joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000142c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdi, qword [rsp + 0x90]
mov r14, r9
mov r15d, r8d
mov r12, rdx
mov r13, rcx
test rdi, rdi
je 0x140001497
movzx esi, word [rdi]
mov r8d, 0x67666e43
mov edx, esi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
jne 0x140001486
mov eax, 0xc0000017
jmp 0x1400015c5
mov rdx, qword [rdi + 8]
mov r8, rsi
mov rcx, rax
call fcn.14000efc0
jmp 0x14000149b
xor esi, esi
xor ebx, ebx
mov rdx, r12
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r9d, r9d
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
and dword [rsp + 0x20], 0
mov rcx, r13
lea ebp, [r9 + 2]
mov r8d, ebp
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0x80000005
je 0x1400014e5
cmp eax, 0xc0000023
jne 0x1400015b6
cmp dword [rsp + 0x90], 0x10
jb 0x1400015b6
mov edx, dword [rsp + 0x90]
mov r12d, 0x67666e43
mov r8d, r12d
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x1400015b6
lea rax, [rsp + 0x90]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov eax, dword [rsp + 0x90]
mov r8d, ebp
mov rcx, r13
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x1400015aa
cmp dword [rdi + 4], r15d
jne 0x1400015aa
mov ecx, dword [rdi + 8]
lea eax, [rcx - 1]
cmp eax, 0xfffe
ja 0x1400015aa
mov esi, ecx
test rbx, rbx
je 0x140001570
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov esi, dword [rdi + 8]
mov r8d, r12d
mov edx, esi
xor ecx, ecx
mov ebp, esi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
lfence
test rax, rax
jne 0x14000159b
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x14000147c
lea rdx, [rdi + 0xc]
mov r8, rbp
mov rcx, rax
call fcn.14000efc0
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [r14 + 8], rbx
xor eax, eax
mov word [r14], si
mov word [r14 + 2], si
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000193c
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
and qword [rbp + 0x18], 0
lea rax, [0x14000f4c0]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [0x14000f4e0]
mov dword [rbp - 0x20], 0x20001e
mov qword [rbp - 8], rax
mov r9d, 0x22
lea rax, [rbp + 0x18]
mov dword [rbp - 0x10], 0x280026
mov qword [rsp + 0x30], rax
xor edx, edx
mov byte [rsp + 0x28], 0
mov rbx, rcx
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jns 0x1400019a8
lfence
jmp 0x140001a14
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov edi, eax
lfence
test eax, eax
jns 0x1400019cb
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x140001a12
lea rax, [0x140001a30]
mov qword [rbx + 0x70], rax
lea rax, [0x140001a30]
mov qword [rbx + 0x80], rax
lea rax, [0x140001a30]
mov qword [rbx + 0x100], rax
lea rax, [0x140001a50]
mov qword [rbx + 0xe0], rax
mov rax, qword [rbp + 0x18]
mov qword [0x140066db0], rax
mov byte [0x140066da8], 1
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140009d8c
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor edx, edx
lea rcx, [0x140067548]
call fcn.14000e8c8
test eax, eax
jns 0x140009db3
lfence
jmp 0x140009e51
xor r8d, r8d
lea rdx, [0x140009e90]
xor ecx, ecx
call fcn.140001014
mov edx, 1
lea rcx, [0x140067540]
call fcn.14000e8c8
mov ebx, eax
test eax, eax
jns 0x140009de7
lfence
mov rcx, qword [0x140067548]
jmp 0x140009e4a
xor r8d, r8d
lea rdx, [0x140009e70]
lea ecx, [r8 + 1]
call fcn.140001014
lea r8, [0x140066dc0]
mov rcx, rdi
lea rdx, [0x140064260]
call sub.FLTMGR.SYS_FltRegisterFilter
mov ebx, eax
test eax, eax
js 0x140009e34
mov rcx, qword [0x140066dc0]
call sub.FLTMGR.SYS_FltStartFiltering
mov ebx, eax
test eax, eax
jns 0x140009e5c
mov rcx, qword [0x140066dc0]
call sub.FLTMGR.SYS_FltUnregisterFilter
lfence
mov rcx, qword [0x140067548]
call fcn.14000e800
mov rcx, qword [0x140067540]
call fcn.14000e800
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lfence
mov byte [0x140066db8], 1
jmp 0x140009e51
Function at 0x14000a2dc
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rsi, r8
lea r9, [rax + 0x20]
mov r14, rdx
xor ebx, ebx
and dword [rax + 0x20], ebx
xor r8d, r8d
and dword [rax - 0x28], ebx
xor edx, edx
mov ebp, ecx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000a39c
mov eax, dword [rsp + 0x68]
add eax, dword [rsp + 0x20]
mov dword [rsp + 0x68], eax
test rbx, rbx
je 0x14000a33c
mov edx, 0x72706c48
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [rsp + 0x68]
mov edx, eax
xor ecx, ecx
mov r8d, 0x72706c48
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x14000a397
mov r8d, dword [rsp + 0x68]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, ebp
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov edi, eax
cmp eax, 0xc0000004
je 0x14000a319
lfence
test eax, eax
jns 0x14000a38b
mov edx, 0x72706c48
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
jmp 0x14000a39c
mov eax, dword [rsp + 0x68]
mov qword [r14], rbx
mov qword [rsi], rax
jmp 0x14000a387
mov eax, 0xc0000022
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x14000abfc
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov eax, 0x5a4d
mov r14, r9
mov r12, r8
mov r13, rdx
mov rdi, rcx
cmp word [rcx], ax
jne 0x14000ac90
movsxd rbx, dword [rcx + 0x3c]
add rbx, rcx
cmp dword [rbx], 0x4550
jne 0x14000ac90
movzx eax, word [rbx + 0x14]
lea r15, [rbx + 0x18]
add r15, rax
xor eax, eax
cmp ax, word [rbx + 6]
movzx esi, ax
jae 0x14000ac90
movzx eax, si
mov rdx, r14
lea rcx, [rax + rax*4]
lea rbp, [r15 + rcx*8]
mov rcx, rbp
call sub.ntoskrnl.exe_strstr
test rax, rax
je 0x14000ac87
mov ecx, dword [rbp + 0xc]
mov r9, r12
mov edx, dword [rbp + 8]
add rcx, rdi
mov r8, r13
call fcn.14000ab80
test rax, rax
jne 0x14000ac92
inc si
cmp si, word [rbx + 6]
jmp 0x14000ac51
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000acb0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov eax, 0x5a4d
mov r14, r8
mov rbp, rdx
cmp word [rcx], ax
jne 0x14000ad29
movsxd rbx, dword [rcx + 0x3c]
add rbx, rcx
cmp dword [rbx], 0x4550
jne 0x14000ad29
movzx eax, word [rbx + 0x14]
lea r15, [rbx + 0x18]
xor r12d, r12d
add r15, rax
movzx esi, r12w
cmp r12w, word [rbx + 6]
jae 0x14000ad29
movzx eax, si
mov rdx, rbp
lea rcx, [rax + rax*4]
lea rdi, [r15 + rcx*8]
mov rcx, rdi
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x14000ad4a
inc si
cmp si, word [rbx + 6]
jb 0x14000ad05
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
test r14, r14
je 0x14000ad55
mov eax, dword [rdi + 0x10]
mov dword [r14], eax
mov eax, dword [rdi + 0xc]
add rax, rdi
jmp 0x14000ad2b

Function at 0x14000ad60
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
lea r9, [rax + 0x18]
and dword [rax + 0x18], ebp
mov r14, rdx
mov r15, rcx
lea rdx, [rax + 0x18]
xor r8d, r8d
lea ebx, [rbp + 0xb]
mov ecx, ebx
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x14000ae26
mov edx, eax
xor ecx, ecx
mov r8d, 0x564d4f4e
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x14000ae26
mov r8d, dword [rsp + 0x50]
xor r9d, r9d
mov rdx, rax
mov ecx, ebx
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
js 0x14000ae13
lfence
xor esi, esi
cmp qword [rdi], rsi
jbe 0x14000ae13
mov rbx, rdi
lea rcx, [rbx + 0x30]
mov rdx, r15
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x14000ae01
inc rsi
add rbx, 0x128
cmp rsi, qword [rdi]
jb 0x14000addf
jmp 0x14000ae13
lfence
mov rbp, qword [rbx + 0x18]
test r14, r14
je 0x14000ae13
mov ecx, dword [rbx + 0x20]
mov dword [r14], ecx
mov edx, 0x564d4f4e
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbp
jmp 0x14000ae28
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14000b408
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
cmp byte [0x140066dd9], 0
jne 0x14000b555
cmp byte [0x140066dd8], 0
je 0x14000b555
cmp qword [0x140066de0], 0
je 0x14000b555
mov ecx, 4
call fcn.14000af94
test eax, eax
jns 0x14000b466
mov ecx, 1
call fcn.14000af94
test eax, eax
js 0x14000b555
mov ecx, 4
call fcn.14000af94
test eax, eax
js 0x14000b555
mov rcx, qword [0x140066e10]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000b555
cmp dword [0x140066de8], 0x47bb
ja 0x14000b515
mov rax, qword [0x140066e10]
lea rcx, [fcn.14000b150]
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1fffff
mov qword [rax], rcx
lea rax, [0x14000aab0]
and qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
js 0x14000b54a
and qword [rsp + 0x28], 0
lea rax, [0x140066e60]
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x1fffff
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
jns 0x14000b508
and qword [0x140066e60], 0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x14000b54a
mov rdx, qword [0x140066e10]
mov rcx, qword [rdx]
mov qword [0x140066e18], rcx
mov qword [rdx], 1
mov rdx, qword [0x140066e38]
mov rcx, qword [rdx + 0x70]
mov qword [0x140066dc8], rcx
lea rcx, section..text
mov qword [rdx + 0x70], rcx
mov byte [0x140066dd9], 1
mov al, 1
jmp 0x14000b557
xor al, al
add rsp, 0x48
ret

Function at 0x14000c680
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rdx, [rsp + 0x38]
mov ecx, 4
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14000c703
mov rcx, qword [rbx + 0x28]
call fcn.14000b810
mov rcx, qword [rsp + 0x38]
mov rbx, rax
call fcn.14000b810
mov rdi, rax
test rbx, rbx
je 0x14000c6f8
test rax, rax
je 0x14000c6f8
lea rcx, [0x140067420]
call qword [sym.imp.ntoskrnl.exe_KeAcquireGuardedMutex]
mov rdx, qword [rbx]
cmp qword [rbx + 8], rdx
jne 0x14000c6eb
mov rax, qword [rdi]
mov qword [rbx + 8], rdi
mov qword [rbx], rax
mov qword [rdi], rbx
mov qword [rax + 8], rbx
lea rcx, [0x140067420]
call qword [sym.imp.ntoskrnl.exe_KeReleaseGuardedMutex]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000d3f8
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
and qword [rbp + 0x6f], 0
lea r9, [0x14000d3b0]
and qword [rbp - 0x59], 0
lea r8, [0x14000d2d0]
and qword [rsp + 0x20], 0
lea rdx, [0x14000d350]
mov rsi, rcx
lea rcx, [0x140067180]
call qword [sym.imp.ntoskrnl.exe_RtlInitializeGenericTableAvl]
lea r8, [rbp - 0x59]
mov ecx, 5
lea rdx, [rbp + 0x6f]
call fcn.14000a2dc
mov ebx, eax
test eax, eax
jns 0x14000d461
lfence
jmp 0x14000d57a
mov rax, qword [rbp + 0x6f]
xor ecx, ecx
mov rdi, rax
and qword [rbp + 0x77], 0
add rax, rcx
mov qword [rbp + 0x6f], rax
cmp qword [rax + 0x50], 0
je 0x14000d565
and qword [rbp - 0x31], 0
lea r9, [rbp - 0x49]
and qword [rbp - 0x29], 0
lea r8, [rbp - 0x39]
xorps xmm0, xmm0
mov dword [rbp - 0x39], 0x30
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp - 0x21], 0x200
lea rcx, [rbp - 0x51]
mov rax, qword [rax + 0x50]
mov edx, 0x1000
and qword [rbp - 0x41], 0
mov qword [rbp - 0x49], rax
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
mov ebx, eax
test eax, eax
js 0x14000d561
mov rdx, qword [rbp - 0x51]
lea r9, [rbp - 0x59]
lea r8, [rbp + 0x7f]
mov ecx, 0x1b
call fcn.14000a1e4
mov rcx, qword [rbp - 0x51]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
js 0x14000d561
xor edx, edx
lea rcx, [rbp - 9]
lea r8d, [rdx + 0x50]
call fcn.14000f280
mov rcx, qword [rbp + 0x6f]
lea rdx, [rbp + 0x77]
mov rax, qword [rcx + 0x50]
mov qword [rbp - 9], rax
mov rcx, qword [rcx + 0x50]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x14000d558
mov rax, qword [rbp + 0x77]
lea rcx, [rbp - 9]
mov r8, qword [rbp + 0x6f]
mov rdx, qword [rbp + 0x7f]
mov qword [rbp + 0x1f], rax
mov rax, rsi
mov r8, qword [r8 + 0x58]
call qword [0x140010270]
lea rcx, [rbp - 9]
call fcn.14000d278
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rbp + 0x7f]
call fcn.140009edc
mov rax, qword [rbp + 0x6f]
mov ecx, dword [rax]
test rcx, rcx
jne 0x14000d46a
mov rcx, rdi
call fcn.140009edc
mov eax, ebx
mov rbx, qword [rsp + 0xf0]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000dc54
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x70
mov rbx, rdx
cmp dword [rdx + 8], 0
jl 0x14000de2a
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.14000c634
test al, al
jne 0x14000de2a
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rdx, qword [rbx]
lea rcx, [0x140067128]
call qword [sym.imp.ntoskrnl.exe_CmCallbackGetKeyObjectID]
test eax, eax
js 0x14000de2a
mov rdi, qword [rbx + 0x10]
lea r8, [rsp + 0x60]
mov rdx, qword [rdi + 0x10]
mov ecx, dword [rdi + 0xc]
call fcn.14000dacc
test al, al
je 0x14000de2a
and dword [rsp + 0xa0], 0
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [0x140067160]
call fcn.14000e734
cmp dword [rsp + 0xa0], 0
jbe 0x14000de2a
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov rax, qword [sym.imp.ntoskrnl.exe_CmKeyObjectType]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf003f
xor r8d, r8d
mov edx, 0x200
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
test eax, eax
js 0x14000de2a
mov edx, dword [rdi + 0x18]
mov ecx, 1
mov r8d, 0x46526c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14000de18
mov edx, dword [rdi + 8]
add edx, dword [rsp + 0xa0]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov ecx, dword [rdi + 0x18]
mov dword [rsp + 0x20], ecx
mov r9, rsi
mov r8d, dword [rdi + 0xc]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov r14d, eax
mov dword [rsp + 0x40], eax
test eax, eax
js 0x14000de08
lfence
lea r8, [rsp + 0x60]
mov rdx, rsi
mov ecx, dword [rdi + 0xc]
call fcn.14000dacc
test al, al
je 0x14000de08
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [0x140067160]
call fcn.14000e734
test al, al
jne 0x14000dd5c
mov rdx, qword [rdi + 0x20]
mov eax, dword [rsp + 0xa8]
mov dword [rdx], eax
lfence
mov r8d, dword [rsp + 0xa8]
mov rdx, rsi
mov rcx, qword [rdi + 0x10]
call fcn.14000efc0
jmp 0x14000de08
mov edx, 0x46526c46
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x14000de1b
xor r14d, r14d
mov dword [rbx + 0x18], r14d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop r14
pop rdi
pop rsi
ret
Function at 0x14000de40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x70
mov rbx, rdx
cmp dword [rdx + 8], 0
jl 0x14000e016
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, rax
call fcn.14000c634
test al, al
jne 0x14000e016
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rdx, qword [rbx]
lea rcx, [0x140067128]
call qword [sym.imp.ntoskrnl.exe_CmCallbackGetKeyObjectID]
test eax, eax
js 0x14000e016
mov rdi, qword [rbx + 0x10]
lea r8, [rsp + 0x60]
mov rdx, qword [rdi + 0x10]
mov ecx, dword [rdi + 0xc]
call fcn.14000db00
test al, al
je 0x14000e016
and dword [rsp + 0xa0], 0
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [0x140067158]
call fcn.14000e734
cmp dword [rsp + 0xa0], 0
jbe 0x14000e016
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov rax, qword [sym.imp.ntoskrnl.exe_CmKeyObjectType]
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf003f
xor r8d, r8d
mov edx, 0x200
mov rcx, qword [rbx]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
test eax, eax
js 0x14000e016
mov edx, dword [rdi + 0x18]
mov ecx, 1
mov r8d, 0x46526c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14000e004
mov edx, dword [rdi + 8]
add edx, dword [rsp + 0xa0]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov ecx, dword [rdi + 0x18]
mov dword [rsp + 0x20], ecx
mov r9, rsi
mov r8d, dword [rdi + 0xc]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
mov r14d, eax
mov dword [rsp + 0x40], eax
test eax, eax
js 0x14000dff4
lfence
lea r8, [rsp + 0x60]
mov rdx, rsi
mov ecx, dword [rdi + 0xc]
call fcn.14000db00
test al, al
je 0x14000dff4
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [0x140067158]
call fcn.14000e734
test al, al
jne 0x14000df48
mov rdx, qword [rdi + 0x20]
mov eax, dword [rsp + 0xa8]
mov dword [rdx], eax
lfence
mov r8d, dword [rsp + 0xa8]
mov rdx, rsi
mov rcx, qword [rdi + 0x10]
call fcn.14000efc0
jmp 0x14000dff4
mov edx, 0x46526c46
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x14000e007
xor r14d, r14d
mov dword [rbx + 0x18], r14d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop r14
pop rdi
pop rsi
ret
Function at 0x180002ae0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180002b15
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1800026a0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180002c84
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180002bfc
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180002c73
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x180002c39
mov r10, qword [rdx]
cmp r10, rax
je 0x180002c33
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180002c73
cmp r9, rdx
je 0x180002c4f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x180002c95
cmp r9, rdx
jne 0x180002c40
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x180002b80
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180002c73