joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12598
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x0001d100]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
or qword [rsp + 0x38], 0xffffffffffffffff
xor eax, eax
xor esi, esi
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x92]
mov r8d, 0x206
xor edx, edx
mov dword [rsp + 0x30], esi
mov word [rsp + 0x40], si
mov qword [rsp + 0x42], rax
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
mov word [rsp + 0x90], si
call fcn.0001a460
cmp rbx, rsi
je 0x126ab
cmp rdi, rsi
je 0x126ab
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x38]
mov edx, 0x20019
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x68], 0x40
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, esi
jl 0x126ab
lea rdx, [0x0001a820]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x30]
mov qword [rsp + 0x28], r11
lea ebp, [rsi + 2]
lea r9, [rsp + 0x80]
lea rdx, [rsp + 0x40]
mov r8d, ebp
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, esi
jge 0x126d3
cmp eax, 0x80000005
je 0x126d3
cmp eax, 0xc0000023
je 0x126d3
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.0001a090
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2b0
pop rdi
pop rsi
pop rbp
ret
mov edx, dword [rsp + 0x30]
mov ecx, 1
mov r8d, 0x50766970
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ecx, dword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rbx, rax
lea rax, [rsp + 0x30]
mov r8d, ebp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x38]
mov r9, rbx
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, esi
jge 0x1273a
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp rbx, rsi
je 0x126ab
mov edx, 0x50766970
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x126ab
cmp dword [rbx + 4], ebp
jne 0x127cd
mov ebp, 0x104
lea r8, [rbx + 0xc]
lea rcx, [rsp + 0x90]
mov rdx, rbp
call fcn.00011008
lea rdx, [0x0001a840]
lea rcx, [rsp + 0x90]
call fcn.00012394
mov rdx, rbp
mov rcx, rdi
cmp eax, esi
je 0x127b5
lea r8, [0x0001a740]
call fcn.00011008
lea r8, [0x0001a870]
mov rdx, rbp
mov rcx, rdi
call fcn.00011080
lea r8, [rsp + 0x90]
mov rdx, rbp
mov rcx, rdi
call fcn.00011080
mov r11d, dword [rbx + 8]
add r11d, 0x1e
jmp 0x127c6
lea r8, [rsp + 0x90]
call fcn.00011008
mov r11d, dword [rbx + 8]
mov dword [0x000dd8e8], r11d
mov edx, 0x50766970
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
jmp 0x126b0
Function at 0x131fc
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
push rdi
sub rsp, 0x60
mov qword [rax + 0x18], 0x1000
lea rax, [rdx - 0x70000000]
mov rbp, rcx
mov rsi, rdx
mov ecx, 0x70000000
cmp rax, 0xfffffff
cmovbe rsi, rcx
mov ecx, dword [0x00100060]
test ecx, ecx
je 0x1331e
call fcn.00102818
test rax, rax
je 0x1328a
mov rdi, qword gs:[0x188]
mov ecx, dword [0x0010005c]
and qword [rsp + 0x28], 0
add rdi, rcx
lea r9, [rsp + 0x30]
xor r8d, r8d
mov bl, byte [rdi]
mov rdx, rsi
mov rcx, rbp
mov byte [rdi], 0
mov qword [rsp + 0x20], 0x30
call rax
mov byte [rdi], bl
jmp 0x1328f
mov eax, 0xc0000225
test eax, eax
js 0x1331e
mov rax, qword [rsp + 0x38]
cmp rsi, rax
mov rsi, rax
jne 0x132ab
lea rsi, [rax - 0x10000]
cmp dword [rsp + 0x50], 0x10000
jne 0x13238
lea r9, [rsp + 0x80]
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x2000
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x13238
lea r9, [rsp + 0x80]
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, rbp
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
js 0x13238
mov rax, qword [rsp + 0x30]
jmp 0x13320
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1333c
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x0001d100]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rax, qword [0x000de758]
and dword [rsp + 0x58], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
test rax, rax
mov rsi, rdx
cmove rax, rdx
lea rdx, [rsp + 0x50]
mov rdi, r8
mov qword [0x000de758], rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x13587
mov rcx, qword [rsp + 0x50]
mov ebx, 0xc0000001
call qword [0x000ddaf8]
test rax, rax
jne 0x1357c
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov r9d, 0x1fffff
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x200
mov byte [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov ebx, eax
test eax, eax
js 0x1357c
mov rax, qword [0x000ffb98]
test rax, rax
je 0x1340f
mov rcx, qword [0x000fffc8]
test rcx, rcx
je 0x1340f
mov rdx, qword [0x000ffda8]
test rdx, rdx
jne 0x13481
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea rdx, [0x0001ab40]
mov rcx, rsi
call fcn.00102008
lea rdx, [0x0001ab60]
mov rcx, rsi
mov qword [0x000ffda8], rax
call fcn.00102008
lea rdx, [0x0001ab70]
mov rcx, rsi
mov qword [0x000ffb98], rax
call fcn.00102008
lea rcx, [rsp + 0x70]
mov qword [0x000fffc8], rax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rax, qword [0x000ffb98]
mov rcx, qword [0x000fffc8]
mov rdx, qword [0x000ffda8]
mov ebx, 0xc0000001
test rax, rax
je 0x13571
test rcx, rcx
je 0x13571
test rdx, rdx
je 0x13571
mov rcx, qword [rsp + 0x48]
mov rdx, rdi
call fcn.00102148
test rax, rax
je 0x13571
mov rcx, qword [0x000fffc8]
and dword [rsp + 0x40], 0
mov edi, 5
sub eax, ecx
mov byte [rsp + 0xa0], 0xe9
mov qword [rsp + 0x60], rdi
sub eax, edi
cmp dword [0x00100064], 0
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0xa1], eax
je 0x13545
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9d, [rdi + 0x3b]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rax
call fcn.00013170
mov ebx, eax
test eax, eax
js 0x13571
mov rdx, qword [0x000fffc8]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
lea r8, [rsp + 0xa0]
mov r9d, edi
mov qword [rsp + 0x20], rax
call fcn.000130e0
cmp dword [0x00100064], 0
jne 0x1354c
mov ebx, 0xc0000225
jmp 0x13571
mov r9d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rax
call fcn.00013170
mov ebx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.0001a090
add rsp, 0xb0
pop rdi
pop rsi
pop rbx
ret
Function at 0x135ac
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x0001d100]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rax, qword [0x000ddf18]
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
test rax, rax
mov rsi, rdx
mov rdi, r8
cmove rax, rdx
lea rdx, [rsp + 0x50]
mov qword [0x000ddf18], rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x137d9
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov r9d, 0x1fffff
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x200
mov byte [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov ebx, eax
test eax, eax
js 0x137ce
mov rax, qword [0x000de128]
mov ebx, 0xc0000001
test rax, rax
je 0x13666
mov rcx, qword [0x000de548]
test rcx, rcx
je 0x13666
mov rdx, qword [0x000de338]
test rdx, rdx
jne 0x136d8
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea rdx, [0x0001ab40]
mov rcx, rsi
call fcn.00102008
lea rdx, [0x0001ab60]
mov rcx, rsi
mov qword [0x000de338], rax
call fcn.00102008
lea rdx, [0x0001ab70]
mov rcx, rsi
mov qword [0x000de128], rax
call fcn.00102008
lea rcx, [rsp + 0x70]
mov qword [0x000de548], rax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rax, qword [0x000de128]
mov rcx, qword [0x000de548]
mov rdx, qword [0x000de338]
test rax, rax
je 0x137c3
test rcx, rcx
je 0x137c3
test rdx, rdx
je 0x137c3
mov rcx, qword [rsp + 0x48]
mov rdx, rdi
call fcn.0010231c
test rax, rax
je 0x137c3
mov rcx, qword [0x000de548]
and dword [rsp + 0x40], 0
mov edi, 5
sub eax, ecx
mov byte [rsp + 0xa0], 0xe9
mov qword [rsp + 0x58], rdi
sub eax, edi
cmp dword [0x00100064], 0
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0xa1], eax
je 0x13797
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9d, [rdi + 0x3b]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.00013170
mov ebx, eax
test eax, eax
js 0x137c3
mov rdx, qword [0x000de548]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x68]
lea r8, [rsp + 0xa0]
mov r9d, edi
mov qword [rsp + 0x20], rax
call fcn.000130e0
cmp dword [0x00100064], 0
jne 0x1379e
mov ebx, 0xc0000225
jmp 0x137c3
mov r9d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.00013170
mov ebx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.0001a090
add rsp, 0xb0
pop rdi
pop rsi
pop rbx
ret
Function at 0x152b0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rdi, rdx
xor r13d, r13d
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
test rax, rax
je 0x15448
cmp rax, 4
je 0x15448
cmp dword [rdi + 8], r13d
jge 0x152ec
xor eax, eax
jmp 0x1544a
mov rsi, qword [rdi + 0x10]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], r13b
and qword [rsp + 0x20], r13
mov r9d, 0xf003f
xor r8d, r8d
mov edx, 0x200
mov rcx, qword [rdi]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
test eax, eax
jns 0x15326
xor eax, eax
jmp 0x1544a
mov edx, dword [rsi + 0x18]
mov ecx, 1
mov r8d, 0x46526c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x15432
mov ecx, dword [rsi + 8]
lea edx, [r13 + rcx]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov ecx, dword [rsi + 0x18]
mov dword [rsp + 0x20], ecx
mov r9, rbx
mov r8d, dword [rsi + 0xc]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov r12d, eax
mov dword [rsp + 0xa8], eax
test eax, eax
js 0x1541d
cmp dword [rsi + 0xc], 0
je 0x153b3
cmp dword [rsi + 0xc], 3
jne 0x1541d
lea rcx, [rbx + 4]
mov qword [rsp + 0x58], rcx
movzx ecx, word [rbx]
mov word [rsp + 0x52], cx
mov word [rsp + 0x50], cx
jmp 0x153ca
lea rax, [rbx + 0x10]
mov qword [rsp + 0x58], rax
movzx eax, word [rbx + 0xc]
mov word [rsp + 0x52], ax
mov word [rsp + 0x50], ax
lea rdx, [rsp + 0x50]
mov rcx, qword [rdi]
call fcn.000150a4
test al, al
jne 0x15415
mov rdx, qword [rsi + 0x20]
mov eax, dword [rsp + 0xa0]
mov dword [rdx], eax
mov r8d, dword [rsp + 0xa0]
mov rdx, rbx
mov rcx, qword [rsi + 0x10]
call fcn.0001a110
jmp 0x1541d
inc r13d
jmp 0x1534b
test rbx, rbx
je 0x15435
mov edx, 0x46526c46
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x15435
xor r12d, r12d
mov dword [rdi + 0x18], r12d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
jmp 0x1544a
xor eax, eax
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x15a6c
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov ebp, r8d
mov rsi, rdx
mov r13d, 0x5000
xor edx, edx
mov r8, r13
mov rdi, rcx
xor ebx, ebx
mov r12, rcx
call fcn.0001a460
test r12, r12
je 0x15bad
test rsi, rsi
je 0x15bad
cmp ebp, 4
jl 0x15b8f
mov r9b, 0x80
lea r10, [0x0001c320]
inc ebx
cmp ebx, r13d
jge 0x15b9f
test byte [rsi], r9b
jne 0x15b93
movsx rax, byte [rsi]
mov cl, byte [rax + r10]
cmp cl, 0xff
je 0x15b93
test byte [rsi + 1], r9b
jne 0x15b93
movsx rax, byte [rsi + 1]
mov r8b, byte [rax + r10]
cmp r8b, 0xff
je 0x15b93
shl cl, 2
mov al, r8b
sar al, 4
and al, 3
or al, cl
mov byte [rdi], al
mov al, byte [rsi + 2]
inc rdi
cmp al, 0x3d
je 0x15ba6
inc ebx
cmp ebx, r13d
jge 0x15b9f
test r9b, al
jne 0x15b93
movsx rax, al
mov dl, byte [rax + r10]
cmp dl, 0xff
je 0x15b93
shl r8b, 4
mov al, dl
sar al, 2
and al, 0xf
or al, r8b
mov byte [rdi], al
mov al, byte [rsi + 3]
inc rdi
cmp al, 0x3d
je 0x15ba6
inc ebx
cmp ebx, r13d
jge 0x15b9f
test r9b, al
jne 0x15b93
movsx rax, al
mov cl, byte [rax + r10]
cmp cl, 0xff
je 0x15b93
and cl, 0x3f
shl dl, 6
sub ebp, 4
or cl, dl
add rsi, 4
mov byte [rdi], cl
inc rdi
cmp ebp, 4
jge 0x15ac7
test ebp, ebp
jle 0x15ba6
mov eax, 0xfffffffe
mov byte [r12], 0
jmp 0x15bb0
mov eax, 0xfffffffd
jmp 0x15b98
mov byte [rdi], 0
mov eax, ebx
jmp 0x15bb0
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x15cc0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
xor r10d, r10d
mov rbx, rdx
mov r11, rcx
mov esi, r10d
cmp r8d, r10d
jbe 0x15d40
mov edi, r8d
mov ebp, 0xff
lea eax, [r10 + 1]
cdq
and edx, ebp
add eax, edx
and eax, ebp
sub eax, edx
movsxd r10, eax
movzx r8d, byte [r10 + r11]
lea eax, [rsi + r8]
cdq
and edx, ebp
add eax, edx
and eax, ebp
sub eax, edx
movsxd rsi, eax
mov cl, byte [rsi + r11]
mov byte [r10 + r11], cl
mov byte [rsi + r11], r8b
movzx eax, byte [r10 + r11]
add eax, r8d
cdq
and edx, ebp
add eax, edx
and eax, ebp
sub eax, edx
movsxd rcx, eax
mov al, byte [rcx + r11]
xor byte [rbx], al
inc rbx
sub rdi, 1
jne 0x15cec
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x15d5c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x0001d100]
xor rax, rsp
mov qword [rsp + 0xa0], rax
or qword [r11 - 0x80], 0xffffffffffffffff
xor eax, eax
xor ebx, ebx
lea rcx, [r11 - 0x50]
lea r8d, [rbx + 0x28]
xor edx, edx
mov word [rsp + 0x40], bx
mov qword [r11 - 0x76], rax
mov word [rsp + 0x50], bx
mov qword [r11 - 0x66], rax
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
mov dword [rsp + 0x5a], eax
mov word [rsp + 0x5e], ax
mov dword [rsp + 0x60], ebx
call fcn.0001a460
lea rdx, [0x0001ad30]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], ebx
lea edi, [rbx + 1]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x0001ad60]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x38]
mov edx, 0xf003f
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x78], 0x40
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
jge 0x15e3c
mov al, dil
jmp 0x15efb
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
mov r8d, 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, ebx
jge 0x15e7e
cmp eax, 0x80000005
je 0x15e7e
cmp eax, 0xc0000023
jne 0x15eee
cmp dword [rsp + 0x94], 4
jne 0x15ee8
mov edx, dword [rsp + 0x30]
mov r8d, 0x706b7670
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
cmp rax, rbx
je 0x15eeb
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov r9, rsi
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, ebx
jl 0x15ed8
cmp dword [rsi + 0xc], ebx
setne dil
mov edx, 0x706b7670
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x15eeb
mov dil, bl
mov bl, dil
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.0001a090
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x177cc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0xb0
or r10, 0xffffffffffffffff
mov rbx, rcx
lea rdi, [0x000de550]
mov qword [rax + 0x10], r10
xor eax, eax
mov rcx, r10
repne scasw ax, word [rdi]
mov edx, 0xc0000001
not rcx
cmp rcx, 1
je 0x178c1
mov rax, cr8
test al, al
je 0x17816
mov edi, edx
jmp 0x17927
lea rdx, [0x000de550]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x88], 0
and qword [rsp + 0xa0], 0
and qword [rsp + 0xa8], 0
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], 1
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0xc8]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rsp + 0x80], 0x30
mov dword [rsp + 0x98], 0x240
mov qword [rsp + 0x90], rax
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov r10, qword [rsp + 0xc8]
mov edx, eax
mov edi, edx
test edx, edx
js 0x17927
test r10, r10
je 0x17919
test rbx, rbx
je 0x17919
mov rax, cr8
test al, al
jne 0x17919
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], 0x5000
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r10
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov r10, qword [rsp + 0xc8]
mov edi, eax
jmp 0x1791e
mov edi, 0xc0000001
mov rcx, r10
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rdi
ret
Function at 0x19e40
Capabilities:
Map section object

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0xc0
or qword [r11 + 8], 0xffffffffffffffff
xor eax, eax
xor edi, edi
mov word [rsp + 0x70], di
mov qword [r11 - 0x56], rax
lea rdx, [0x0001aa60]
lea rcx, [r11 - 0x58]
mov dword [rsp + 0x7a], eax
mov word [rsp + 0x7e], ax
mov qword [r11 + 0x10], rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x70]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x90], 0x30
mov qword [rsp + 0x98], rdi
mov dword [rsp + 0xa8], 0x240
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xb8], rdi
lea ebx, [rdi + 1]
jmp 0x19ec9
mov ecx, 0x32
call fcn.00015f28
mov dword [rsp + 0x68], 0x100
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x90]
lea rcx, [rsp + 0xd0]
mov edx, 0x80100000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
cmp eax, edi
jl 0x19ebf
mov rax, qword [rsp + 0xd0]
xor r9d, r9d
lea r8, [rsp + 0x90]
mov qword [rsp + 0x30], rax
lea rcx, [0x0001d110]
lea edx, [r9 + 5]
mov dword [rsp + 0x28], 0x1000000
mov qword [rsp + 0xa0], rdi
mov dword [rsp + 0x20], 8
call qword [sym.imp.ntoskrnl.exe_ZwCreateSection]
mov rcx, qword [rsp + 0xd0]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp ebx, edi
jl 0x19fdc
mov rcx, qword [0x0001d110]
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x40], 0x100000
mov dword [rsp + 0x38], 2
lea rax, [rsp + 0xd8]
lea r8, [0x001000a0]
mov qword [rsp + 0x30], rax
xor r9d, r9d
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov qword [0x001000a0], rdi
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov rcx, qword [0x0001d110]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
Function at 0x102008
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
xor r9d, r9d
mov rbp, rdx
mov r8, rcx
cmp rcx, r9
jne 0x102036
xor eax, eax
jmp 0x102127
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10202f
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x10202f
mov ecx, 0x20b
cmp word [rax + r8 + 0x18], cx
jne 0x10206c
mov edx, dword [rax + r8 + 0x88]
mov ebx, dword [rax + r8 + 0x8c]
jmp 0x102076
mov edx, dword [rax + r8 + 0x78]
mov ebx, dword [rax + r8 + 0x7c]
add rdx, r8
mov r10d, r9d
mov r13d, dword [rdx + 0x24]
mov r14d, dword [rdx + 0x20]
mov r12d, dword [rdx + 0x1c]
add r13, r8
add r14, r8
add r12, r8
cmp dword [rdx + 0x14], r9d
jbe 0x102124
mov rcx, r9
cmp rbp, 0xffff
ja 0x1020ad
movzx r11d, r10w
jmp 0x1020c7
cmp r10d, dword [rdx + 0x18]
jae 0x10202f
mov eax, r10d
mov ecx, dword [r14 + rax*4]
mov r11w, word [r13 + rax*2]
add rcx, r8
cmp rbp, 0xffff
ja 0x1020de
movzx ecx, r11w
movzx eax, bp
add ecx, dword [rdx + 0x10]
cmp eax, ecx
jmp 0x1020f9
mov rsi, rbp
sub rsi, rcx
movzx eax, byte [rcx]
movzx edi, byte [rcx + rsi]
sub eax, edi
jne 0x1020f6
inc rcx
test edi, edi
jne 0x1020e4
cmp eax, r9d
je 0x102106
inc r10d
cmp r10d, dword [rdx + 0x14]
jb 0x10209b
jmp 0x102124
movzx eax, r11w
mov r9d, dword [r12 + rax*4]
add r9, r8
cmp r9, rdx
jb 0x102124
mov eax, ebx
add rax, rdx
cmp r9, rax
jbe 0x10202f
mov rax, r9
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r14
pop r13
pop r12
ret
Function at 0x103064
Capabilities:
Check os version
Create device object
Create thread

Disassembly:
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.00103008
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp fcn.000114e0