joyce8/EMBER2024-capa huggingface dataset:
Function at 0x17e40
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov r15d, dword [rcx]
mov rbx, qword [rcx + 4]
xor r12d, r12d
mov rdi, rcx
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x28], rbx
cmp r15d, r12d
je 0x17ffb
mov dword [rcx], r12d
lea ebp, [r12 + 5]
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov ecx, ebp
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov r13d, 0xc0000004
cmp eax, r13d
jne 0x17ffb
mov edx, dword [rsp + 0x20]
mov ecx, 1
call fcn.00036578
mov rsi, rax
mov qword [rsp + 0x30], rax
cmp rax, r12
je 0x17ffb
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, ebp
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, r13d
jne 0x17f00
mov rcx, rsi
call fcn.000365f0
jmp 0x17ebd
cmp eax, r12d
jge 0x17f0d
mov rcx, rsi
jmp 0x17ff6
mov rbp, rsi
lea r14, [rdi + 0xc]
mov esi, r12d
cmp qword [rbp + 0x40], r12
je 0x17fdb
mov rdx, qword [rbp + 0x50]
mov rcx, rbx
call fcn.00033974
cmp al, r12b
je 0x17fdb
mov rcx, qword [rbp + 0x50]
call fcn.000269bc
mov r13, rax
cmp rax, r12
je 0x17fdb
movsxd rbx, esi
xor edx, edx
mov r8d, 0x104
mov rcx, rbx
imul rcx, rcx, 0x210
lea r12, [rcx + rdi + 0x14]
mov rcx, r12
call fcn.0003b290
mov rcx, r13
mov r11d, 0x104
imul rbx, rbx, 0x210
sub rcx, rbx
sub rcx, rdi
xor edx, edx
lea rax, [r11 + 0x7ffffefa]
cmp rax, rdx
je 0x17fab
movzx eax, word [rcx + r12 - 0x14]
cmp ax, dx
je 0x17fab
mov word [r12], ax
add r12, 2
sub r11, 1
jne 0x17f85
cmp r11, rdx
jne 0x17fb4
sub r12, 2
mov word [r12], dx
mov rax, qword [rbp + 0x50]
mov rcx, r13
mov qword [r14], rax
inc dword [rdi]
add r14, 0x210
inc esi
call fcn.000365f0
mov rbx, qword [rsp + 0x28]
xor r12d, r12d
cmp dword [rdi], r15d
jae 0x17ff1
cmp dword [rbp], r12d
je 0x17ff1
mov eax, dword [rbp]
add rbp, rax
jmp 0x17f17
mov rcx, qword [rsp + 0x30]
call fcn.000365f0
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.0003ac70
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1807c
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [0x0004ace8]
mov rbx, rcx
cmp eax, 0xffffffff
jne 0x18105
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call fcn.0003b290
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
xor ecx, ecx
cmp eax, ecx
je 0x180da
mov dword [0x0004ace8], ecx
mov al, cl
jmp 0x18105
cmp dword [rsp + 0x24], 6
jb 0x180d0
mov eax, 1
mov dword [0x0004ace8], eax
jne 0x18105
cmp dword [rsp + 0x28], ecx
jne 0x18105
cmp word [rsp + 0x134], ax
cmovb eax, ecx
mov dword [0x0004ace8], eax
movzx eax, al
mov dword [rbx], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.0003ac70
add rsp, 0x150
pop rbx
ret
Function at 0x1812c
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x18160
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessCreateTimeQuadPart]
mov rcx, qword [rsp + 0x30]
mov qword [rbx + 4], rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rsp, 0x20
pop rbx
ret

Function at 0x19314
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov qword [rsp + 0x30], rbx
cmp rcx, qword [0x0004d308]
jne 0x19332
mov al, 1
jmp 0x1938e
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, ebx
jge 0x19345
xor al, al
jmp 0x1938e
mov rcx, qword [rsp + 0x30]
call fcn.0003acde
mov rdi, rax
cmp rax, rbx
je 0x19381
lea rdx, [0x0003bb00]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe__stricmp]
cmp eax, ebx
je 0x1937f
lea rdx, [0x0003bad0]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe__stricmp]
cmp eax, ebx
jne 0x19381
mov bl, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x19848
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov ebx, edx
mov rdi, rcx
lea rdx, [0x0003bdc0]
lea rcx, [rsp + 0x60]
mov r8d, 0xf003f
call fcn.00026d58
test eax, eax
js 0x198b5
lea rdx, [0x0003be10]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1b038
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, rcx
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rsi, rax
jne 0x1b079
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
xor bl, bl
mov qword [rsp + 0x20], rax
jmp 0x1b099
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1b092
xor al, al
jmp 0x1b194
mov rax, qword [rsp + 0x20]
mov bl, 1
mov rcx, rax
call fcn.0003acde
mov rdx, rax
test rax, rax
jne 0x1b0ba
test bl, bl
je 0x1b08b
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1b08b
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x0003c000]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [0x0003c000]
call qword [sym.imp.ntoskrnl.exe__strnicmp]
test eax, eax
sete dil
test bl, bl
je 0x1b0f8
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
and qword [rsp + 0x20], 0
test dil, dil
je 0x1b08b
mov rcx, rsi
call fcn.000269bc
mov rbx, rax
test rax, rax
je 0x1b08b
lea r8, [0x0003c010]
lea rcx, [rsp + 0x30]
movabs r9, 0xfffff78000000030
mov edx, 0x32
call fcn.0002f330
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
mov rdx, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe__wcsnicmp]
test eax, eax
sete dil
test dil, dil
je 0x1b189
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_wcsrchr]
test rax, rax
je 0x1b189
lea rcx, [rax + 2]
lea rdx, [0x0003c030]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
sete dil
mov rcx, rbx
call fcn.000365f0
mov al, dil
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.0003ac70
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1e05c
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
and qword [rax + 0x18], 0
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
jne 0x1e0a3
lea rdx, [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1e0a3
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessSectionBaseAddress]
mov rcx, qword [rsp + 0x48]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, rdi
call fcn.00033410
mov rsi, rax
test rax, rax
jne 0x1e0b7
xor eax, eax
jmp 0x1e121
mov edx, 0x400
mov ecx, 1
call fcn.00036578
mov rdi, rax
test rax, rax
je 0x1e0b3
xor edx, edx
mov r8d, 0x400
mov rcx, rax
call fcn.0003b290
lea r11, [rsp + 0x50]
mov r9, rdi
mov qword [rsp + 0x28], r11
mov r8d, 2
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x20], 0x3fe
call fcn.0001ddf0
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
jns 0x1e11e
mov rcx, rdi
call fcn.000365f0
jmp 0x1e0b3
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1e57c
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x70
mov rdi, rdx
lea rcx, [rsp + 0x50]
mov rdx, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
test eax, eax
js 0x1e625
lea rcx, [rsp + 0x60]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov edi, eax
test eax, eax
js 0x1e618
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
mov r9d, 1
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
xor ecx, ecx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [0x0003ba70]
call qword [sym.imp.ntoskrnl.exe_RtlWriteRegistryValue]
lea rcx, [rsp + 0x40]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov eax, edi
add rsp, 0x70
pop rdi
ret

Function at 0x1e67c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0xb0
xor edi, edi
lea rax, [0x0001e634]
mov qword [r11 - 0x78], rax
mov dword [rsp + 0x48], 4
mov qword [r11 - 0x60], rdi
lea rax, [0x0003b9a0]
lea edx, [rdi + 0x10]
lea ecx, [rdi + 1]
mov qword [r11 - 0x68], rax
mov dword [rsp + 0x60], edi
mov qword [r11 - 0x50], rdi
mov dword [rsp + 0x70], edi
mov qword [r11 - 0x40], rdi
mov dword [r11 - 0x38], edi
mov qword [r11 - 0x30], rdi
mov qword [r11 - 0x28], rdi
mov dword [r11 - 0x20], edi
mov qword [r11 - 0x18], rdi
mov dword [r11 - 0x10], edi
call fcn.00036578
mov rbx, rax
mov qword [rsp + 0x58], rax
cmp rax, rdi
jne 0x1e6f3
xor eax, eax
jmp 0x1e73d
xor eax, eax
lea rdx, [0x0003b5b0]
lea rcx, [rsp + 0x30]
mov qword [rbx], rax
mov qword [rbx + 8], rax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0x40]
lea rdx, [0x0003ba70]
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp eax, edi
jge 0x1e738
mov rcx, rbx
call fcn.000365f0
jmp 0x1e6ef
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rdi
ret
Function at 0x1e754
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0xa0
xor ebp, ebp
lea rax, [0x0001e634]
mov rdi, rdx
mov qword [r11 - 0x78], rax
mov dword [rsp + 0x38], 4
mov qword [r11 - 0x68], r8
mov qword [r11 - 0x60], rbp
mov dword [rsp + 0x50], ebp
mov qword [r11 - 0x50], rbp
mov dword [rsp + 0x60], ebp
mov esi, ecx
mov qword [r11 - 0x40], rbp
mov dword [rsp + 0x70], ebp
lea edx, [rbp + 0x10]
lea ecx, [rbp + 1]
mov qword [r11 - 0x30], rbp
mov qword [r11 - 0x28], rbp
mov dword [r11 - 0x20], ebp
mov qword [r11 - 0x18], rbp
mov dword [r11 - 0x10], ebp
call fcn.00036578
mov rbx, rax
mov qword [rsp + 0x48], rax
cmp rax, rbp
jne 0x1e7d1
xor eax, eax
jmp 0x1e819
xor eax, eax
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rbx], rax
mov rdx, rdi
mov ecx, esi
mov qword [rbx + 8], rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp eax, ebp
jge 0x1e800
mov rcx, rbx
call fcn.000365f0
jmp 0x1e7cd
cmp word [rbx], bp
jne 0x1e816
cmp qword [rbx + 8], rbp
je 0x1e7f6
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
jmp 0x1e7f6
mov rax, rbx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1ea08
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0xb0
xor edi, edi
lea rax, [0x0001e634]
lea r8, [r11 - 0x78]
mov qword [r11 - 0x78], rax
mov dword [rsp + 0x48], 4
lea rax, [0x0003cc20]
mov qword [r11 - 0x68], rax
lea rax, [rsp + 0x30]
lea rdx, [0x0003ba70]
mov qword [r11 - 0x60], rax
mov dword [rsp + 0x60], edi
xor eax, eax
mov qword [r11 - 0x50], rdi
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor ecx, ecx
mov qword [r11 - 0x80], rax
mov qword [r11 - 0x40], rdi
mov dword [r11 - 0x38], edi
mov qword [r11 - 0x30], rdi
mov qword [r11 - 0x28], rdi
mov dword [r11 - 0x20], edi
mov qword [r11 - 0x18], rdi
mov dword [r11 - 0x10], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp eax, edi
jge 0x1ea9a
mov al, 1
jmp 0x1eae4
mov rdx, qword [rsp + 0x58]
mov ebx, 1
lea rdi, [0x0003b5b0]
mov rsi, qword [rdx + 8]
mov rcx, rbx
repe cmpsw word [rsi], word [rdi]
je 0x1ead9
mov rsi, qword [rdx + 8]
lea rdi, [0x0003ca10]
lea ecx, [rbx + 1]
xor eax, eax
repe cmpsw word [rsi], word [rdi]
je 0x1ead1
sbb eax, eax
sbb eax, 0xffffffff
neg eax
sbb al, al
and al, bl
mov bl, al
mov rcx, rdx
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov al, bl
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1eb00
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0xb0
xor edi, edi
lea rax, [0x0001e634]
lea r8, [r11 - 0x78]
mov qword [r11 - 0x78], rax
mov dword [rsp + 0x48], 4
lea rax, [0x0003cc60]
mov qword [r11 - 0x68], rax
lea rax, [rsp + 0x30]
lea rdx, [0x0003ba70]
mov qword [r11 - 0x60], rax
mov dword [rsp + 0x60], edi
xor eax, eax
mov qword [r11 - 0x50], rdi
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor ecx, ecx
mov qword [r11 - 0x80], rax
mov qword [r11 - 0x40], rdi
mov dword [r11 - 0x38], edi
mov qword [r11 - 0x30], rdi
mov qword [r11 - 0x28], rdi
mov dword [r11 - 0x20], edi
mov qword [r11 - 0x18], rdi
mov dword [r11 - 0x10], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp eax, edi
jge 0x1eb92
mov al, 1
jmp 0x1ebdc
mov rdx, qword [rsp + 0x58]
mov ebx, 1
lea rdi, [0x0003b5b0]
mov rsi, qword [rdx + 8]
mov rcx, rbx
repe cmpsw word [rsi], word [rdi]
je 0x1ebd1
mov rsi, qword [rdx + 8]
lea rdi, [0x0003ca10]
lea ecx, [rbx + 1]
xor eax, eax
repe cmpsw word [rsi], word [rdi]
je 0x1ebc9
sbb eax, eax
sbb eax, 0xffffffff
neg eax
sbb al, al
and al, bl
mov bl, al
mov rcx, rdx
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov al, bl
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1ed8c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0xb0
xor ebx, ebx
lea rax, [0x0001e634]
lea r8, [r11 - 0x78]
mov qword [r11 - 0x78], rax
mov dword [rsp + 0x48], 4
lea rax, [0x0003ccf0]
mov qword [r11 - 0x68], rax
lea rax, [rsp + 0x30]
lea rdx, [0x0003ba70]
mov qword [r11 - 0x60], rax
mov dword [rsp + 0x60], ebx
xor eax, eax
mov qword [r11 - 0x50], rbx
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor ecx, ecx
mov qword [r11 - 0x80], rax
mov qword [r11 - 0x40], rbx
mov dword [r11 - 0x38], ebx
mov qword [r11 - 0x30], rbx
mov qword [r11 - 0x28], rbx
mov dword [r11 - 0x20], ebx
mov qword [r11 - 0x18], rbx
mov dword [r11 - 0x10], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp eax, ebx
jge 0x1ee1e
xor al, al
jmp 0x1ee65
mov rdx, qword [rsp + 0x58]
lea rdi, [0x0003b5b0]
mov ecx, 1
mov rsi, qword [rdx + 8]
repe cmpsw word [rsi], word [rdi]
je 0x1ee5a
mov rsi, qword [rdx + 8]
xor eax, eax
lea rdi, [0x0003ca10]
lea ecx, [rax + 2]
repe cmpsw word [rsi], word [rdi]
je 0x1ee52
sbb eax, eax
sbb eax, 0xffffffff
neg eax
sbb al, al
and al, 1
mov bl, al
mov rcx, rdx
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov al, bl
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1ef5c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov edi, ecx
lea r8, [rax + 0x10]
xor r14d, r14d
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov ebp, 0xc0000001
mov dword [rax + 0x10], r14d
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
cmp dword [rsp + 0x68], 0x1771
ja 0x1efa4
lea eax, [rbp + 1]
jmp 0x1f17c
cmp edi, 2
jne 0x1efb2
lea r13, [0x0003cd40]
jmp 0x1efc2
cmp edi, 1
jne 0x1f177
lea r13, [0x0003cd70]
lea r8, [0x0003c1a0]
lea rdx, [0x0003cd20]
mov ecx, 1
call fcn.0001e754
mov rsi, rax
cmp rax, r14
jne 0x1efe9
mov eax, ebp
jmp 0x1f17c
movzx ecx, word [rax]
shr ecx, 1
je 0x1f15b
dec ecx
movsxd rax, ecx
cmp rax, r14
jl 0x1f01a
mov rdi, qword [rsi + 8]
lea rdx, [rdi + rax*2]
cmp word [rdx], 0x5c
je 0x1f05e
dec rax
dec ecx
sub rdx, 2
cmp rax, r14
jge 0x1f006
mov rbx, r14
cmp rbx, r14
je 0x1f15b
add rbx, 2
lea rdx, [0x0003cd40]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
cmp eax, r14d
je 0x1f067
lea rdx, [0x0003cd70]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
cmp eax, r14d
je 0x1f067
mov ebp, 0xc000036d
jmp 0x1f15b
movsxd rax, ecx
lea rbx, [rdi + rax*2]
jmp 0x1f01d
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov ecx, 1
sub eax, dword [rsi + 8]
add eax, ebx
mov edx, eax
mov edi, eax
call fcn.00036578
mov r12, rax
cmp rax, r14
je 0x1f15b
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.0003b290
mov r11, qword [rsi + 8]
shr rdi, 1
sub rbx, r11
cmp rdi, r14
je 0x1f10a
cmp rdi, 0x7fffffff
ja 0x1f10a
shr rbx, 1
cmp rbx, 0x7ffffffe
jbe 0x1f0d0
mov word [r12], r14w
jmp 0x1f10a
sub rbx, rdi
mov rdx, rdi
mov rcx, r12
sub r11, r12
lea rax, [rbx + rdx]
cmp rax, r14
je 0x1f0fd
movzx eax, word [r11 + rcx]
cmp ax, r14w
je 0x1f0fd
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1f0dc
cmp rdx, r14
jne 0x1f106
sub rcx, 2
mov word [rcx], r14w
mov r8, r13
mov rdx, rdi
mov rcx, r12
call fcn.0001e4b0
or rcx, 0xffffffffffffffff
xor eax, eax
mov r9d, 2
mov rdi, r12
lea r8, [0x0003c1a0]
repne scasw ax, word [rdi]
lea rdx, [0x0003cd20]
not rcx
lea eax, [rcx + rcx]
lea ecx, [r9 - 1]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_RtlWriteRegistryValue]
mov rcx, r12
mov ebp, eax
call fcn.000365f0
cmp qword [rsi + 8], r14
je 0x1f16a
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov rcx, rsi
call fcn.000365f0
jmp 0x1efe2
mov eax, 0xc000000d
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x21268
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x98
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x84], 1
mov dword [rsp + 0x80], 0
lea r9, [rsp + 0x78]
mov r8d, 0x40
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [rsp + 0x7c], eax
cmp dword [rsp + 0x7c], 0
jl 0x212e1
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x24]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov eax, dword [rsp + 0x88]
shl eax, 5
mov ecx, dword [rsp + 0x24]
shl ecx, 4
add ecx, dword [rsp + 0x84]
add ecx, eax
mov eax, dword [rsp + 0x20]
lea eax, [rcx + rax*2]
add eax, dword [rsp + 0x70]
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x80]
shr eax, 8
add eax, 0xff
mov ecx, dword [rsp + 0x80]
and ecx, eax
mov eax, dword [rsp + 0x80]
shr eax, 0x10
add eax, 0xff
and ecx, eax
mov eax, dword [rsp + 0x80]
shr eax, 0x18
add eax, 0xff
and ecx, eax
and ecx, 0xff
mov eax, dword [rsp + 0x80]
add eax, ecx
mov dword [rsp + 0x80], eax
mov ecx, dword [rsp + 0x80]
and ecx, 0xff
mov eax, dword [rsp + 0x80]
shr eax, 8
and eax, 0xff
imul ecx, eax
mov eax, dword [rsp + 0x80]
add eax, ecx
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x80]
add rsp, 0x98
ret

Function at 0x21f94
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor edi, edi
mov ebx, ecx
lea rcx, [r11 - 0x58]
lea r8d, [rdi + 0x40]
xor edx, edx
call fcn.0003b290
mov dword [rsp + 0xa0], ebx
lea ecx, [rdi + 1]
lea rdx, [rsp + 0xa4]
mov eax, ecx
xor eax, 0x64
add eax, ecx
inc ecx
imul eax, dword [rdx - 4]
mov dword [rdx], eax
add rdx, 4
cmp ecx, 0x10
jb 0x21fda
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x20]
mov r8d, 0x40
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], 0x67452301
mov dword [rsp + 0x6c], 0xefcdab89
mov dword [rsp + 0x70], 0x98badcfe
mov dword [rsp + 0x74], 0x10325476
mov dword [rsp + 0x78], 0xc3d2e1f0
call fcn.000206f8
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.000207c4
lea r11, [rsp + 0x80]
mov eax, 5
xor edi, dword [r11]
add r11, 4
sub rax, 1
jne 0x22056
lea rax, [rsp + 0x80]
mov edx, 0x14
movzx ecx, byte [rax]
inc rax
add edi, ecx
sub rdx, 1
jne 0x22070
mov eax, edi
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.0003ac70
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rdi
ret
Function at 0x239a0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x450
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov ebp, dword [rcx]
xor r14d, r14d
mov rsi, rcx
mov dword [rsp + 0x20], r14d
mov r13d, r14d
cmp ebp, r14d
je 0x23b58
mov dword [rcx], r14d
lea edi, [r14 + 5]
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov r12d, 0xc0000004
cmp eax, r12d
jne 0x23b58
mov edx, dword [rsp + 0x20]
mov ecx, 1
call fcn.00036578
mov rbx, rax
cmp rax, r14
je 0x23b58
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, r12d
jne 0x23a4d
mov rcx, rbx
call fcn.000365f0
jmp 0x23a0f
cmp eax, r14d
jl 0x23b50
mov rcx, qword [0x0004d828]
mov rdi, rbx
lea r12, [rsi + 0x224]
cmp qword [rdi + 0x40], r14
je 0x23b3d
mov rax, qword [rdi + 0x50]
mov qword [rsp + 0x28], rax
cmp rcx, r14
je 0x23b3d
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r9, rcx
call fcn.0001b3e0
cmp al, r14b
je 0x23b36
mov rcx, qword [rdi + 0x50]
call fcn.000269bc
mov r11, rax
cmp rax, r14
je 0x23b36
movsxd rdx, r13d
mov r9d, 0x104
mov rcx, rdx
imul rdx, rdx, 0x214
imul rcx, rcx, 0x214
lea r8, [rcx + rsi + 0x1c]
mov rcx, rax
sub rcx, rdx
sub rcx, rsi
lea rax, [r9 + 0x7ffffefa]
cmp rax, r14
je 0x23b01
movzx eax, word [rcx + r8 - 0x1c]
cmp ax, r14w
je 0x23b01
mov word [r8], ax
add r8, 2
sub r9, 1
jne 0x23adb
cmp r9, r14
jne 0x23b0a
sub r8, 2
mov word [r8], r14w
mov rax, qword [rdi + 0x50]
mov rcx, r11
mov qword [r12 - 0x210], rax
mov eax, dword [rsp + 0x38]
inc r13d
mov dword [r12], eax
inc dword [rsi]
add r12, 0x214
call fcn.000365f0
mov rcx, qword [0x0004d828]
cmp dword [rsi], ebp
jae 0x23b50
cmp dword [rdi], r14d
je 0x23b50
mov eax, dword [rdi]
add rdi, rax
jmp 0x23a67
mov rcx, rbx
call fcn.000365f0
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.0003ac70
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret