joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1410ba058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1410ba1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1410ba089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410ba06f
add dl, dl
jne 0x1410ba096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410ba0f6
xor eax, eax
add dl, dl
jne 0x1410ba0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410ba1ad
add dl, dl
jne 0x1410ba0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410ba0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410ba0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410ba0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1410ba0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1410ba07e
mov eax, 1
add dl, dl
jne 0x1410ba106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410ba113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410ba0fb
sub eax, ebx
mov ebx, 1
jne 0x1410ba14c
mov ecx, 1
add dl, dl
jne 0x1410ba12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1410ba13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410ba123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410ba07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1410ba168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1410ba175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410ba15d
cmp eax, 0x7d00
jae 0x1410ba19b
cmp eax, 0x500
jb 0x1410ba196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410ba07e
cmp eax, 0x7f
ja 0x1410ba19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410ba07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1410ba1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1410ba07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x17754
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rsi
push rdi
push r12
sub rsp, 0x70
mov rsi, rcx
xor edi, edi
mov qword [rax - 0x50], rdi
and dword [rax + 0x10], edi
mov dword [rax - 0x48], 0x30
and qword [rax - 0x40], rdi
mov dword [rax - 0x30], 0x240
mov qword [rax - 0x38], rcx
and qword [rax - 0x28], rdi
and qword [rax - 0x20], rdi
lea r8, [rax - 0x48]
mov edx, 0xf003f
lea rcx, [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x177c3
mov r9d, eax
mov r8, rsi
lea rdx, [0x0001a380]
xor ecx, ecx
call fcn.0001923c
jmp 0x17923
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x17820
cmp eax, 0xc0000023
je 0x17820
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov r9d, ebx
mov r8, rsi
lea rdx, [0x0001a3c0]
xor ecx, ecx
call fcn.0001923c
jmp 0x17923
mov r12d, dword [rsp + 0x98]
mov rdx, r12
mov ecx, 1
mov r8d, 0x62525249
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1785f
mov r8, rsi
lea rdx, [0x0001a400]
xor ecx, ecx
call fcn.0001923c
jmp 0x17923
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, r12d
mov r8, rdi
mov edx, 2
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x178b3
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov r9d, ebx
mov r8, rsi
lea rdx, [0x0001a450]
xor ecx, ecx
call fcn.0001923c
jmp 0x17923
mov edx, dword [rdi + 0x20]
test edx, edx
je 0x178e1
mov rcx, qword [rsp + 0xa0]
call fcn.00017c40
mov ebx, eax
mov dword [rsp + 0x30], eax
mov r9d, eax
mov r8, rsi
lea rdx, [0x0001a490]
xor ecx, ecx
call fcn.0001923c
mov r8d, dword [rdi + 0x14]
test r8d, r8d
je 0x17914
mov rdx, rsi
mov rcx, qword [rsp + 0xa0]
call fcn.00017950
mov ebx, eax
mov dword [rsp + 0x30], eax
mov r9d, eax
mov r8, rsi
lea rdx, [0x0001a4d0]
xor ecx, ecx
call fcn.0001923c
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
nop
test rdi, rdi
je 0x17936
mov edx, 0x62525249
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop r12
pop rdi
pop rsi
ret
Function at 0x17c40
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x40
xor edi, edi
mov ebp, edx
mov r13, rcx
mov ebx, 0xc0000001
test edx, edx
je 0x17d77
xor r9d, r9d
lea rax, [rsp + 0x68]
mov edx, edi
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8d, [r9 + 1]
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
mov ebx, eax
test eax, eax
jns 0x17cb0
cmp eax, 0xc0000023
je 0x17cb0
mov r8d, eax
lea rdx, [0x0001a6d0]
xor ecx, ecx
call fcn.0001923c
jmp 0x17d6d
mov r12d, dword [rsp + 0x68]
mov ecx, 1
mov r8d, 0x62525249
mov rdx, r12
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
jne 0x17cdd
mov r8d, ebx
lea rdx, [0x0001a720]
jmp 0x17ca4
lea rax, [rsp + 0x68]
mov r9, rsi
mov r8d, 1
mov qword [rsp + 0x28], rax
mov edx, edi
mov rcx, r13
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
mov ebx, eax
test eax, eax
jns 0x17d20
mov edx, 0x62525249
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r8d, ebx
lea rdx, [0x0001a770]
jmp 0x17ca4
movzx eax, word [rsi + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, r13
mov word [rsp + 0x32], ax
mov word [rsp + 0x30], ax
lea rax, [rsi + 0x14]
mov qword [rsp + 0x38], rax
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
lea r8, [rsp + 0x30]
lea rdx, [0x0001a7c0]
xor ecx, ecx
mov r9d, eax
mov ebx, eax
call fcn.0001923c
mov edx, 0x62525249
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
dec edi
inc edi
cmp edi, ebp
jb 0x17c6c
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x17ef4
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x2a0
mov rax, qword [0x00013100]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rsi, rdx
mov rdi, rcx
mov ebx, 0xc0000001
xor r12d, r12d
mov word [rsp + 0x80], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x82]
call fcn.00011320
nop
cmp rdi, r12
je 0x1809a
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, r12b
je 0x1809a
add rdi, 8
cmp rdi, r12
je 0x1809a
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, r12b
je 0x1809a
mov word [rsp + 0x30], r12w
mov eax, 0x208
mov word [rsp + 0x32], ax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rdx, rsi
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [0x0001a5f0]
lea rcx, [rsp + 0x30]
call fcn.00011008
mov ebx, eax
cmp eax, r12d
jge 0x17fdb
mov r9d, eax
lea r8, [rsp + 0x30]
lea rdx, [0x0001a8e0]
xor ecx, ecx
call fcn.0001923c
jmp 0x1809a
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.00011008
mov ebx, eax
cmp eax, r12d
jge 0x1800e
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [rsp + 0x30]
lea rdx, [0x0001a930]
xor ecx, ecx
call fcn.0001923c
jmp 0x1809a
mov dword [rsp + 0x48], 0x30
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x60], 0x240
lea rax, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
lea r8, [rsp + 0x48]
mov edx, 0xf003f
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov ebx, eax
cmp eax, r12d
jge 0x1806b
mov r9d, eax
lea r8, [rsp + 0x30]
lea rdx, [0x0001a980]
xor ecx, ecx
call fcn.0001923c
jmp 0x1809a
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov ebx, eax
mov r9d, eax
lea r8, [rsp + 0x30]
lea rdx, [0x0001a9c0]
xor ecx, ecx
call fcn.0001923c
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
nop
mov eax, ebx
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.00011290
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2a0
pop r12
pop rdi
pop rsi
ret
Function at 0x180c8
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x2b0
mov rax, qword [0x00013100]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r12, rdx
mov rsi, rcx
mov ebx, 0xc0000001
xor r13d, r13d
mov word [r11 - 0x238], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [r11 - 0x236]
call fcn.00011320
nop
cmp rsi, r13
je 0x182b1
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, r13b
je 0x182b1
lea rdi, [rsi + 8]
cmp rdi, r13
je 0x182b1
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, r13b
je 0x182b1
add rsi, 0x80c
cmp rsi, r13
je 0x182b1
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, r13b
je 0x182b1
mov word [rsp + 0x30], r13w
mov eax, 0x208
mov word [rsp + 0x32], ax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov rdx, r12
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [0x0001a5f0]
lea rcx, [rsp + 0x30]
call fcn.00011008
mov ebx, eax
cmp eax, r13d
jge 0x181d6
mov r9d, eax
lea r8, [rsp + 0x30]
lea rdx, [0x0001aa00]
xor ecx, ecx
call fcn.0001923c
jmp 0x182b1
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.00011008
mov ebx, eax
cmp eax, r13d
jge 0x18209
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [rsp + 0x30]
lea rdx, [0x0001aa50]
xor ecx, ecx
call fcn.0001923c
jmp 0x182b1
mov rdx, rsi
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x58], 0x30
mov qword [rsp + 0x60], r13
mov dword [rsp + 0x70], 0x240
lea rax, [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x80], r13
lea r8, [rsp + 0x58]
mov edx, 0xf003f
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov ebx, eax
cmp eax, r13d
jge 0x18277
mov r9d, eax
lea r8, [rsp + 0x30]
lea rdx, [0x0001aaa0]
xor ecx, ecx
call fcn.0001923c
jmp 0x182b1
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov ebx, eax
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x30]
lea rdx, [0x0001aae0]
xor ecx, ecx
call fcn.0001923c
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
nop
mov eax, ebx
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.00011290
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x182e4
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov rax, qword [0x00013100]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r15, rdx
mov rdi, rcx
mov ebx, 0xc0000001
xor r14d, r14d
mov word [r11 - 0x248], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [r11 - 0x246]
call fcn.00011320
nop
cmp rdi, r14
je 0x18538
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, r14b
je 0x18538
lea rsi, [rdi + 8]
cmp rsi, r14
je 0x18538
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, r14b
je 0x18538
lea r12, [rdi + 0x80c]
cmp r12, r14
je 0x18538
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, r14b
je 0x18538
cmp dword [rdi + 0x100c], r14d
je 0x18538
lea rcx, [rdi + 0x100c]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, r14b
je 0x18538
lea r14, [rdi + 0x1010]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
xor ecx, ecx
cmp al, cl
jne 0x183e2
lea rdx, [0x0001ab30]
call fcn.0001923c
jmp 0x18538
mov word [rsp + 0x30], cx
mov eax, 0x208
mov word [rsp + 0x32], ax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov rdx, r15
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [0x0001a5f0]
lea rcx, [rsp + 0x30]
call fcn.00011008
mov ebx, eax
xor r15d, r15d
cmp eax, r15d
jge 0x18442
mov r9d, eax
lea r8, [rsp + 0x30]
lea rdx, [0x0001ab70]
xor ecx, ecx
call fcn.0001923c
jmp 0x18538
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.00011008
mov ebx, eax
cmp eax, r15d
jge 0x18475
mov dword [rsp + 0x20], eax
mov r9, rsi
lea r8, [rsp + 0x30]
lea rdx, [0x0001abc0]
xor ecx, ecx
call fcn.0001923c
jmp 0x18538
mov dword [rsp + 0x58], 0x30
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x70], 0x240
lea rax, [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x80], r15
lea r8, [rsp + 0x58]
mov edx, 0xf003f
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov ebx, eax
cmp eax, r15d
jge 0x184d5
mov r9d, eax
lea r8, [rsp + 0x30]
lea rdx, [0x0001ac10]
xor ecx, ecx
call fcn.0001923c
jmp 0x18538
mov rdx, r12
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r11d, dword [rdi + 0x100c]
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], r14
mov r9d, dword [rdi + 0x808]
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ebx, eax
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x30]
lea rdx, [0x0001ac50]
xor ecx, ecx
call fcn.0001923c
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
nop
mov eax, ebx
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.00011290
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18a48
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x90
xor esi, esi
mov qword [rsp + 0x38], rsi
lea rdx, [0x0001aee0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x60], 0x30
and qword [rsp + 0x68], rsi
mov dword [rsp + 0x78], 0x240
lea rax, [rsp + 0x50]
mov qword [rsp + 0x70], rax
and qword [rsp + 0x80], rsi
and qword [rsp + 0x88], rsi
lea r8, [rsp + 0x60]
mov edx, 0xf003f
lea rcx, [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov edi, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x18ca0
lea rdx, [0x0001b040]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rsp + 0xb0]
mov qword [rsp + 0x28], r11
and dword [rsp + 0x20], esi
xor r9d, r9d
lea r12d, [rsi + 2]
mov r8d, r12d
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov edi, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x18b6a
cmp eax, 0xc0000023
je 0x18b32
cmp eax, 0x80000005
je 0x18b32
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x18ca0
mov edx, dword [rsp + 0xb0]
mov ecx, 1
mov r8d, 0x62525249
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18b6a
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x18ca0
test rsi, rsi
je 0x18c91
cmp dword [rsp + 0xb0], 0
je 0x18c91
mov r8d, dword [rsp + 0xb0]
xor edx, edx
mov rcx, rsi
call fcn.00011320
lea r11, [rsp + 0xb0]
mov qword [rsp + 0x28], r11
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
mov r9, rsi
mov r8d, r12d
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov edi, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x18be1
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x18ca0
lea r12, [rsi + 0xc]
test r12, r12
je 0x18c78
cmp dword [rsi + 8], 0
je 0x18c78
xor edx, edx
mov r8d, 0x208
lea r14, [0x00014d30]
mov rcx, r14
call fcn.00011320
mov r8d, 0x104
lea rdx, [0x0001a020]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_wcsncpy]
mov r8d, dword [rsi + 8]
mov rdx, r12
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_wcsncat]
mov r8d, 0x104
lea rdx, [0x0001a020]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe__wcsnicmp]
test eax, eax
jne 0x18c68
xor edx, edx
mov r8d, 0x208
mov rcx, r14
call fcn.00011320
mov edi, 0x80000005
mov dword [rsp + 0x30], edi
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x18ca0
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edi, 0x80000005
mov dword [rsp + 0x30], edi
jmp 0x18ca0
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
nop
test rsi, rsi
je 0x18cb3
mov edx, 0x62525249
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
mov rsi, qword [rsp + 0xc0]
add rsp, 0x90
pop r14
pop r12
pop rdi
ret
Function at 0x1980c
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x18], r8
push r12
sub rsp, 0xf0
mov r12, rcx
xor ebx, ebx
mov rsi, rbx
mov qword [rax - 0x80], rbx
mov qword [rax + 0x18], rbx
mov dword [0x00014f48], ebx
xor r9d, r9d
mov r8d, 0x73534649
lea rdx, [rax - 0x78]
call fcn.00019a60
mov dword [rsp + 0x70], eax
cmp eax, ebx
jl 0x19a3f
mov dword [rsp + 0xb8], 0x30
mov qword [rsp + 0xc0], rbx
mov dword [rsp + 0xd0], 0x240
lea rax, [rsp + 0x80]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0xe0], rbx
mov dword [rsp + 0x68], 0x100
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0xb8]
mov edx, 0x80100000
lea rcx, [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
mov edi, eax
mov dword [rsp + 0x70], eax
cmp eax, ebx
jl 0x199ea
mov dword [rsp + 0x20], 5
mov r9d, 0x18
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov edi, eax
mov dword [rsp + 0x70], eax
cmp eax, ebx
jl 0x199ea
cmp dword [rsp + 0x98], 0xa00000
jbe 0x1995f
mov edi, 0xc00000bb
mov dword [rsp + 0x70], edi
jmp 0x199ea
mov edx, dword [rsp + 0x98]
mov ecx, 1
mov r8d, 0x64534649
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
mov qword [rsp + 0x78], rax
cmp rax, rbx
jne 0x1998f
mov edi, 0xc000009a
mov dword [rsp + 0x70], edi
jmp 0x199ea
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov edi, eax
mov dword [rsp + 0x70], eax
cmp eax, ebx
jl 0x199ea
mov eax, dword [rsp + 0x98]
mov dword [0x00014f48], eax
mov qword [0x00014f40], rsi
cmp edi, ebx
jge 0x19a01
cmp rsi, rbx
je 0x19a01
mov edx, 0x64534649
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x110]
cmp rcx, rbx
je 0x19a1c
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0x110], rbx
mov rax, qword [r12 + 8]
cmp qword [rsp + 0x88], rax
je 0x19a3d
mov edx, 0x73534649
lea rcx, [rsp + 0x80]
call fcn.00019fb4
mov eax, edi
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x19b50
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
mov dword [rax + 0x10], edx
push rbx
sub rsp, 0x80
and qword [rax + 0x20], 0
mov rdx, rcx
lea rcx, [rax - 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x0001b8e0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.00019e08
test eax, eax
js 0x19cea
mov rbx, qword [rsp + 0xa8]
mov eax, dword [rsp + 0x98]
cmp dword [rbx + 0xc], eax
je 0x19bde
lea r9, [rsp + 0x98]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov r8d, 4
mov dword [rsp + 0x20], 4
call fcn.00019eb8
mov edx, 0x73525349
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rdx, [0x0001b8f0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.00019e08
test eax, eax
js 0x19cea
mov rbx, qword [rsp + 0xa8]
mov eax, dword [rsp + 0xa0]
cmp dword [rbx + 0xc], eax
je 0x19c56
lea r9, [rsp + 0xa0]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov r8d, 4
mov dword [rsp + 0x20], 4
call fcn.00019eb8
mov edx, 0x73525349
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rdx, [0x0001b900]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0xa8], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x70], 0
and qword [rsp + 0x78], 0
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xa8]
mov edx, 0xf003f
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x50], 0x30
mov dword [rsp + 0x68], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x19ce8
mov rcx, qword [rsp + 0xa8]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
add rsp, 0x80
pop rbx
ret
Function at 0x19cfc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
and dword [rsp + 0x60], 0
mov rdi, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
je 0x19d25
and qword [r8], 0
xor r9d, r9d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8d, [r9 + 2]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
cmp eax, 0xc0000023
je 0x19d84
cmp eax, 0xc0000034
je 0x19ded
test eax, eax
jns 0x19ded
xor edx, edx
mov dword [rsp + 0x28], eax
lea r9, [0x0001b480]
lea r8, [0x0001b920]
lea ecx, [rdx + 0x65]
mov dword [rsp + 0x20], 0x16e
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x19ded
test rdi, rdi
je 0x19ded
mov edx, dword [rsp + 0x60]
mov ecx, 1
mov r8d, 0x73525349
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
jne 0x19dad
mov ebx, 0xc000009a
jmp 0x19ded
lea rax, [rsp + 0x60]
mov r9, rsi
mov r8d, 2
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x60]
mov rdx, rbp
mov rcx, r12
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
test eax, eax
js 0x19ddf
mov qword [rdi], rsi
jmp 0x19ded
mov edx, 0x73525349
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret

Function at 0x19eb8
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rdi
sub rsp, 0x60
and qword [rax + 8], 0
and qword [rax - 0x30], 0
and qword [rax - 0x18], 0
and qword [rax - 0x10], 0
mov qword [rax - 0x28], rcx
mov rdi, rdx
lea rcx, [rax + 8]
lea r8, [rax - 0x38]
mov edx, 0xf003f
mov rbx, r9
mov dword [rax - 0x38], 0x30
mov dword [rax - 0x20], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x19f37
mov rcx, qword [rsp + 0x70]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x70]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret