0x17a47
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, ebp
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, r13d
jne 0x1794c
mov rcx, rsi
call fcn.0002e49c
jmp 0x17909
cmp eax, r12d
jge 0x17959
mov rcx, rsi
jmp 0x17a42
mov rbp, rsi
lea r14, [rdi + 0xc]
mov esi, r12d
cmp qword [rbp + 0x40], r12
je 0x17a27
mov rdx, qword [rbp + 0x50]
mov rcx, rbx
call fcn.0002bc40
cmp al, r12b
je 0x17a27
mov rcx, qword [rbp + 0x50]
call fcn.00021e6c
mov r13, rax
cmp rax, r12
je 0x17a27
movsxd rbx, esi
xor edx, edx
mov r8d, 0x104
mov rcx, rbx
imul rcx, rcx, 0x210
lea r12, [rcx + rdi + 0x14]
mov rcx, r12
call fcn.0002f810
mov rcx, r13
mov r11d, 0x104
imul rbx, rbx, 0x210
sub rcx, rbx
sub rcx, rdi
xor edx, edx
lea rax, [r11 + 0x7ffffefa]
cmp rax, rdx
je 0x179f7
movzx eax, word [rcx + r12 - 0x14]
cmp ax, dx
je 0x179f7
mov word [r12], ax
add r12, 2
sub r11, 1
jne 0x179d1
cmp r11, rdx
jne 0x17a00
sub r12, 2
mov word [r12], dx
mov rax, qword [rbp + 0x50]
mov rcx, r13
mov qword [r14], rax
inc dword [rdi]
add r14, 0x210
inc esi
call fcn.0002e49c
mov rbx, qword [rsp + 0x28]
xor r12d, r12d
cmp dword [rdi], r15d
jae 0x17a3d
cmp dword [rbp], r12d
je 0x17a3d
mov eax, dword [rbp]
add rbp, rax
jmp 0x17963
mov rcx, qword [rsp + 0x30]
call fcn.0002e49c
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.0002f1f0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x17ac8
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x00039100]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [0x0003f368]
mov rbx, rcx
cmp eax, 0xffffffff
jne 0x17b51
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call fcn.0002f810
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
xor ecx, ecx
cmp eax, ecx
je 0x17b26
mov dword [0x0003f368], ecx
mov al, cl
jmp 0x17b51
cmp dword [rsp + 0x24], 6
jb 0x17b1c
mov eax, 1
mov dword [0x0003f368], eax
jne 0x17b51
cmp dword [rsp + 0x28], ecx
jne 0x17b51
cmp word [rsp + 0x134], ax
cmovb eax, ecx
mov dword [0x0003f368], eax
movzx eax, al
mov dword [rbx], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.0002f1f0
add rsp, 0x150
pop rbx
ret
Function at 0x17b78
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x17bac
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessCreateTimeQuadPart]
mov rcx, qword [rsp + 0x30]
mov qword [rbx + 4], rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rsp, 0x20
pop rbx
ret

Function at 0x184ec
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov qword [rsp + 0x30], rbx
cmp rcx, qword [0x000413e0]
jne 0x1850a
mov al, 1
jmp 0x18566
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, ebx
jge 0x1851d
xor al, al
jmp 0x18566
mov rcx, qword [rsp + 0x30]
call sub.ntoskrnl.exe_PsGetProcessImageFileName
mov rdi, rax
cmp rax, rbx
je 0x18559
lea rdx, [0x0002ffc0]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe__stricmp]
cmp eax, ebx
je 0x18557
lea rdx, [0x0002ff90]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe__stricmp]
cmp eax, ebx
jne 0x18559
mov bl, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x19ef4
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x00039100]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, rcx
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x19f35
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
xor bl, bl
mov qword [rsp + 0x20], rax
jmp 0x19f55
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x19f4e
xor al, al
jmp 0x1a050
mov rax, qword [rsp + 0x20]
mov bl, 1
mov rcx, rax
call sub.ntoskrnl.exe_PsGetProcessImageFileName
mov rdx, rax
test rax, rax
jne 0x19f76
test bl, bl
je 0x19f47
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x19f47
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x00030370]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [0x00030370]
call qword [sym.imp.ntoskrnl.exe__strnicmp]
test eax, eax
sete dil
test bl, bl
je 0x19fb4
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
and qword [rsp + 0x20], 0
test dil, dil
je 0x19f47
mov rcx, rsi
call fcn.00021e6c
mov rbx, rax
test rax, rax
je 0x19f47
lea r8, [0x00030380]
lea rcx, [rsp + 0x30]
movabs r9, 0xfffff78000000030
mov edx, 0x32
call fcn.00018cdc
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
mov rdx, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe__wcsnicmp]
test eax, eax
sete dil
test dil, dil
je 0x1a045
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_wcsrchr]
test rax, rax
je 0x1a045
lea rcx, [rax + 2]
lea rdx, [0x000303a0]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
sete dil
mov rcx, rbx
call fcn.0002e49c
mov al, dil
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.0002f1f0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1cd10
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
and qword [rax + 0x18], 0
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
jne 0x1cd57
lea rdx, [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1cd57
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessSectionBaseAddress]
mov rcx, qword [rsp + 0x48]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, rdi
call fcn.0002b97c
mov rsi, rax
test rax, rax
jne 0x1cd6b
xor eax, eax
jmp 0x1cdd5
mov edx, 0x400
mov ecx, 1
call fcn.0002e424
mov rdi, rax
test rax, rax
je 0x1cd67
xor edx, edx
mov r8d, 0x400
mov rcx, rax
call fcn.0002f810
lea r11, [rsp + 0x50]
mov r9, rdi
mov qword [rsp + 0x28], r11
mov r8d, 2
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], 0x3fe
call fcn.0001caa4
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
jns 0x1cdd2
mov rcx, rdi
call fcn.0002e49c
jmp 0x1cd67
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1d230
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x70
mov rdi, rdx
lea rcx, [rsp + 0x50]
mov rdx, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
test eax, eax
js 0x1d2d9
lea rcx, [rsp + 0x60]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov edi, eax
test eax, eax
js 0x1d2cc
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
mov r9d, 1
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
xor ecx, ecx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x0002ff30]
call qword [sym.imp.ntoskrnl.exe_RtlWriteRegistryValue]
lea rcx, [rsp + 0x40]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov eax, edi
add rsp, 0x70
pop rdi
ret

Function at 0x1d330
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0xb0
xor edi, edi
lea rax, [0x0001d2e8]
mov qword [r11 - 0x78], rax
mov dword [rsp + 0x48], 4
mov qword [r11 - 0x60], rdi
lea rax, [0x0002fe60]
lea edx, [rdi + 0x10]
lea ecx, [rdi + 1]
mov qword [r11 - 0x68], rax
mov dword [rsp + 0x60], edi
mov qword [r11 - 0x50], rdi
mov dword [rsp + 0x70], edi
mov qword [r11 - 0x40], rdi
mov dword [r11 - 0x38], edi
mov qword [r11 - 0x30], rdi
mov qword [r11 - 0x28], rdi
mov dword [r11 - 0x20], edi
mov qword [r11 - 0x18], rdi
mov dword [r11 - 0x10], edi
call fcn.0002e424
mov rbx, rax
mov qword [rsp + 0x58], rax
cmp rax, rdi
jne 0x1d3a7
xor eax, eax
jmp 0x1d3f1
xor eax, eax
lea rdx, [0x0002fb30]
lea rcx, [rsp + 0x30]
mov qword [rbx], rax
mov qword [rbx + 8], rax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0x40]
lea rdx, [0x0002ff30]
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp eax, edi
jge 0x1d3ec
mov rcx, rbx
call fcn.0002e49c
jmp 0x1d3a3
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rdi
ret
Function at 0x1d408
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0xa0
xor ebp, ebp
lea rax, [0x0001d2e8]
mov rdi, rdx
mov qword [r11 - 0x78], rax
mov dword [rsp + 0x38], 4
mov qword [r11 - 0x60], rbp
lea rax, [0x0002fe60]
mov esi, ecx
lea edx, [rbp + 0x10]
mov qword [r11 - 0x68], rax
mov dword [rsp + 0x50], ebp
mov qword [r11 - 0x50], rbp
mov dword [rsp + 0x60], ebp
mov qword [r11 - 0x40], rbp
mov dword [rsp + 0x70], ebp
lea ecx, [rbp + 1]
mov qword [r11 - 0x30], rbp
mov qword [r11 - 0x28], rbp
mov dword [r11 - 0x20], ebp
mov qword [r11 - 0x18], rbp
mov dword [r11 - 0x10], ebp
call fcn.0002e424
mov rbx, rax
mov qword [rsp + 0x48], rax
cmp rax, rbp
jne 0x1d48c
xor eax, eax
jmp 0x1d4d4
xor eax, eax
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rbx], rax
mov rdx, rdi
mov ecx, esi
mov qword [rbx + 8], rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp eax, ebp
jge 0x1d4bb
mov rcx, rbx
call fcn.0002e49c
jmp 0x1d488
cmp word [rbx], bp
jne 0x1d4d1
cmp qword [rbx + 8], rbp
je 0x1d4b1
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
jmp 0x1d4b1
mov rax, rbx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1d6c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0xb0
xor edi, edi
lea rax, [0x0001d2e8]
lea r8, [r11 - 0x78]
mov qword [r11 - 0x78], rax
mov dword [rsp + 0x48], 4
lea rax, [0x00030d80]
mov qword [r11 - 0x68], rax
lea rax, [rsp + 0x30]
lea rdx, [0x0002ff30]
mov qword [r11 - 0x60], rax
mov dword [rsp + 0x60], edi
xor eax, eax
mov qword [r11 - 0x50], rdi
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor ecx, ecx
mov qword [r11 - 0x80], rax
mov qword [r11 - 0x40], rdi
mov dword [r11 - 0x38], edi
mov qword [r11 - 0x30], rdi
mov qword [r11 - 0x28], rdi
mov dword [r11 - 0x20], edi
mov qword [r11 - 0x18], rdi
mov dword [r11 - 0x10], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp eax, edi
jge 0x1d756
mov al, 1
jmp 0x1d7a0
mov rdx, qword [rsp + 0x58]
mov ebx, 1
lea rdi, [0x0002fb30]
mov rsi, qword [rdx + 8]
mov rcx, rbx
repe cmpsw word [rsi], word [rdi]
je 0x1d795
mov rsi, qword [rdx + 8]
lea rdi, [0x00030b70]
lea ecx, [rbx + 1]
xor eax, eax
repe cmpsw word [rsi], word [rdi]
je 0x1d78d
sbb eax, eax
sbb eax, 0xffffffff
neg eax
sbb al, al
and al, bl
mov bl, al
mov rcx, rdx
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov al, bl
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1d950
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0xb0
xor ebx, ebx
lea rax, [0x0001d2e8]
lea r8, [r11 - 0x78]
mov qword [r11 - 0x78], rax
mov dword [rsp + 0x48], 4
lea rax, [0x00030e10]
mov qword [r11 - 0x68], rax
lea rax, [rsp + 0x30]
lea rdx, [0x0002ff30]
mov qword [r11 - 0x60], rax
mov dword [rsp + 0x60], ebx
xor eax, eax
mov qword [r11 - 0x50], rbx
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor ecx, ecx
mov qword [r11 - 0x80], rax
mov qword [r11 - 0x40], rbx
mov dword [r11 - 0x38], ebx
mov qword [r11 - 0x30], rbx
mov qword [r11 - 0x28], rbx
mov dword [r11 - 0x20], ebx
mov qword [r11 - 0x18], rbx
mov dword [r11 - 0x10], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp eax, ebx
jge 0x1d9e2
xor al, al
jmp 0x1da29
mov rdx, qword [rsp + 0x58]
lea rdi, [0x0002fb30]
mov ecx, 1
mov rsi, qword [rdx + 8]
repe cmpsw word [rsi], word [rdi]
je 0x1da1e
mov rsi, qword [rdx + 8]
xor eax, eax
lea rdi, [0x00030b70]
lea ecx, [rax + 2]
repe cmpsw word [rsi], word [rdi]
je 0x1da16
sbb eax, eax
sbb eax, 0xffffffff
neg eax
sbb al, al
and al, 1
mov bl, al
mov rcx, rdx
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov al, bl
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1fb08
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x98
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x84], 1
mov dword [rsp + 0x80], 0
lea r9, [rsp + 0x78]
mov r8d, 0x40
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [rsp + 0x7c], eax
cmp dword [rsp + 0x7c], 0
jl 0x1fb81
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x24]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov eax, dword [rsp + 0x88]
shl eax, 5
mov ecx, dword [rsp + 0x24]
shl ecx, 4
add ecx, dword [rsp + 0x84]
add ecx, eax
mov eax, dword [rsp + 0x20]
lea eax, [rcx + rax*2]
add eax, dword [rsp + 0x70]
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x80]
shr eax, 8
add eax, 0xff
mov ecx, dword [rsp + 0x80]
and ecx, eax
mov eax, dword [rsp + 0x80]
shr eax, 0x10
add eax, 0xff
and ecx, eax
mov eax, dword [rsp + 0x80]
shr eax, 0x18
add eax, 0xff
and ecx, eax
and ecx, 0xff
mov eax, dword [rsp + 0x80]
add eax, ecx
mov dword [rsp + 0x80], eax
mov ecx, dword [rsp + 0x80]
and ecx, 0xff
mov eax, dword [rsp + 0x80]
shr eax, 8
and eax, 0xff
imul ecx, eax
mov eax, dword [rsp + 0x80]
add eax, ecx
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x21800
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x850
mov rax, qword [0x00039100]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rbx, rcx
lea rcx, [rsp + 0x42]
xor r13d, r13d
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x40], r13w
call fcn.0002f810
lea rcx, [0x00031100]
call fcn.0001d7bc
mov rsi, rax
cmp rax, r13
jne 0x21867
mov eax, 0xc000014d
jmp 0x219d1
cmp word [rbx], 0x21
jne 0x218bd
lea rax, [rsp + 0x40]
mov rdi, rbx
mov edx, 0x400
sub rdi, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7ffffbfe]
cmp rax, r13
je 0x218a5
movzx eax, word [rdi + rcx]
cmp ax, r13w
je 0x218a5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x21882
cmp rdx, r13
jne 0x218ae
sub rcx, 2
mov word [rcx], r13w
mov word [rsp + 0x83e], r13w
jmp 0x218eb
cmp word [rbx], r13w
jne 0x218cd
mov edi, 0xc000003b
jmp 0x219c6
lea rdx, [rsp + 0x40]
mov r8d, 0x400
mov rcx, rbx
call fcn.0002b84c
cmp eax, r13d
mov edi, eax
jl 0x219c6
lea rdx, [0x000310c0]
xor eax, eax
or r14, 0xffffffffffffffff
mov rdi, rdx
mov rcx, r14
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe__wcsnicmp]
cmp eax, r13d
jne 0x21922
mov edi, 0xc0000039
jmp 0x219c6
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor eax, eax
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r12d, [rcx + rcx + 0x34]
lea ecx, [rax + 1]
mov edx, r12d
mov edi, r12d
call fcn.0002e424
mov rbp, rax
cmp rax, r13
jne 0x21962
mov edi, 0xc000009a
jmp 0x219c6
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.0002f810
xor eax, eax
mov dword [rbp], 0x11232fe
mov dword [rbp + 4], 0x34
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdx, rbx
not rcx
lea r8, [rcx + rcx]
lea rcx, [rbp + 0x34]
call fcn.0002f2c0
lea rdx, [rsp + 0x30]
mov r9d, 3
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, rbp
mov edi, eax
call fcn.0002e49c
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.0002f1f0
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x21a04
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rbx, rcx
xor r13d, r13d
lea rcx, [0x00031100]
mov dword [rax + 0x10], r13d
mov dword [rax + 0x18], r13d
call fcn.0001d7bc
mov rdi, rax
cmp rax, r13
jne 0x21a42
mov eax, 0xc000014d
jmp 0x21bf3
mov edx, 0x810
mov ecx, 1
call fcn.0002e424
mov rbp, rax
cmp rax, r13
jne 0x21a6c
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc000009a
jmp 0x21bf3
mov edx, 0x418
mov ecx, 1
call fcn.0002e424
mov rsi, rax
cmp rax, r13
jne 0x21a8d
mov ebx, 0xc000009a
jmp 0x21be0
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ebx, 0xc0000001
mov r12d, r13d
xor edx, edx
jmp 0x21bab
inc r12d
cmp dword [rbp + 4], 3
jne 0x21ba8
movzx ecx, word [rbp + 8]
lea rax, [rbp + 0xc]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
mov qword [rsp + 0x28], rax
mov r9, rsi
mov r8d, 1
mov rcx, rdi
mov dword [rsp + 0x20], 0x418
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jl 0x21ba8
cmp dword [rsi + 0xc], 0x34
jbe 0x21ba8
cmp dword [rsi + 4], 3
jne 0x21ba8
mov edx, dword [rsi + 8]
mov eax, dword [rsi + 0xc]
mov r9d, 2
sub eax, r9d
add rdx, rsi
mov byte [rax + rdx], r13b
mov eax, dword [rsi + 0xc]
dec eax
mov byte [rax + rdx], r13b
mov eax, dword [rsi + 0xc]
cmp dword [rdx + 4], eax
jae 0x21ba8
mov r8d, dword [rdx + 4]
add r8, rdx
mov qword [rsp + 0x38], r8
movzx ecx, word [rsi + 0xc]
sub cx, word [rdx + 4]
mov word [rsp + 0x32], cx
mov word [rsp + 0x30], cx
cmp cx, r9w
jbe 0x21b79
movzx eax, cx
shr rax, 1
cmp word [r8 + rax*2 - 2], r13w
jne 0x21b79
sub cx, r9w
mov word [rsp + 0x30], cx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
cmp eax, r13d
jne 0x21ba8
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov ebx, eax
cmp eax, r13d
cmovge ebx, r13d
mov edx, r12d
lea rax, [rsp + 0x98]
mov r9, rbp
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x20], 0x810
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, r13d
jge 0x21aaa
mov rcx, rsi
call fcn.0002e49c
mov rcx, rbp
call fcn.0002e49c
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x220fc
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
sub rsp, 0x40
mov rbx, rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x60]
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
add rsp, 0x40
pop rbx
ret
Function at 0x22148
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x00039100]
xor rax, rsp
mov qword [rsp + 0x60], rax
and dword [rsp + 0x30], 0
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x38]
mov rdx, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rsp + 0x30]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], r11
lea rdx, [rsp + 0x38]
mov r8d, 2
mov rcx, rbx
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x221bd
cmp dword [rsp + 0x4c], 4
jne 0x221b8
mov ecx, dword [rsp + 0x54]
mov dword [rdi], ecx
jmp 0x221bd
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.0002f1f0
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret
Function at 0x261b8
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x2c0
mov rax, qword [0x00039100]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
xor ebp, ebp
mov bl, cl
mov rdi, rdx
lea rcx, [r11 - 0x226]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x38], ebp
mov word [rsp + 0xa0], bp
call fcn.0002f810
lea r11, [rsp + 0xa0]
mov eax, 0x208
mov word [rsp + 0x50], bp
mov word [rsp + 0x52], ax
mov qword [rsp + 0x58], r11
cmp bl, bpl
je 0x2625d
cmp word [0x00041990], bp
je 0x263ba
lea rdx, [0x00041990]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rcx, [rsp + 0x90]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x30]
mov edx, 0x80000000
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x78], 0x240
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rbp
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebp
jl 0x263ba
mov edx, 0x818
mov ecx, 1
call fcn.0002e424
mov rcx, qword [rsp + 0x30]
mov rbx, rax
cmp rax, rbp
je 0x263b4
lea rax, [rsp + 0x38]
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov esi, ebp
mov dword [rsp + 0x20], 0x818
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, ebp
jl 0x263a7
lea rdi, [rbx + 0x10]
movzx ecx, word [rbx + 0xc]
inc esi
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
cmp cx, 6
jb 0x2637a
cmp word [rdi], 0x7b
je 0x2636b
lea rdx, [rdi + 2]
cmp word [rdx], 0x7b
jne 0x2637a
movzx eax, cx
shr rax, 1
cmp word [rdi + rax*2 - 2], 0x7d
jne 0x2637a
mov eax, 0xfffe
mov qword [rsp + 0x48], rdx
add cx, ax
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], cx
lea rcx, [rsp + 0x40]
mov edx, 5
call fcn.00026038
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, esi
mov dword [rsp + 0x20], 0x818
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, ebp
jge 0x2631b
mov rcx, rbx
call fcn.0002e49c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.0002f1f0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret