joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140075c24
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x140179d80]
test rcx, rcx
jne 0x140075b73
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x60]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x140075b6c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140075b9e
and qword [rax], 0
and qword [rax + 8], 0
xor eax, eax
lock cmpxchg qword [rbx + 0x40], rdi
je 0x140075b68
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx + 0x40]
mov qword [0x140179d80], rcx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x140075c11
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x140075bc1
xor edx, edx
lea r9, [rsp + 0x30]
mov ecx, 0xc0000017
lea r8d, [rdx + 1]
mov qword [rsp + 0x30], 0x20
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [rax]
mov rcx, qword [0x140179d80]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x140075bee
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x140075c11
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x140179d80]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x140075bf5
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jmp 0x140075af8

Function at 0x140077e58
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140077cc0
Function at 0x140078767
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1401786a0]
jne 0x1400762ea
rol rcx, 0x10
test cx, 0xffff
jne 0x1400762e6
repz ret
ror rcx, 0x10
jmp 0x1400786c0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14017a2b0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14017a3a8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140078745
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14017a2b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140078767
mov rax, qword [rsp + 0x88]
mov qword [0x14017a3a8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14017a348], rax
mov rax, qword [0x14017a3a8]
mov qword [0x14017a220], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14017a330], rax
mov dword [0x14017a210], 0xc0000409
mov dword [0x14017a214], 1
mov rax, qword [0x1401786a0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1401786a8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14017a2a8], eax
mov ecx, 1
call fcn.140084314
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14009ae60]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14017a2a8], 0
jne 0x1400787ee
mov ecx, 1
call fcn.140084314
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140084034
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14007afa8
xor ebx, ebx
mov rdi, rax
cmp qword [0x14017acd8], rbx
jne 0x14008413a
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14008420f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14008420f
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x14009bd98]
mov rcx, rsi
mov qword [0x14017acd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14017ace0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14017ace8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14017acf8], rax
test rax, rax
je 0x140084131
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14017acf0], rax
jmp 0x140084141
mov rax, qword [0x14017acf0]
jmp 0x140084148
mov rax, qword [0x14017acf0]
mov r11, qword [0x14017acf8]
cmp rax, rdi
je 0x1400841b0
cmp r11, rdi
je 0x1400841b0
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14017acf8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1400841b0
test rax, rax
je 0x1400841b0
call rsi
test rax, rax
je 0x1400841aa
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400841aa
test byte [rsp + 0x38], 1
jne 0x1400841b0
bts ebp, 0x15
jmp 0x1400841ee
mov rcx, qword [0x14017ace0]
cmp rcx, rdi
je 0x1400841ee
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400841ee
call rax
mov rbx, rax
test rax, rax
je 0x1400841ee
mov rcx, qword [0x14017ace8]
cmp rcx, rdi
je 0x1400841ee
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400841ee
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14017acd8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14008420f
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140084211
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14000b570
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x1400360d0]
test rax, rax
je 0x14000b5ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000b5ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000b5ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000b5ba
cmp dword [rcx + 0x84], 0xe
jbe 0x14000b5ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000b5bc
xor al, al
add rsp, 0x28
ret

Function at 0x14001af50
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001ad40
Function at 0x140031720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
xor ebx, ebx
mov r13, rdx
mov rbp, rcx
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r14d, dword [rdi + 0x1c]
mov r15d, dword [rdi + 0x20]
add r14, rcx
mov r12d, dword [rdi + 0x24]
add r15, rcx
add r12, rcx
cmp dword [rdi + 0x18], ebx
jbe 0x140031797
nop dword [rax]
movzx eax, word [r12 + rbx*2]
mov rdx, r13
mov ecx, dword [r15 + rbx*4]
add rcx, rbp
mov esi, dword [r14 + rax*4]
add rsi, rbp
call qword [section..rdata]
test eax, eax
je 0x1400317b6
inc ebx
cmp ebx, dword [rdi + 0x18]
jb 0x140031770
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rsi
jmp 0x140031799
Function at 0x1400319d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x58
mov rbx, qword [0x1400a3cc0]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x38]
mov dword [rbp - 0x38], 0xb0004
mov dword [rbp - 0x34], 0x6001f
mov dword [rbp - 0x30], 0x5b0006
mov dword [rbp - 0x2c], 0x46004b
mov dword [rbp - 0x28], 0x2a0032
mov dword [rbp - 0x24], 0x4d0022
call fcn.140009000
mov rcx, qword [rax]
call rbx
mov rcx, qword [rbp - 0x20]
mov qword [0x1400a3cb0], rax
test rcx, rcx
je 0x140031a64
mov rdx, qword [rbp - 0x10]
mov rax, rcx
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x1000
jb 0x140031a5f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031bfc
call fcn.14000aaa8
movdqa xmm0, xmmword [0x140044dc0]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x38]
mov word [rbp - 0x28], 0x501
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x26], 0x75
call fcn.140009190
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140031ac2
mov rdx, qword [rbp - 0x10]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140031abd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c02
call fcn.14000aaa8
mov qword [rsp + 0x78], rsi
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x80], rdi
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x50], r15
mov dword [rbp - 0x38], 0x61f0b04
mov dword [rbp - 0x34], 0xd012d06
mov dword [rbp - 0x30], 0x283a3335
mov word [rbp - 0x2c], 0x7923
call fcn.140008f30
mov r11, qword [0x1400a3cb0]
mov rdi, qword [rax]
test r11, r11
je 0x140031b96
test rdi, rdi
je 0x140031b96
movsxd rax, dword [r11 + 0x3c]
xor ebx, ebx
mov r9d, ebx
mov ecx, dword [rax + r11 + 0x88]
add rcx, r11
mov r14d, dword [rcx + 0x1c]
mov r10d, dword [rcx + 0x20]
add r14, r11
mov r15d, dword [rcx + 0x24]
add r10, r11
mov esi, dword [rcx + 0x18]
add r15, r11
test esi, esi
je 0x140031b98
nop dword [rax]
mov eax, dword [r10]
mov r8, rdi
add rax, r11
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140031b73
inc rax
test ecx, ecx
jne 0x140031b60
test edx, edx
je 0x140031b85
inc r9d
add r10, 4
cmp r9d, esi
jb 0x140031b50
jmp 0x140031b98
mov eax, r9d
movzx ecx, word [r15 + rax*2]
mov ebx, dword [r14 + rcx*4]
add rbx, r11
jmp 0x140031b98
xor ebx, ebx
mov rcx, qword [rbp - 0x20]
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov qword [0x1400a3c98], rbx
test rcx, rcx
je 0x140031bef
mov rdx, qword [rbp - 0x10]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140031bea
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031bf6
call fcn.14000aaa8
add rsp, 0x58
pop rbx
pop rbp
ret
call fcn.140011770
int3
call fcn.140011770
int3
call fcn.140011770
int3
Function at 0x140033de0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov eax, 0x4e
mov dword [rbp - 0x34], 0x26001c
lea rdx, [rbp - 0x18]
mov word [rbp - 0x20], ax
lea rcx, [rbp - 0x34]
mov dword [rbp - 0x30], 0x240028
mov dword [rbp - 0x2c], 0x24002f
mov dword [rbp - 0x28], 0x29003b
mov dword [rbp - 0x24], 0x30005
call fcn.140009590
mov rsi, qword [rax]
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140033e6d
nop dword [rax]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
call fcn.14000bc28
test rax, rax
jne 0x140033f61
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140033e50
xor eax, eax
mov rcx, qword [rbp - 0x18]
mov qword [0x1400a3cb8], rax
test rcx, rcx
je 0x140033eb6
mov rdx, qword [rbp - 8]
mov rax, rcx
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x1000
jb 0x140033eb1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033f70
call fcn.14000aaa8
lea rdx, [rbp - 0x18]
mov dword [rbp - 0x40], 0x170039
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x3c], 0x6001e
mov dword [rbp - 0x38], 0x680006
call fcn.1400094d0
mov rsi, qword [rax]
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140033f0d
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
call fcn.14000bc28
test rax, rax
jne 0x140033f0d
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140033ef4
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140033f49
mov rdx, qword [rbp - 8]
mov rax, rcx
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x1000
jb 0x140033f44
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033f6a
call fcn.14000aaa8
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret
mov rax, qword [rbx + 0x20]
jmp 0x140033e6f
call fcn.140011770
int3
call fcn.140011770
int3
Function at 0x14000e478
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rdx + 0x30], r8d
mov rbx, rdx
test r8d, r8d
mov rsi, rcx
mov edi, r8d
cmove eax, r9d
mov rcx, rbx
mov qword [rdx + 0x38], rax
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
cmp byte [rsp + 0x50], 0
jne 0x14000e4c4
mov rcx, qword [rsi + 0x308]
mov r8, rbx
mov edx, edi
call fcn.14000fc9c
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140018cac
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and dword [rax + 0x20], 0
mov rbp, rcx
lea rcx, [rax - 0x18]
mov rsi, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r9d, r9d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
and dword [rsp + 0x20], 0
mov rcx, rbp
lea r8d, [r9 + 2]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
cmp eax, 0x80000005
je 0x140018d08
cmp eax, 0xc0000023
jne 0x140018d6b
mov edx, dword [rsp + 0x68]
xor ecx, ecx
mov r8d, 0x62696c52
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x140018d66
mov ecx, dword [rsp + 0x68]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], ecx
mov r9, rdi
mov rcx, rbp
mov r8d, 2
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
test eax, eax
js 0x140018d56
mov qword [rsi], rdi
jmp 0x140018d6b
lfence
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140018d6b
mov ebx, 0xc000009a
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14001ba8c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov ebp, dword [rcx + 0x44]
mov rdi, rcx
mov r9d, dword [rcx + 0x9c]
mov edx, dword [rdi + 0x94]
mov esi, dword [rdi + 0x58]
mov ecx, dword [rdi + 0x44]
sub esi, edx
add ecx, 0xfffffefa
sub esi, r9d
add ecx, ebp
cmp edx, ecx
jb 0x14001bb49
mov rcx, qword [rdi + 0x50]
mov r8, rbp
lea rdx, [rcx + rbp]
call fcn.14001e840
mov r9d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebp
sub dword [rdi + 0x94], ebp
sub dword [rdi + 0x84], ebp
lea r8, [rax + r9*2]
xor eax, eax
lea r8, [r8 - 2]
movzx edx, word [r8]
movzx ecx, dx
sub cx, bp
cmp edx, ebp
cmovae ax, cx
mov word [r8], ax
add r9d, 0xffffffff
jne 0x14001bafc
mov rax, qword [rdi + 0x60]
mov r9d, ebp
lea r8, [rax + rbp*2]
xor eax, eax
lea r8, [r8 - 2]
movzx edx, word [r8]
movzx ecx, dx
sub cx, bp
cmp edx, ebp
cmovae ax, cx
mov word [r8], ax
add r9d, 0xffffffff
jne 0x14001bb27
add esi, ebp
mov r14, qword [rdi]
mov ecx, dword [r14 + 8]
test ecx, ecx
je 0x14001bc09
mov edx, dword [rdi + 0x9c]
mov r15d, dword [rdi + 0x94]
add r15, rdx
add r15, qword [rdi + 0x50]
cmp ecx, esi
cmovbe esi, ecx
test esi, esi
je 0x14001bbb5
mov rax, qword [r14 + 0x28]
sub ecx, esi
mov dword [r14 + 8], ecx
cmp dword [rax + 0x2c], 1
jne 0x14001bb98
mov rdx, qword [r14]
mov r8d, esi
mov ecx, dword [r14 + 0x4c]
call fcn.14001bf24
mov dword [r14 + 0x4c], eax
mov rdx, qword [r14]
mov rcx, r15
mov r8d, esi
mov ebx, esi
call fcn.14001e840
add qword [r14], rbx
add dword [r14 + 0xc], esi
mov edx, dword [rdi + 0x9c]
lea r9d, [rdx + rsi]
mov dword [rdi + 0x9c], r9d
cmp r9d, 3
jb 0x14001bbf3
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x14001bc09
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x14001bab1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14002c790
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x40]
mov rsi, rdx
mov rbp, rcx
mov rdx, qword [rdi + 0xc0]
test rdx, rdx
je 0x14002c7ce
lea rcx, [0x140029688]
call fcn.140006ec8
and qword [rdi + 0xc0], 0
mov rcx, qword [rdi + 0x18]
mov rdx, rsi
call fcn.140018128
mov rcx, qword [rdi + 0x18]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_IoDetachDevice]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
xor edx, edx
mov dword [rsi + 0x30], ebx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14002c840
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r14, qword [rdx + 0xb8]
mov rbp, rdx
mov rbx, qword [rcx + 0x40]
mov rdi, rcx
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
and qword [rsp + 0x20], 0
lea rcx, [rbx + 0x58]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
xor r15b, r15b
cmp byte [r14 + 8], r15b
jne 0x14002c8ae
cmp dword [rbx + 0x70], 1
jne 0x14002c8ae
mov eax, dword [rdi + 0x30]
bt eax, 0xe
jb 0x14002c8ae
bts eax, 0xd
mov r15b, 1
mov dword [rdi + 0x30], eax
mov rcx, qword [rbx + 0x18]
mov rdx, rbp
call fcn.140018128
mov esi, eax
test eax, eax
js 0x14002c8de
cmp byte [r14 + 8], 0
je 0x14002c8cd
lock inc dword [rbx + 0x70]
jmp 0x14002c8d1
lock dec dword [rbx + 0x70]
cmp byte [r14 + 8], 0
je 0x14002c8e9
cmp dword [rbx + 0x70], 1
jmp 0x14002c8e2
cmp r15b, 1
jne 0x14002c8e9
btr dword [rdi + 0x30], 0xd
xor r8d, r8d
lea rcx, [rbx + 0x58]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
xor edx, edx
mov dword [rbp + 0x30], esi
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x14002d42c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400291e0]
xor rax, rsp
mov qword [rbp - 0x10], rax
and qword [rsp + 0x28], 0
xor eax, eax
mov qword [rdx], rax
mov rsi, rdx
mov qword [r8], rax
mov rdi, r8
mov rdx, rcx
lea r8, [0x14002ff80]
movabs rax, 0xfffff78000000014
mov r9d, 0x2001f
xor ecx, ecx
mov rax, qword [rax]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
call fcn.140017d18
mov ebx, eax
test eax, eax
js 0x14002d534
lea rdx, [0x14002ffa0]
mov dword [rbp - 0x50], 0x18
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x28]
mov eax, dword [rbp - 0x50]
lea rdx, [rbp - 0x38]
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov r9d, 3
test eax, eax
js 0x14002d4fb
cmp dword [rbp - 0x20], 8
jne 0x14002d4fb
cmp dword [rbp - 0x24], r9d
jne 0x14002d4fb
lfence
mov rax, qword [rbp - 0x1c]
mov qword [rsi], rax
mov rcx, qword [rbp - 0x48]
lea rax, [rbp - 0x40]
mov dword [rsp + 0x28], 8
lea rdx, [rbp - 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ebx, eax
test eax, eax
js 0x14002d52a
mov rax, qword [rbp - 0x40]
mov qword [rdi], rax
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140016e70
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400019ac
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov r15, rdx
mov rbx, rcx
lea edx, [r13 + 0x41]
mov r12d, r9d
mov r14d, r8d
lea ecx, [rdx - 1]
mov esi, r13d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x140001ab4
lea ebp, [r13 + 7]
cmp r14d, ebp
jb 0x140001a0e
lea rcx, str.ERROR_kull_m_busylight_request_create___count_u__max_is_7__n
mov edx, r14d
call fcn.14000bce4
cmp r14d, ebp
cmovb ebp, r14d
mov esi, 1
test ebp, ebp
je 0x140001a6b
lea rcx, [r15 + 2]
lea rdx, [rdi + 2]
mov r8d, ebp
mov al, byte [rcx - 2]
test al, 0xf0
movzx eax, al
jne 0x140001a33
or eax, 0x10
mov byte [rdx - 1], al
mov al, byte [rcx - 1]
mov byte [rdx], al
mov al, byte [rcx]
add rdx, 8
mov byte [rdx - 7], al
mov al, byte [rcx + 1]
add rcx, 8
mov byte [rdx - 6], al
mov al, byte [rcx - 6]
mov byte [rdx - 5], al
mov al, byte [rcx - 5]
mov byte [rdx - 4], al
mov al, byte [rcx - 4]
mov byte [rdx - 3], al
mov al, byte [rcx - 3]
mov byte [rdx - 2], al
sub r8, rsi
jne 0x140001a26
mov dword [rdi + 0x39], 0xff550404
mov word [rdi + 0x3d], 0xffff
movzx ecx, r13w
lea rdx, [rdi + 1]
mov r8d, 0x3e
movzx eax, byte [rdx]
add rdx, rsi
add cx, ax
sub r8, rsi
jne 0x140001a86
movzx eax, cx
shr ax, 8
mov byte [rdi + 0x3f], al
movzx eax, cx
and eax, 0x800000ff
jge 0x140001ab1
sub eax, esi
or eax, 0xffffff00
add eax, esi
mov byte [rdi + 0x40], al
test esi, esi
je 0x140001b5b
jmp 0x140001b49
mov ebp, r13d
test rbx, rbx
je 0x140001b2b
mov rcx, qword [rbx + 0x78]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001b2b
movzx r9d, word [rbx + 0x2a]
mov r8d, Ordinal_69
cmp r9d, r8d
jb 0x140001b1a
lea r9, [rsp + 0x30]
mov rdx, rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, eax
test eax, eax
jne 0x140001b3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rbx + 8]
lea rcx, str.ERROR_kull_m_busylight_device_send_raw____device__u__WriteFile__0x_08x__n
mov r8d, eax
call fcn.14000bce4
jmp 0x140001b3a
mov edx, dword [rbx + 8]
lea rcx, str.ERROR_kull_m_busylight_device_send_raw____device__u__Size_is_not_valide__siz___u__max___u__n
call fcn.14000bce4
jmp 0x140001b3a
mov edx, dword [rbx + 8]
lea rcx, str.ERROR_kull_m_busylight_device_send_raw____device__u__Invalid_Device_Busy_Handle_n
call fcn.14000bce4
and esi, ebp
test r12d, r12d
je 0x140001b46
mov rbx, qword [rbx]
jmp 0x140001b49
mov rbx, r13
test rbx, rbx
jne 0x140001ac1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0x40]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140001b7c
Capabilities:
Terminate thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rdi, rcx
mov dword [rax + 8], 0
mov dword [rax + 0xc], 0x80000000
mov rbx, rcx
test rcx, rcx
je 0x140001bda
mov rcx, qword [rbx + 0x98]
and dword [rbx + 0x90], 0
test rcx, rcx
je 0x140001bca
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
and qword [rbx + 0x98], 0
test esi, esi
je 0x140001bd3
mov rbx, qword [rbx]
jmp 0x140001bd5
xor ebx, ebx
test rbx, rbx
jne 0x140001ba7
lea rdx, [rsp + 0x30]
mov r9d, esi
mov r8d, 1
mov rcx, rdi
call fcn.1400019ac
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret