joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ae44
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x110
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rsi, rcx
mov rbp, r8
mov rdi, rdx
mov ebx, 0xdc
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8, rbx
call fcn.0005d630
and dword [rsp + 0x20], 0
and dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
mov dword [rsp + 0x38], 0xc3d2e1f0
test rdi, rdi
je 0x4aec9
lea rcx, [rsp + 0x20]
mov r8, rdi
mov rdx, rsi
call fcn.0004ac1c
lea rcx, [rsp + 0x20]
mov rdx, rbp
call fcn.0004acec
lea rax, [rsp + 0x20]
mov byte [rax], 0
inc rax
sub rbx, 1
jne 0x4aedb
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.0005cf80
mov rbx, qword [rsp + 0x148]
add rsp, 0x110
pop rdi
pop rsi
pop rbp
ret

Function at 0x4af10
Capabilities:
Authenticate hmac
Encode data using xor
Hash data using sha1

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x40
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov edi, 0x14
mov rbp, r8
mov rsi, rdx
lea r15d, [rdi + 0x2c]
mov rbx, rcx
cmp r8, r15
jbe 0x4af5d
lea r8, [rsp + 0x20]
mov rdx, rbp
mov rcx, rsi
call fcn.0004ae44
mov rbp, rdi
lea rsi, [rsp + 0x20]
lea rcx, [rbx + 0x5c]
mov r8, r15
mov edx, 0x36
call fcn.0005d630
lea r12, [rbx + 0x9c]
mov r8, r15
mov rcx, r12
mov edx, 0x5c
call fcn.0005d630
test rbp, rbp
je 0x4afa3
mov al, byte [rsi]
xor byte [r12 - 0x40], al
mov al, byte [rsi]
inc rsi
xor byte [r12], al
inc r12
sub rbp, 1
jne 0x4af8a
and dword [rbx], 0
and dword [rbx + 4], 0
lea rdx, [rbx + 0x5c]
mov r8, r15
mov rcx, rbx
mov dword [rbx + 8], 0x67452301
mov dword [rbx + 0xc], 0xefcdab89
mov dword [rbx + 0x10], 0x98badcfe
mov dword [rbx + 0x14], 0x10325476
mov dword [rbx + 0x18], 0xc3d2e1f0
call fcn.0004ac1c
lea rax, [rsp + 0x20]
mov byte [rax], 0
inc rax
sub rdi, 1
jne 0x4afe1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.0005cf80
add rsp, 0x40
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x4b010
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
lea rdx, [rsp + 0x20]
mov rbx, rcx
call fcn.0004acec
and dword [rbx], 0
and dword [rbx + 4], 0
lea rdx, [rbx + 0x9c]
mov r8d, 0x40
mov rcx, rbx
mov dword [rbx + 8], 0x67452301
mov dword [rbx + 0xc], 0xefcdab89
mov dword [rbx + 0x10], 0x98badcfe
mov dword [rbx + 0x14], 0x10325476
mov dword [rbx + 0x18], 0xc3d2e1f0
call fcn.0004ac1c
mov esi, 0x14
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, rsi
call fcn.0004ac1c
mov rdx, rdi
mov rcx, rbx
call fcn.0004acec
lea rax, [rsp + 0x20]
mov byte [rax], 0
inc rax
sub rsi, 1
jne 0x4b0a2
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.0005cf80
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x4b454
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
mov r12d, dword [r8]
mov rbx, rdx
mov edx, dword [rdx]
mov r11, r8
mov r10, rcx
mov rsi, rcx
mov ebp, 0x10
mov r13d, 0xff
xor edx, dword [rsi]
add rsi, 4
mov ecx, edx
movzx r9d, dx
mov edi, edx
shr ecx, 8
and r9w, r13w
movzx r8d, cx
shr ecx, 8
mov eax, ecx
and r8w, r13w
shr eax, 8
movzx edx, al
movzx eax, cx
mov edx, dword [r10 + rdx*4 + 0x48]
movzx ecx, al
movzx eax, r8w
add edx, dword [r10 + rcx*4 + 0x448]
xor edx, dword [r10 + rax*4 + 0x848]
movzx eax, r9w
add edx, dword [r10 + rax*4 + 0xc48]
xor edx, r12d
sub rbp, 1
mov r12d, edi
jne 0x4b487
mov eax, dword [r10 + 0x44]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
xor eax, edi
mov rdi, qword [rsp + 0x30]
mov dword [rbx], eax
mov eax, dword [r10 + 0x40]
mov rbx, qword [rsp + 0x18]
xor eax, edx
mov dword [r11], eax
pop r13
pop r12
ret

Function at 0x4b518
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
mov r12d, dword [r8]
mov rbx, rdx
mov edx, dword [rdx]
mov r11, r8
mov r10, rcx
lea rsi, [rcx + 0x44]
mov ebp, 0x10
mov r13d, 0xff
xor edx, dword [rsi]
sub rsi, 4
mov ecx, edx
movzx r9d, dx
mov edi, edx
shr ecx, 8
and r9w, r13w
movzx r8d, cx
shr ecx, 8
mov eax, ecx
and r8w, r13w
shr eax, 8
movzx edx, al
movzx eax, cx
mov edx, dword [r10 + rdx*4 + 0x48]
movzx ecx, al
movzx eax, r8w
add edx, dword [r10 + rcx*4 + 0x448]
xor edx, dword [r10 + rax*4 + 0x848]
movzx eax, r9w
add edx, dword [r10 + rax*4 + 0xc48]
xor edx, r12d
sub rbp, 1
mov r12d, edi
jne 0x4b54c
mov eax, dword [r10]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
xor eax, edi
mov rdi, qword [rsp + 0x30]
mov dword [rbx], eax
mov eax, dword [r10 + 4]
mov rbx, qword [rsp + 0x18]
xor eax, edx
mov dword [r11], eax
pop r13
pop r12
ret
Function at 0x4c2b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov r12, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
mov r13, r9
mov r14d, edx
mov r15, rcx
test r8b, 0xf
je 0x4c304
mov eax, 0xffffffda
jmp 0x4c3c3
test edx, edx
jne 0x4c361
test r8, r8
je 0x4c3c1
lea rdi, [r8 - 1]
mov rsi, r9
shr rdi, 4
sub rsi, rbx
inc rdi
movdqu xmm6, xmmword [r12]
mov r9, rbx
mov r8, r12
xor edx, edx
mov rcx, r15
call fcn.0004c050
mov ecx, 0x10
mov al, byte [rsi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x4c33d
add r12, 0x10
sub rsi, 0x10
sub rdi, 1
movdqu xmmword [r13], xmm6
jne 0x4c322
jmp 0x4c3c1
test r8, r8
je 0x4c3c1
lea rsi, [r8 - 1]
mov rdi, rbx
sub r12, r9
shr rsi, 4
sub rdi, r9
inc rsi
mov rcx, r13
mov edx, 0x10
mov al, byte [r12 + rcx]
xor al, byte [rcx]
mov byte [rdi + rcx], al
inc rcx
sub rdx, 1
jne 0x4c382
mov r9, rbx
mov r8, rbx
mov edx, r14d
mov rcx, r15
call fcn.0004c050
add r12, 0x10
add rdi, 0x10
movdqu xmm5, xmmword [rbx]
add rbx, 0x10
sub rsi, 1
movdqu xmmword [r13], xmm5
jne 0x4c37a
xor eax, eax
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.0005cf80
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [rsp + 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x4c570
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x4c5d1
xor eax, eax
jmp 0x4c5d6
mov rax, qword [rsp + 0x48]
add rsp, 0x58
ret

Function at 0x4c930
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov dword [rsp + 0x54], 0xc0000001
mov dword [rsp + 0x58], 0
lea rdi, [rsp + 0x5c]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rdi, [rsp + 0x60]
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0
cmp qword [rsp + 0x80], 0xffffffffffffffff
je 0x4c98e
cmp qword [rsp + 0x80], 0
jne 0x4c992
xor eax, eax
jmp 0x4c9ef
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jl 0x4c9ed
mov eax, dword [rsp + 0x60]
jmp 0x4c9ef
xor eax, eax
add rsp, 0x70
pop rdi
ret
Function at 0x4ca20
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov dword [rsp + 0x54], 0xc0000001
mov dword [rsp + 0x58], 0
lea rdi, [rsp + 0x5c]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rdi, [rsp + 0x60]
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0
cmp qword [rsp + 0x80], 0xffffffffffffffff
je 0x4ca7e
cmp qword [rsp + 0x80], 0
jne 0x4ca82
xor eax, eax
jmp 0x4cadf
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jl 0x4cadd
mov eax, dword [rsp + 0x60]
jmp 0x4cadf
xor eax, eax
add rsp, 0x70
pop rdi
ret

Function at 0x4caf0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x20], 5
mov r9d, 0x18
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jge 0x4cb41
cmp qword [rsp + 0x78], 0
jne 0x4cb3d
mov eax, 0xffffffff
jmp 0x4cb58
xor eax, eax
jmp 0x4cb58
cmp qword [rsp + 0x78], 0
je 0x4cb54
mov rcx, qword [rsp + 0x78]
mov eax, dword [rsp + 0x54]
mov dword [rcx], eax
mov eax, dword [rsp + 0x50]
add rsp, 0x68
ret
Function at 0x4cb70
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x98]
sar rax, 0x20
mov dword [rsp + 0x58], eax
mov ecx, 0xffffffff
mov rax, qword [rsp + 0x98]
and rax, rcx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0
je 0x4cc9c
cmp dword [rsp + 0x78], 1
je 0x4cbe3
cmp dword [rsp + 0x78], 2
je 0x4cc41
jmp 0x4cca8
mov dword [rsp + 0x20], 0xe
mov r9d, 8
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
add rax, rcx
mov qword [rsp + 0x40], rax
cmp dword [rsp + 0x50], 0
jge 0x4cc3f
cmp dword [rsp + 0x58], 0
je 0x4cc35
mov dword [rsp + 0x58], 0
mov eax, 0xffffffff
jmp 0x4cd09
jmp 0x4ccaf
mov dword [rsp + 0x20], 5
mov r9d, 0x18
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x68]
add rax, rcx
mov qword [rsp + 0x40], rax
cmp dword [rsp + 0x50], 0
jge 0x4cc9a
cmp dword [rsp + 0x58], 0
je 0x4cc93
mov dword [rsp + 0x58], 0
mov eax, 0xffffffff
jmp 0x4cd09
jmp 0x4ccaf
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
jmp 0x4ccaf
mov eax, 0xffffffff
jmp 0x4cd09
cmp qword [rsp + 0x40], 0
jge 0x4ccbe
mov eax, 0xffffffff
jmp 0x4cd09
mov dword [rsp + 0x20], 0xe
mov r9d, 8
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x4cd05
cmp dword [rsp + 0x58], 0
je 0x4ccfe
mov dword [rsp + 0x58], 0
mov eax, 0xffffffff
jmp 0x4cd09
mov eax, dword [rsp + 0x40]
add rsp, 0x88
ret
Function at 0x4cd20
Capabilities:
Set file attributes

Disassembly:
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xe0
mov qword [rsp + 0xa0], 0
mov dword [rsp + 0x60], 0
lea rdi, [rsp + 0x68]
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
mov dword [rsp + 0x90], 0
lea rdi, [rsp + 0x94]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rdi, [rsp + 0x98]
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov dword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0xb8], 0x418
mov ecx, dword [rsp + 0xb8]
call fcn.0004c4f0
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
jne 0x4cdce
xor eax, eax
jmp 0x4cfe2
mov ecx, dword [rsp + 0xb8]
mov rdi, qword [rsp + 0xb0]
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xf8]
movzx ecx, word [rax]
mov rax, qword [rsp + 0xb0]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0xf8]
mov rax, qword [rax + 8]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xb0]
add rax, 0x14
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
mov word [rsp + 0xd8], ax
mov rcx, qword [rsp + 0xc8]
movzx eax, word [rsp + 0xd8]
mov word [rcx], ax
mov rax, qword [rsp + 0xc0]
add rax, 2
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xc8]
add rax, 2
mov qword [rsp + 0xc8], rax
cmp word [rsp + 0xd8], 0
jne 0x4ce2f
mov rcx, qword [rsp + 0xb0]
movzx eax, byte [rsp + 0x100]
mov byte [rcx], al
mov rax, qword [rsp + 0xb0]
mov qword [rax + 8], 0
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x78], 0x40
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x28
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x60]
mov edx, 0x10000000
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [rsp + 0xa8], eax
cmp dword [rsp + 0xa8], 0
jge 0x4cf64
mov rcx, qword [rsp + 0xb0]
call fcn.0004c540
xor eax, eax
jmp 0x4cfe2
mov dword [rsp + 0x20], 0xa
mov r9d, dword [rsp + 0xb8]
mov r8, qword [rsp + 0xb0]
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov dword [rsp + 0xa8], eax
cmp dword [rsp + 0xa8], 0
jge 0x4cfc2
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0xb0]
call fcn.0004c540
xor eax, eax
jmp 0x4cfe2
mov rcx, qword [rsp + 0xb0]
call fcn.0004c540
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 1
add rsp, 0xe0
pop rdi
ret
Function at 0x4d000
Capabilities:
Set file attributes

Disassembly:
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x30], 0
lea rdi, [rsp + 0x38]
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
mov dword [rsp + 0x60], 0
lea rdi, [rsp + 0x64]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rdi, [rsp + 0x68]
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov dword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x88], 0x418
cmp qword [rsp + 0xc0], 0
jne 0x4d08b
xor eax, eax
jmp 0x4d1fc
mov ecx, dword [rsp + 0x88]
call fcn.0004c4f0
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
jne 0x4d0b1
xor eax, eax
jmp 0x4d1fc
mov ecx, dword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xc8]
movzx ecx, word [rax]
mov rax, qword [rsp + 0x80]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x80]
add rax, 0x14
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x90]
movzx eax, word [rax]
mov word [rsp + 0xa8], ax
mov rcx, qword [rsp + 0x98]
movzx eax, word [rsp + 0xa8]
mov word [rcx], ax
mov rax, qword [rsp + 0x90]
add rax, 2
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x98]
add rax, 2
mov qword [rsp + 0x98], rax
cmp word [rsp + 0xa8], 0
jne 0x4d112
mov rcx, qword [rsp + 0x80]
movzx eax, byte [rsp + 0xd0]
mov byte [rcx], al
mov rax, qword [rsp + 0x80]
mov qword [rax + 8], 0
mov dword [rsp + 0x20], 0xa
mov r9d, dword [rsp + 0x88]
mov r8, qword [rsp + 0x80]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0
jge 0x4d1df
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x80]
call fcn.0004c540
xor eax, eax
jmp 0x4d1fc
mov rcx, qword [rsp + 0x80]
call fcn.0004c540
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 1
add rsp, 0xb0
pop rdi
ret

Function at 0x4de40
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0x1000
mov dword [rsp + 0x3c], 0xc0000001
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov edx, dword [rsp + 0x40]
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x4de94
jmp 0x4dee2
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov ecx, 0x10
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
jge 0x4dece
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x40]
shl eax, 1
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x3c], 0xc0000004
je 0x4de76
mov rax, qword [rsp + 0x30]
add rsp, 0x58
ret
Function at 0x4e1c0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0xc0000001
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0xa0]
call fcn.0004c740
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jbe 0x4e2fd
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [r8]
mov edx, 0x10000000
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
cmp qword [rsp + 0x40], 0
je 0x4e2fd
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x28]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x28]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x28]
mov qword [rax + 8], 0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x58], 0x30
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x70], 0x200
lea rax, [rsp + 0x48]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov dword [rsp + 0x38], eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [rsp + 0x38], 0
jl 0x4e311
mov dword [rsp + 0x88], 1
jmp 0x4e31c
mov dword [rsp + 0x88], 0
mov eax, dword [rsp + 0x88]
add rsp, 0x98
ret
Function at 0x4f0e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0x10
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x40], 0x200
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x48], 0
xor r8d, r8d
mov edx, 2
mov ecx, 2
call fcn.0004f020
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0xffffffffffffffff
jne 0x4f166
jmp 0x4f2f9
mov edx, dword [rsp + 0x40]
mov r8d, 0x746b734b
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x4f18a
jmp 0x4f2f9
mov ecx, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x30]
xor eax, eax
rep stosb byte [rdi], al
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
call fcn.0004f350
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0
jge 0x4f1be
jmp 0x4f2f9
mov eax, 2
mov word [rsp + 0x70], ax
mov dword [rsp + 0x74], 0x72727272
mov eax, 0x3500
mov word [rsp + 0x72], ax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.0004eec0
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0
jge 0x4f213
jmp 0x4f2f9
mov r8d, dword [rsp + 0x40]
mov edx, dword [rsp + 0x5c]
lea rcx, str.__u___u__n
call sub.ntoskrnl.exe_DbgPrint
mov ecx, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x30]
xor eax, eax
rep stosb byte [rdi], al
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x200
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.0004ecb0
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0
jge 0x4f26f
jmp 0x4f2f9
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax + 2]
shr ax, 8
and ax, 0xf
movzx eax, ax
test eax, eax
je 0x4f293
jmp 0x4f2f9
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x30]
add rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movzx eax, word [rax + 2]
cmp eax, 0x100
je 0x4f2e3
mov rax, qword [rsp + 0x60]
movzx eax, word [rax + 0xa]
test eax, eax
je 0x4f2e3
mov rax, qword [rsp + 0x60]
movzx ecx, word [rax + 0xa]
call fcn.0004f5d0
movzx ecx, ax
mov rax, qword [rsp + 0x60]
lea rax, [rax + rcx + 0xc]
mov qword [rsp + 0x60], rax
jmp 0x4f2a4
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x44], eax
xor eax, eax
test eax, eax
jne 0x4f142
cmp qword [rsp + 0x38], 0xffffffffffffffff
je 0x4f30b
mov rcx, qword [rsp + 0x38]
call fcn.0004e6b0
cmp qword [rsp + 0x30], 0
je 0x4f323
mov edx, 0x746b734b
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.0005cf80
add rsp, 0x90
pop rdi
ret
Function at 0x4fb00
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x20], 0x30
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x38], 0x40
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
lea r8, [rsp + 0x20]
mov edx, 0xf003f
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
jl 0x4fb8b
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov dword [rsp + 0x58], eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0x78
ret

Function at 0x4fba0
Capabilities:
Print debug messages
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x40], 0x30
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x58], 0x40
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
lea r8, [rsp + 0x40]
mov edx, 0xf003f
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0
jl 0x4fc8b
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xb0]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov dword [rsp + 0x78], eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwFlushKey]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x4fc9b
mov edx, dword [rsp + 0x78]
lea rcx, str.__ZwCreateKey_Error:__d_n
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x98
ret