joyce8/EMBER2024-capa huggingface dataset:
Function at 0x17304
Capabilities:
Map section object

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0xc0
xor eax, eax
xor ebp, ebp
mov rsi, r8
mov rbx, rcx
mov rdi, rdx
lea r8d, [rbp + 0x28]
lea rcx, [r11 - 0x40]
mov word [rsp + 0x70], bp
mov qword [r11 - 0x66], rax
xor edx, edx
mov dword [rsp + 0x7a], eax
mov word [rsp + 0x7e], ax
mov dword [r11 - 0x48], ebp
call fcn.00028240
xor eax, eax
mov dword [rsp + 0x84], eax
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x80], ebp
mov qword [rsp + 0xe0], rbp
mov qword [rsp + 0xf8], rbp
cmp rbx, rbp
je 0x1750b
cmp rdi, rbp
je 0x1750b
mov qword [rdi], rbp
lea rcx, [rsp + 0x70]
mov rdx, rbx
mov qword [rsi], rbp
call qword [fcn.004e696c]
mov dword [rsp + 0x68], 0x100
mov qword [rsp + 0x60], rbp
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x40], 0x20
lea rax, [rsp + 0x70]
mov qword [rsp + 0xa0], rax
lea eax, [rbp + 1]
lea ebx, [rbp + 0x30]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x90]
lea rcx, [rsp + 0xe0]
mov edx, 0x80100000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x90], ebx
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0xa8], 0x240
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rbp
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
cmp eax, ebp
jge 0x17437
xor al, al
jmp 0x1750b
mov rax, qword [rsp + 0xe0]
xor r9d, r9d
lea r8, [rsp + 0x90]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0xf8]
lea edx, [r9 + 5]
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x90], ebx
mov qword [rsp + 0x98], rbp
mov dword [rsp + 0x20], 8
mov dword [rsp + 0xa8], 0x200
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0xb8], rbp
call qword [sym.imp.ntoskrnl.exe_ZwCreateSection]
mov rcx, qword [rsp + 0xe0]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp ebx, ebp
jl 0x17430
mov rcx, qword [rsp + 0xf8]
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov r8, rdi
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov rcx, qword [rsp + 0xf8]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp ebx, ebp
setge al
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1a018
Capabilities:
Parse pe header

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x0002c100]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebx, ebx
mov byte [rsp + 0x38], bl
xor eax, eax
mov qword [r11 - 0x2f], rax
mov qword [r11 - 0x27], rax
mov qword [r11 - 0x1f], rax
mov dword [rsp + 0x51], eax
mov word [rsp + 0x55], ax
mov byte [rsp + 0x57], al
mov byte [rsp + 0x30], 0xb8
mov byte [rsp + 0x31], 0x6c
mov byte [rsp + 0x32], 3
mov byte [rsp + 0x33], bl
mov byte [rsp + 0x34], 0xc0
mov byte [rsp + 0x35], 0xc2
lea esi, [rbx + 8]
mov byte [rsp + 0x36], sil
mov byte [rsp + 0x37], bl
mov byte [rsp + 0x24], 0xb8
mov byte [rsp + 0x25], 0x6c
mov byte [rsp + 0x26], 3
mov byte [rsp + 0x27], bl
mov byte [rsp + 0x28], 0xc0
mov byte [rsp + 0x29], 0xc3
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1a14f
movsxd r8, dword [rdx + 0x3c]
cmp dword [r8 + rdx], 0x4550
jne 0x1a14f
movzx ecx, word [r8 + rdx + 0x18]
cmp ecx, 0x10b
je 0x1a0f5
cmp ecx, 0x20b
jne 0x1a14f
mov edi, dword [r8 + rdx + 0x28]
add rdi, rdx
lea rdx, [r11 - 0x30]
lea rcx, [r11 - 0x44]
mov eax, dword [rcx]
mov dword [rdx], eax
movzx eax, word [rcx + 4]
mov word [rdx + 4], ax
lea esi, [rbx + 6]
jmp 0x1a108
lea eax, [r8 + rdx]
mov edi, dword [rax + 0x28]
add edi, edx
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, bl
je 0x1a14f
mov rbx, cr8
mov byte [rsp + 0x20], bl
mov eax, 2
mov cr8, rax
call fcn.00028140
nop
mov r8d, esi
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.000283d0
jmp 0x1a142
call fcn.00028154
movzx r11d, bl
mov cr8, r11
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.000281c0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1a6f8
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, qword [0x00065e90]
xor r15d, r15d
lea rcx, [0x00019ee0]
mov rsi, r15
mov r14d, r15d
call qword [sym.imp.ntoskrnl.exe_PsSetLoadImageNotifyRoutine]
cmp dword [0x0005ad10], r15d
jne 0x1a89f
mov rbp, qword [0x00065ea0]
cmp rbp, r15
je 0x1a89f
mov eax, dword [0x0005ad14]
cmp eax, 1
je 0x1a89f
cmp eax, 2
je 0x1a89f
cmp eax, 4
je 0x1a89f
cmp eax, 7
je 0x1a89f
cmp eax, 8
je 0x1a89f
cmp eax, 0x12
je 0x1a89f
movsxd rbx, dword [rbp + 0x3c]
add rbx, rbp
cmp dword [rbx], 0x4550
jne 0x1a89f
mov eax, 0x10b
cmp word [rbx + 0x18], ax
je 0x1a7b7
mov eax, 0x20b
cmp word [rbx + 0x18], ax
jne 0x1a89f
movzx eax, word [rbx + 0x14]
mov r13d, r15d
lea rdi, [rax + rbx + 0x18]
cmp r15w, word [rbx + 6]
jae 0x1a838
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, r15b
je 0x1a89f
lea rcx, [rdi + 8]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, r15b
je 0x1a89f
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, r15b
je 0x1a89f
lea rdx, [0x00028e20]
mov r8d, 8
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe__strnicmp]
cmp eax, r15d
je 0x1a82e
movzx eax, word [rbx + 6]
inc r13d
add rdi, 0x28
cmp r13d, eax
jb 0x1a7ca
jmp 0x1a838
mov esi, dword [rdi + 0xc]
mov r14d, dword [rdi + 0x10]
add rsi, rbp
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, r15b
je 0x1a89f
cmp r14d, r15d
je 0x1a89f
mov r8d, r14d
mov rdx, rsi
mov rcx, r12
call fcn.0001a5f8
mov rcx, qword [r12 + 8]
cmp rcx, r15
je 0x1a8a4
cmp eax, r15d
jne 0x1a8a4
cmp byte [r12 + 0x11], r15b
je 0x1a87f
lea r8, [0x0002818d]
lea rdx, [0x00019e58]
jmp 0x1a88d
lea r8, [0x00028174]
lea rdx, [0x00019dd0]
call fcn.00014db0
cmp eax, r15d
jl 0x1a8a4
mov byte [r12 + 0x10], 1
jmp 0x1a8a4
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1aa18
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbp, rcx
xor edi, edi
mov rcx, r8
mov r14, r9
mov rsi, r8
mov r15, rdx
mov bl, dil
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, dil
je 0x1ab85
mov rcx, qword [rsi + 8]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, dil
je 0x1ab85
cmp word [rsi], di
je 0x1ab85
movzx r11d, word [rsi]
mov rcx, qword [rsi + 8]
mov edx, r11d
call fcn.000143a8
cmp rax, rdi
je 0x1ab85
mov r8d, dword [rsi + 8]
sub r8d, eax
add r8d, r11d
je 0x1ab85
lea rcx, [0x0002a590]
mov rdx, rax
call fcn.000140f0
mov r12d, eax
cmp eax, edi
je 0x1ab85
lea rcx, [rbp + 0xc28]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea rcx, [rbp + 0xe00]
mov dl, al
cmp dword [rcx - 0x10], 0
je 0x1aadc
cmp dword [rcx], 0
je 0x1aadc
cmp dword [rcx], r12d
je 0x1aae9
inc edi
add rcx, 0x18
cmp edi, 0xf
jae 0x1aafb
jmp 0x1aacc
mov eax, edi
lea rax, [rax + rax*2 + 0x1bf]
cmp qword [rbp + rax*8], r15
setne bl
lea rcx, [rbp + 0xc28]
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
xor r12d, r12d
cmp bl, r12b
je 0x1ab85
cmp edi, r12d
jbe 0x1ab81
lea eax, [r12 + 2]
cmp edi, eax
jbe 0x1ab55
cmp edi, 4
je 0x1ab39
cmp edi, 7
jne 0x1ab81
cmp word [rsp + 0x70], ax
jne 0x1ab50
mov rcx, r14
call fcn.00015710
jmp 0x1ab50
cmp word [rsi], 0x3e
jne 0x1ab50
cmp word [rsp + 0x70], r12w
je 0x1ab81
cmp dword [rbp + 0xfbc], r12d
jne 0x1ab81
mov bl, r12b
jmp 0x1ab81
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_PsGetThreadProcess]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsGetProcessImageFileName]
lea rdx, [0x00028e30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_strstr]
movzx ebx, bl
cmp rax, r12
cmovne ebx, r12d
mov al, bl
jmp 0x1ab87
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1ae90
Capabilities:
Create device object

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov r9d, dword [rdx + 0x48]
mov rcx, qword [rcx + 0xc00]
and qword [r11 + 8], 0
mov rbp, r8
xor r8d, r8d
lea rax, [r11 + 8]
mov qword [r11 - 0x28], rax
mov rdi, rdx
lea edx, [r8 + 8]
mov byte [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
js 0x1af72
test byte [rdi + 0x30], 4
mov rcx, qword [rsp + 0x60]
mov r12, qword [rcx + 0x40]
je 0x1aef8
or dword [rcx + 0x30], 4
mov rcx, qword [rsp + 0x60]
test byte [rdi + 0x30], 0x10
je 0x1af07
or dword [rcx + 0x30], 0x10
mov rcx, qword [rsp + 0x60]
bt dword [rdi + 0x34], 8
jae 0x1af18
bts dword [rcx + 0x34], 8
mov rcx, qword [rsp + 0x60]
xor ebx, ebx
mov r8, r12
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStackSafe]
mov esi, eax
test eax, eax
jns 0x1af58
lea r8, [rsp + 0x68]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x68], 0xfffffffffe363c80
call qword [sym.imp.ntoskrnl.exe_KeDelayExecutionThread]
mov rcx, qword [rsp + 0x60]
inc ebx
cmp ebx, 8
jb 0x1af1a
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x1af70
mov rax, qword [rsp + 0x60]
btr dword [rax + 0x30], 7
test rbp, rbp
je 0x1af70
mov rax, qword [rsp + 0x60]
mov qword [rbp], rax
mov eax, esi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x1c6ec
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov r12, qword [0x00065e80]
movzx ecx, dx
sub ecx, 2
je 0x1c79c
mov ebp, 1
cmp ecx, ebp
jne 0x1c808
xor eax, eax
cmp dword [r12 + 0xfbc], eax
jne 0x1c808
lea rcx, [r12 + 0xc30]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
or rcx, 0xffffffffffffffff
mov dword [r12 + 0xe50], ebp
mov bl, al
xor eax, eax
lea rdi, [0x00028ea0]
repne scasw ax, word [rdi]
lea rdx, [0x00028ea0]
not rcx
sub rcx, rbp
lea r8d, [rcx + rcx]
lea rcx, [0x0002a590]
call fcn.000140f0
lea rcx, [r12 + 0xc30]
mov dl, bl
mov dword [r12 + 0xe60], eax
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
xchg dword [r12 + 0xfbc], ebp
jmp 0x1c808
xor eax, eax
lea rcx, [r12 + 0xc30]
xchg dword [r12 + 0xfbc], eax
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
or rcx, 0xffffffffffffffff
mov bl, al
mov ebp, 1
xor eax, eax
mov dword [r12 + 0xe50], ebp
lea rdi, [0x00028ea0]
lea rdx, [0x00028ea0]
repne scasw ax, word [rdi]
not rcx
sub rcx, rbp
lea r8d, [rcx + rcx]
lea rcx, [0x0002a590]
call fcn.000140f0
lea rcx, [r12 + 0xc30]
mov dl, bl
mov dword [r12 + 0xe60], eax
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop r12
ret
Function at 0x1d0c4
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x2a0
mov rax, qword [0x0002c100]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor ebx, ebx
xor bpl, bpl
xor edi, edi
and dword [rsp + 0x30], ebx
and qword [rsp + 0x38], rbx
mov r13, rdx
mov r14, rcx
test rdx, rdx
je 0x1d301
lea rdx, [0x00028eb0]
lea rcx, [rsp + 0x70]
call qword [fcn.004e696c]
and qword [rsp + 0x48], rbx
and qword [rsp + 0x60], rbx
and qword [rsp + 0x68], rbx
lea rax, [rsp + 0x70]
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x38]
mov edx, 0x1f0000
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x30
mov dword [rsp + 0x58], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov r12d, 0x456e6d52
test eax, eax
js 0x1d2cf
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea esi, [rbx + 2]
mov edx, esi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
cmp eax, 0xc0000023
jne 0x1d2cf
mov edx, dword [rsp + 0x30]
mov r8d, r12d
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x1d2cf
mov r9d, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov r8, rdi
mov edx, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
test eax, eax
js 0x1d2cf
xor esi, esi
cmp dword [rdi + 0x14], ebx
jbe 0x1d2cf
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor r8d, r8d
mov edx, esi
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, 0xc0000023
jne 0x1d2ac
mov edx, dword [rsp + 0x30]
mov r8d, r12d
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x1d2c4
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
xor r8d, r8d
mov edx, esi
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
test eax, eax
js 0x1d2ac
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x208
call fcn.00028240
mov r8d, dword [rbx + 0xc]
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x80]
call fcn.000283d0
lea rdx, [rsp + 0x80]
mov rcx, r14
call fcn.0001cdd8
test al, al
je 0x1d2a6
mov r8d, dword [rbx + 0xc]
lea rdx, [rbx + 0x10]
mov rcx, r13
call fcn.000283d0
mov bpl, 1
mov r12d, 0x456e6d52
test rbx, rbx
je 0x1d2bf
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor ebx, ebx
test bpl, bpl
jne 0x1d2cf
inc esi
cmp esi, dword [rdi + 0x14]
jb 0x1d1e4
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1d2df
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test rdi, rdi
je 0x1d2f0
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test rbx, rbx
je 0x1d301
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, bpl
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.000281c0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1d338
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0x330
mov rax, qword [0x0002c100]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov rsi, rdx
lea rcx, [r11 - 0x228]
lea rdx, [0x00028eb0]
mov r8d, 0x20
mov ebx, 0xc0000001
call fcn.000283d0
lea rcx, [rsp + 0x130]
xor edx, edx
mov r8d, 0x1e8
call fcn.00028240
lea rcx, [rsp + 0x90]
lea rdx, [0x00028f00]
mov r8d, 0x7a
call fcn.000283d0
and qword [rsp + 0x30], 0
test rsi, rsi
je 0x1d4df
xor eax, eax
or r12, 0xffffffffffffffff
lea rdi, [rsp + 0x110]
mov rcx, r12
repne scasw ax, word [rdi]
not rcx
lea rdx, [rsp + rcx*2 + 0x10e]
mov rcx, qword [0x00065e88]
call fcn.0001d0c4
test al, al
je 0x1d4df
xor eax, eax
lea rdi, [rsp + 0x90]
mov rcx, r12
repne scasw ax, word [rdi]
lea rdi, [rsp + 0x110]
lea rdx, [rsp + 0x90]
not rcx
lea r8, [rcx - 1]
mov rcx, r12
repne scasw ax, word [rdi]
add r8, r8
not rcx
lea rcx, [rsp + rcx*2 + 0x10e]
call fcn.000283d0
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x78]
call qword [fcn.004e696c]
and qword [rsp + 0x40], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov edx, 0xf003f
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], 0x30
mov dword [rsp + 0x50], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov ebx, eax
test eax, eax
js 0x1d4df
lea rdx, [0x00028f80]
lea rcx, [rsp + 0x68]
call qword [fcn.004e696c]
xor eax, eax
mov rcx, r12
mov rdi, rsi
lea r9d, [r12 + 2]
lea rdx, [rsp + 0x68]
repne scasw ax, word [rdi]
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.000281c0
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x1d684
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r15, qword [0x00065e88]
xor r12d, r12d
mov rbp, r9
mov rsi, r8
mov r14d, edx
mov ebx, r12d
mov dword [r11 - 0x38], r12d
mov dword [rsp + 0x24], r12d
mov rax, cr8
cmp al, r12b
jne 0x1d8a7
cmp r8, r12
je 0x1d8a7
lea r9, [r11 - 0x38]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ObQueryNameString]
mov ebx, eax
cmp eax, 0xc0000004
jne 0x1d8a7
mov edi, dword [rsp + 0x20]
cmp edi, r12d
je 0x1d8a7
mov rdx, rdi
xor ecx, ecx
mov r13, rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
xor ecx, ecx
mov r12, rax
cmp rax, rcx
je 0x1d8a7
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.00028240
lea r9, [rsp + 0x20]
mov r8d, edi
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ObQueryNameString]
xor edi, edi
cmp eax, edi
mov ebx, eax
jl 0x1d89c
cmp r14d, 1
jne 0x1d76d
mov r8, rbp
mov rdx, r12
mov rcx, r15
call fcn.0001d514
cmp al, dil
je 0x1d76d
mov ebx, 0xc000017c
jmp 0x1d89c
movzx r11d, word [r12]
mov rcx, qword [r12 + 8]
mov edx, r11d
call fcn.000143a8
cmp rax, rdi
je 0x1d89c
sub r11d, eax
add r11d, dword [r12 + 8]
je 0x1d89c
lea rcx, [0x0002a590]
mov r8d, r11d
mov rdx, rax
call fcn.000140f0
mov esi, eax
cmp eax, edi
je 0x1d89c
cmp rbp, rdi
je 0x1d7db
mov rdx, qword [rbp + 8]
cmp rdx, rdi
je 0x1d7db
cmp word [rbp], di
je 0x1d7db
movzx r8d, word [rbp]
lea rcx, [0x0002a590]
call fcn.000140f0
mov dword [rsp + 0x24], eax
lea rcx, [r15 + 0x270]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
xor r9d, r9d
lea rcx, [r15 + 0x128]
mov edx, r9d
mov r8, r9
mov r13b, al
cmp dword [rcx - 0x10], r9d
je 0x1d80a
cmp dword [rcx], r9d
je 0x1d80a
cmp dword [rcx], esi
je 0x1d81b
inc r8
inc edx
add rcx, 0x18
cmp r8, 7
jge 0x1d88c
jmp 0x1d7fb
mov rcx, qword gs:[0x188]
movsxd rax, edx
lea rax, [rax + rax*2 + 0x24]
cmp qword [r15 + rax*8], rcx
je 0x1d88c
cmp edx, r9d
jne 0x1d83e
mov ebx, 0xc0000383
jmp 0x1d88c
cmp edx, 2
jne 0x1d866
cmp rbp, r9
je 0x1d887
cmp r14d, 1
je 0x1d854
cmp r14d, 0x10
jne 0x1d861
mov eax, dword [rsp + 0x24]
cmp eax, dword [r15 + 0x15c]
je 0x1d887
mov ebx, r9d
jmp 0x1d88c
cmp edx, 3
jne 0x1d887
test byte [0x00065e70], 8
je 0x1d88c
call qword [sym.imp.ntoskrnl.exe_ExGetPreviousMode]
xor ecx, ecx
cmp al, cl
jne 0x1d88c
mov ebx, 0xc000000d
jmp 0x1d88c
mov ebx, 0xc000017c
lea rcx, [r15 + 0x270]
mov dl, r13b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1d8cc
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rsi, qword [0x00065e88]
xor ebx, ebx
mov r11, rdx
cmp rdx, rbx
je 0x1d9e1
mov rcx, qword [rdx + 8]
cmp rcx, rbx
je 0x1d9e1
cmp word [rdx], bx
je 0x1d9e1
movzx edi, word [rdx]
mov edx, edi
call fcn.000143a8
cmp rax, rbx
je 0x1d9e1
mov r8d, dword [r11 + 8]
sub r8d, eax
add r8d, edi
je 0x1d9e1
lea rcx, [0x0002a590]
mov rdx, rax
call fcn.000140f0
mov edi, eax
cmp eax, ebx
je 0x1d9e1
lea rcx, [rsi + 0x270]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov edx, ebx
mov r8, rbx
mov r12b, al
lea rcx, [rsi + 0x128]
cmp dword [rcx - 0x10], ebx
je 0x1d975
cmp dword [rcx], ebx
je 0x1d975
cmp edi, dword [rcx]
je 0x1d986
inc r8
inc edx
add rcx, 0x18
cmp r8, 7
jge 0x1d9d1
jmp 0x1d968
mov rcx, qword gs:[0x188]
movsxd rax, edx
lea rax, [rax + rax*2 + 0x24]
cmp qword [rsi + rax*8], rcx
je 0x1d9d1
cmp edx, ebx
jne 0x1d9a8
mov ebx, 0xc0000383
jmp 0x1d9d1
cmp edx, 2
je 0x1d9d1
cmp edx, 3
jne 0x1d9cc
test byte [0x00065e70], 8
je 0x1d9d1
call qword [sym.imp.ntoskrnl.exe_ExGetPreviousMode]
cmp al, bl
jne 0x1d9d1
mov ebx, 0xc000000d
jmp 0x1d9d1
mov ebx, 0xc000017c
lea rcx, [rsi + 0x270]
mov dl, r12b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret
Function at 0x200b8
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x0002c100]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rsi, qword [0x00065e88]
and dword [rsp + 0x20], 0
mov ecx, 0xc0000082
rdmsr
shl rdx, 0x20
mov r8d, 0x400
or rax, rdx
mov rdx, rax
mov r9, rax
cmp byte [rax + 0x15], 0x6a
je 0x2014b
xor ecx, ecx
xor eax, eax
cmp byte [rax + rdx], 0xe9
jne 0x20119
cmp byte [rax + rdx + 5], 0xc3
je 0x20128
inc ecx
inc rax
cmp ecx, 0x2bc
jae 0x2014b
jmp 0x2010c
mov eax, ecx
lea rcx, [rdx + rcx + 5]
mov r8d, 0x190
mov edx, dword [rdx + rax + 1]
movabs rax, 0xffffffff00000000
add edx, ecx
and rcx, rax
add rdx, rcx
xor ecx, ecx
xor eax, eax
test r8d, r8d
je 0x2018e
cmp byte [rax + rdx], 0x4c
jne 0x2017d
cmp byte [rax + rdx + 1], 0x8d
jne 0x2017d
cmp byte [rax + rdx + 2], 0x15
jne 0x2017d
cmp byte [rax + rdx + 7], 0x4c
jne 0x2017d
cmp byte [rax + rdx + 8], 0x8d
jne 0x2017d
cmp byte [rax + rdx + 9], 0x1d
je 0x20189
inc ecx
inc rax
cmp ecx, r8d
jae 0x2018e
jmp 0x20154
mov eax, ecx
add rdx, rax
cmp r9, rdx
je 0x201c9
movsxd rbx, dword [rdx + 3]
add rdx, 7
add rbx, rdx
je 0x201c9
lea rdx, [rsp + 0x20]
lea rcx, [0x000293a0]
call fcn.00017524
test al, al
je 0x201c9
mov rcx, qword [rbx]
mov eax, dword [rsp + 0x20]
movsxd rbx, dword [rcx + rax*4]
sar rbx, 4
add rbx, rcx
jmp 0x201cb
xor ebx, ebx
test rbx, rbx
je 0x202ab
lea rcx, [rsp + 0x34]
xor edx, edx
mov r8d, 0x110
mov dword [rsp + 0x30], 0x114
call fcn.00028240
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
cmp dword [rsp + 0x34], 6
jne 0x20237
lea r8, [0x000293b0]
mov r9d, 0xb
mov edx, 0x100
mov rcx, rbx
call fcn.00017238
test rax, rax
je 0x202ab
movsxd rcx, dword [rax + 0xb]
lea rax, [rcx + rax + 0xf]
mov qword [rsi + 0x2a8], rax
xor eax, eax
jmp 0x202b0
cmp dword [rsp + 0x34], 0xa
jne 0x202ab
mov edi, 0x100
lea r8, [0x000293c0]
mov r9d, 9
mov rdx, rdi
mov rcx, rbx
call fcn.00017238
test rax, rax
je 0x2026b
movsxd rcx, dword [rax + 9]
lea rax, [rcx + rax + 0xe]
jmp 0x2022c
lea r8, [0x000293d0]
mov r9d, 0xa
mov rdx, rdi
mov rcx, rbx
call fcn.00017238
test rax, rax
je 0x2028e
movsxd rcx, dword [rax + 0xa]
jmp 0x20264
lea r8, [0x000293e0]
mov r9d, 0xa
mov rdx, rdi
mov rcx, rbx
call fcn.00017238
test rax, rax
jne 0x20288
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.000281c0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret