joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140592b2c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140592b5c
xor eax, eax
jmp 0x140592c1f
mov rbp, rbx
cmp word [rax], si
je 0x140592b81
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140592b68
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140592b64
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140592a4c
movsxd r14, eax
test eax, eax
jne 0x140592bbf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140592b55
mov rcx, r14
call fcn.14058fd94
mov rdi, rax
test rax, rax
jne 0x140592bd8
xor ecx, ecx
call fcn.14058f6a4
jmp 0x140592bb4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140592a4c
test eax, eax
jne 0x140592c09
mov rcx, rdi
call fcn.14058f6a4
jmp 0x140592c13
xor ecx, ecx
call fcn.14058f6a4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140592c3c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140592cc3
mov rsi, rbx
cmp word [rax], bp
je 0x140592c82
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140592c6c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140592c68
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14058fd94
mov rdi, rax
test rax, rax
je 0x140592cb0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14059b790
mov rbp, rdi
xor ecx, ecx
call fcn.14058f6a4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1405961f0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140596206
mov al, 1
jmp 0x140596266
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140596217
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140596264
mov ecx, dword [rcx + 0x18]
nop
call fcn.140584170
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140596264
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140596264
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140596264
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140596266
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140002028
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002072
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002072
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002072
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002072
cmp dword [rcx + 0x84], 0xe
jbe 0x140002072
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002074
xor al, al
add rsp, 0x28
ret
Function at 0x14000c980
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000c9cc
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000c9c4
cmp dword [rcx + 0x3c], edx
jl 0x14000c9c4
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14000c9c4
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000c9cc
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1408a7fba
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp r9
push rbx
pushfq
push rsi
mov sil, r13b
jmp 0x1408fa9d4
push r8
inc bh
movzx r8w, r10b
push r15
setae r8b
not sil
movsx r8d, di
push rdx
movsx r8, r15w
setnp sil
cmovge dx, ax
push rbp
push r9
not dl
push rcx
push r10
push r13
xchg bx, dx
push r14
push rax
movsx r8w, spl
cwd
rdtsc
push r12
cdqe
push rdi
cmovo r9d, ebx
push r11
rdtsc
cmovo r9, r9
cwd
movabs r11, 0
mov dil, 0x87
not bx
push r11
cwd
movsx rsi, dx
setbe sil
mov rsi, qword [rsp + 0x90]
cmovae ax, r12w
not bx
bswap esi
mov al, spl
dec esi
adc r9b, r15b
neg esi
movsx ebx, si
rol ah, 0x11
bts r9, rsp
ror esi, 1
dec esi
movsx r9w, r9b
cmp r10, r14
cdq
lea rsi, [rsi + r11]
movsxd r8, r13d
movabs rdx, 0x100000000
cmovae r8, rsi
lea rsi, [rsi + rdx]
rcr rax, 0x59
sets bl
mov rbx, rsp
movsx r9d, bp
btc edi, r10d
sub rsp, 0x180
and r9b, 0xbd
sar dil, 0xc3
and rsp, 0xfffffffffffffff0
btc r9w, 0x4a
and dil, sil
btr di, sp
mov r8, rsi
dec edi
shr ah, cl
movabs rdi, 0
setle al
sub r8, rdi
rol eax, cl
lea r9, [0x1408faad9]
xor ax, 0x3e03
sbb rax, 0xcef6f78
sub rsi, 4
mov eax, dword [rsi]
xor eax, r8d
bswap eax
jmp 0x1409564d2
dec eax
test cl, r15b
bswap eax
test ebp, 0x539d0c06
clc
not eax
cmc
push r8
movzx r8, r12w
shrd r8d, esp, 0x21
shl r8b, cl
xor dword [rsp], eax
xadd r8b, r8b
ror r8b, cl
pop r8
movsxd rax, eax
stc
add r9, rax
jmp 0x1408a1731
Function at 0x140001fe0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000202a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000202a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000202a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000202a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000202a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000202c
xor al, al
add rsp, 0x28
ret

Function at 0x140007dd4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140007e43
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140007e43
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140007e43
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007e43
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140007e43
cmp dword [rcx + 0x84], 0xe
jbe 0x140007e43
cmp dword [rcx + 0xf8], 0
je 0x140007e43
mov ecx, ebx
call fcn.140007ef4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140007cd0
nop
cmp dword [rbp + 0x20], 0
je 0x140007e91
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140007e9c
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140007dd4

Function at 0x140007fd8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140007dd4
Function at 0x14000a6e4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000a76b
mov rsi, rbx
cmp word [rax], bp
je 0x14000a72a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000a714
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14000a710
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400090ec
mov rdi, rax
test rax, rax
je 0x14000a758
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400107e0
mov rbp, rdi
xor ecx, ecx
call fcn.14000914c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400100c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400100e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400100e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140ec4e40
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140ec4e4a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140ec4e73
pop rbp
sub rbp, 0x33
sub rbp, 0xec4e40
sub rsp, 0x20
jmp 0x140ec4e92
mov rax, 0xec4e40
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x385e78c
xor byte [rax], dl
inc rax
dec rcx
jne 0x140ec4eb1
jmp 0x140ec4ec8
invalid
Function at 0x140002d10
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rcx, qword [rcx]
mov rbx, r9
test rcx, rcx
jne 0x140002d35
test rbx, rbx
je 0x140002d2d
mov dword [r9], 0xc0000008
xor eax, eax
add rsp, 0x60
pop rbx
ret
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x70], rdi
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x58], rdi
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
jns 0x140002d95
test rbx, rbx
je 0x140002d9c
mov rdi, qword [rsp + 0x70]
mov dword [rbx], eax
mov rax, qword [rsp + 0x58]
add rsp, 0x60
pop rbx
ret
test rbx, rbx
je 0x140002d9c
mov dword [rbx], edi
mov rax, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x70]
add rsp, 0x60
pop rbx
ret

Function at 0x140002dd0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rcx, qword [rcx]
mov rbx, r9
test rcx, rcx
jne 0x140002df5
test rbx, rbx
je 0x140002ded
mov dword [r9], 0xc0000008
xor eax, eax
add rsp, 0x60
pop rbx
ret
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x70], rdi
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x58], rdi
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
test eax, eax
jns 0x140002e55
test rbx, rbx
je 0x140002e5c
mov rdi, qword [rsp + 0x70]
mov dword [rbx], eax
mov rax, qword [rsp + 0x58]
add rsp, 0x60
pop rbx
ret
test rbx, rbx
je 0x140002e5c
mov dword [rbx], edi
mov rax, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x70]
add rsp, 0x60
pop rbx
ret

Function at 0x140003100
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rcx, qword [rcx]
mov rsi, r8
mov rbx, rdx
mov rdi, r9
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov r9d, 0x28
mov dword [rsp + 0x20], 4
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jns 0x140003147
mov dword [rbx], eax
jmp 0x1400031cc
mov qword [rsp + 0x90], rbp
xor ebp, ebp
test rsi, rsi
je 0x140003174
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rbp
xor ecx, ecx
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
call fcn.1400229f0
test rdi, rdi
je 0x140003197
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rbp
xor ecx, ecx
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
call fcn.1400229f0
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x1400031c2
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rcx], xmm0
xor ecx, ecx
call fcn.1400229f0
mov dword [rbx], ebp
mov rbp, qword [rsp + 0x90]
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400031f0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x70
mov r14, rcx
mov rcx, qword [rcx]
mov rsi, r8
mov rbx, rdx
mov rdi, r9
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r9d, 0x28
mov dword [rsp + 0x20], 4
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jns 0x14000323a
mov dword [rbx], eax
jmp 0x140003294
test rsi, rsi
je 0x140003247
mov rax, qword [rsi]
mov qword [rsp + 0x40], rax
test rdi, rdi
je 0x140003254
mov rax, qword [rdi]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x140003269
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rcx, qword [r14]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov r9d, 0x28
mov dword [rsp + 0x20], 4
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
test eax, eax
js 0x140003236
mov dword [rbx], 0
lea r11, [rsp + 0x70]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret

Function at 0x140003310
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
mov rcx, qword [rcx]
mov esi, r8d
mov rbx, rdx
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x30]
mov r9d, 8
mov dword [rsp + 0x20], 0x23
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jns 0x140003362
mov dword [rbx], eax
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rdi]
or dword [rsp + 0x50], esi
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x30]
mov r9d, 8
mov dword [rsp + 0x20], 0x23
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
test eax, eax
js 0x14000334d
mov rsi, qword [rsp + 0x60]
mov dword [rbx], 0
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x1400033b0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
mov rcx, qword [rcx]
mov rbx, rdx
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov r9d, 8
mov dword [rsp + 0x20], 0xe
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jns 0x1400033f5
mov dword [rbx], eax
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rax, qword [rsp + 0x60]
mov rcx, qword [rdi]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x40]
mov r9d, 8
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
test eax, eax
js 0x1400033e5
mov dword [rbx], 0
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140004650
Capabilities:
Create thread

Disassembly:
sub rsp, 0x78
cmp qword [rcx], 0
je 0x140004661
xor al, al
add rsp, 0x78
ret
xor eax, eax
lea rdx, [0x140002b60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
lea rax, [rcx + 8]
lea r8, [rsp + 0x40]
xor r9d, r9d
mov edx, 0x1fffff
mov dword [rsp + 0x40], 0x30
mov dword [rsp + 0x58], 0x200
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
setns al
add rsp, 0x78
ret

Function at 0x140008c60
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rdx, qword [rcx]
mov rsi, rcx
lea rcx, [rsp + 0x30]
mov ebx, r9d
mov rdi, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
test ebx, ebx
jne 0x140008caa
or rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140008ca0
mov rcx, qword [rsi + 8]
lea eax, [rbx*2 + 2]
lea rdx, [rsp + 0x30]
mov rcx, qword [rcx]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov dword [r14], eax
mov rax, r14
add rsp, 0x40
pop r14
ret
Function at 0x140008f60
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x68], rbp
mov rbx, r8
mov r8, qword [r8 + 8]
xor ebp, ebp
mov qword [rsp + 0x70], rsi
mov rdi, rdx
mov r14, rcx
cmp r8, 0x10
jae 0x140008fb5
mov rcx, qword [rbx]
mov esi, 0x10
cmp r8, rsi
cmova rsi, r8
mov rdx, rsi
call fcn.140022a30
mov qword [rbx], rax
test rax, rax
jne 0x140008fb1
mov qword [rbx + 0x10], rbp
mov qword [rbx + 8], rbp
jmp 0x140008fb5
mov qword [rbx + 8], rsi
mov r8, qword [rbx + 8]
cmp r8, 0x10
jae 0x140008fec
mov rcx, qword [rbx]
mov esi, 0x10
cmp r8, rsi
cmova rsi, r8
mov rdx, rsi
call fcn.140022a30
mov qword [rbx], rax
test rax, rax
jne 0x140008fe8
mov qword [rbx + 0x10], rbp
mov qword [rbx + 8], rbp
jmp 0x140008fec
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], 0x10
mov rdx, qword [r14]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [r14 + 8]
mov rax, qword [rbx + 0x10]
mov r9, qword [rbx]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], ebp
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x30]
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ecx, dword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
test ecx, ecx
jne 0x14000905b
test eax, eax
js 0x140009093
mov dword [rdi], 0xc0000001
mov rax, rdi
add rsp, 0x40
pop r14
pop rdi
pop rbx
ret
mov rdx, rcx
mov rcx, rbx
call fcn.140009440
mov rcx, qword [r14 + 8]
mov rax, qword [rbx + 0x10]
mov rcx, qword [rcx]
mov r9, qword [rbx]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x30]
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [rdi], eax
mov rax, rdi
add rsp, 0x40
pop r14
pop rdi
pop rbx
ret
Function at 0x140009190
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor ebp, ebp
mov esi, r8d
lea rax, [rax + 0x20]
mov qword [rax - 0x58], rbp
mov qword [rax - 0x50], rbp
mov qword [rax - 0x48], rbp
mov dword [rax], ebp
mov r14, rcx
mov rcx, qword [rcx]
mov rbx, rdx
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov edi, ebp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov eax, dword [rsp + 0x88]
test eax, eax
je 0x14000923c
lea rcx, [rsp + 0x30]
mov edx, eax
call fcn.1400094f0
mov rdi, qword [rsp + 0x30]
mov rcx, qword [r14]
lea rax, [rsp + 0x88]
mov r9, rdi
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x40]
mov edx, esi
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
test eax, eax
js 0x14000923c
test rdi, rdi
je 0x14000923c
mov r8d, dword [rdi + 0xc]
lea rdx, [rdi + 0x10]
mov rcx, rbx
shr r8, 1
call fcn.140003b70
jmp 0x140009277
lea rax, [rbx + 0x18]
mov qword [rbx + 0x10], 1
mov qword [rbx + 8], rbp
mov qword [rbx], rax
mov word [rax], bp
mov rax, qword [rbx + 0x10]
mov rcx, rbp
test rax, rax
jne 0x140009267
lea rcx, [rax - 1]
mov rcx, rbp
jmp 0x14000926e
mov rax, qword [rbx]
mov word [rax + rcx*2], bp
mov qword [rbx + 8], rcx
test rdi, rdi
je 0x14000927f
mov rcx, rdi
call fcn.140022b00
mov rbp, qword [rsp + 0x78]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret

Function at 0x14000b290
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rax, [0x140036c78]
mov rbx, rcx
mov qword [rcx], rax
lea rcx, str.VirtualCDBus:_Unloading_VirtualCDBus..._r_n
call qword [sym.imp.ntoskrnl.exe_DbgPrint]
mov rax, qword [rbx + 0x50]
mov qword [rax + 0xd0], 0
mov rdi, qword [rbx + 0x58]
test rdi, rdi
je 0x14000b2fd
mov rcx, rdi
call fcn.140023850
mov eax, dword [rdi + 0xd0]
mov dword [rdi + 0xd0], 3
mov dword [rdi + 0xd4], eax
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x14000b2fd
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x14000b310
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
lea rax, [0x140036ec8]
mov qword [rbx], rax
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14000b331
lea rax, [rbx + 0x30]
cmp rcx, rax
je 0x14000b331
call fcn.140022b00
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140018c20
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
cmp qword [rcx + 0x80], 0
movzx ebp, r8b
mov rsi, rdx
mov rdi, rcx
jne 0x140018c5e
mov dword [rdx], 0xc0000034
mov rax, rdx
lea r11, [rsp + 0x70]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
cmp qword [rcx + 0x50], 0
mov qword [rsp + 0x80], rbx
je 0x140018ca1
mov r8b, 1
mov edx, 0x11
add rcx, 0x48
call fcn.1400058f0
mov rax, qword [rdi + 0x48]
lea rdx, [rdi + 0x60]
mov qword [rdx + 8], rax
movzx eax, word [rdi + 0x50]
add ax, ax
mov word [rdx], ax
movzx eax, word [rdi + 0x58]
add ax, ax
mov word [rdx + 2], ax
jmp 0x140018ca3
xor edx, edx
mov eax, dword [rdi + 0x88]
mov rcx, qword [rdi + 0x80]
mov byte [rsp + 0x50], bpl
mov qword [rsp + 0x48], rdx
mov byte [rsp + 0x40], 1
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
mov rcx, qword [rdi + 8]
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryDirectoryFile]
mov ebx, eax
test eax, eax
jns 0x140018d1a
mov rcx, qword [rdi + 0x80]
test rcx, rcx
je 0x140018d1c
call fcn.140022b00
mov qword [rdi + 0x80], 0
mov dword [rdi + 0x88], 0
jmp 0x140018d1c
xor ebx, ebx
lea r11, [rsp + 0x70]
mov dword [rsi], ebx
mov rbx, qword [rsp + 0x80]
mov rbp, qword [r11 + 0x18]
mov rax, rsi
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret