joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400121e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [0x140052200]
xor esi, esi
mov r15, rcx
mov dword [rdi + 0x2da4], esi
test rcx, rcx
je 0x1400122fa
mov qword [rsp + 0x40], rbx
lea rbx, [rdi + 0x2da8]
mov dword [rdi + 0x2da4], esi
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x48], rbp
test ecx, ecx
jns 0x14001223a
mov eax, ecx
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.1400132c0
mov dword [rbx], esi
cmp dword [rbx + 4], esi
jne 0x14001224e
mov edx, 8
mov rcx, rbx
call fcn.1400132c0
movsxd rcx, dword [rbx]
mov ebp, esi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], sil
inc dword [rbx]
cmp dword [rdi + 0x2db8], esi
jle 0x14001229a
mov qword [rsp + 0x50], r14
mov r14, rsi
nop dword [rax]
mov r9, qword [rdi + 0x2dc0]
mov r8, rbx
add r9, r14
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add r14, 0x30
cmp ebp, dword [rdi + 0x2db8]
jl 0x140012270
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
cmp qword [rbx + 8], rsi
je 0x1400122a9
mov esi, dword [rbx]
dec esi
mov rax, qword [rdi + 0x2db0]
lea rdx, [0x14004584c]
test rax, rax
movsxd rsi, esi
lea rdi, [0x1400521f8]
mov rcx, r15
cmovne rdi, rax
call fcn.140002850
mov rbx, rax
test rax, rax
je 0x1400122f5
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x14001e070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14001e229
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14001e106
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001d9e0
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001cfd0
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14001e0f7
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140012f40
mov dword [rbx + 0x80], 0
jmp 0x14001e215
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
mov r8d, 4
call fcn.14001beb0
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400300e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140051040]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [rcx]
mov ebx, edx
test al, al
je 0x140030118
cmp al, 0x25
jne 0x14003010d
cmp byte [rcx + 1], al
jne 0x140030118
inc rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140030101
cmp byte [rcx], 0x25
jne 0x1400301e9
cmp byte [rcx + 1], 0x25
je 0x1400301e9
xorps xmm3, xmm3
mov r8, rcx
cvtss2sd xmm3, xmm2
mov edx, 0x40
lea rcx, [rsp + 0x30]
movq r9, xmm3
call fcn.140002670
cmp byte [rsp + 0x30], 0x20
lea rcx, [rsp + 0x30]
jne 0x14003015d
inc rcx
cmp byte [rcx], 0x20
je 0x140030155
lea eax, [rbx - 4]
cmp eax, 1
jbe 0x1400301d7
movzx edx, byte [rcx]
movzx r8d, dl
cmp dl, 0x2d
jne 0x140030176
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
xorps xmm1, xmm1
cmovne rax, rcx
cmp r8b, 0x2b
lea rcx, [rax + 1]
cmovne rcx, rax
movzx eax, byte [rcx]
cmp al, 0x30
jl 0x1400301c6
movss xmm2, dword [0x14004a500]
nop dword [rax]
cmp al, 0x39
ja 0x1400301c6
movsx eax, byte [rcx]
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x1400301a0
cmp dl, 0x2d
jne 0x1400301e4
xorps xmm1, xmmword [0x14004af80]
movaps xmm0, xmm1
jmp 0x1400301ec
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1400301ec
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140042150
add rsp, 0x80
pop rbx
ret

Function at 0x140030210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140051040]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [rcx]
mov ebx, edx
test al, al
je 0x140030248
cmp al, 0x25
jne 0x14003023d
cmp byte [rcx + 1], al
jne 0x140030248
inc rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140030231
cmp byte [rcx], 0x25
jne 0x14003030b
cmp byte [rcx + 1], 0x25
je 0x14003030b
mov r8, rcx
movaps xmm3, xmm2
lea rcx, [rsp + 0x30]
movq r9, xmm2
mov edx, 0x40
call fcn.140002670
cmp byte [rsp + 0x30], 0x20
lea rcx, [rsp + 0x30]
jne 0x140030289
inc rcx
cmp byte [rcx], 0x20
je 0x140030281
lea eax, [rbx - 4]
cmp eax, 1
jbe 0x1400302fd
movzx edx, byte [rcx]
movzx r8d, dl
cmp dl, 0x2d
jne 0x1400302a2
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
xorps xmm1, xmm1
cmovne rax, rcx
cmp r8b, 0x2b
lea rcx, [rax + 1]
cmovne rcx, rax
movzx eax, byte [rcx]
cmp al, 0x30
jl 0x1400302ec
movsd xmm2, qword [0x14004a470]
cmp al, 0x39
ja 0x1400302ec
movsx eax, byte [rcx]
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x1400302c8
cmp dl, 0x2d
jne 0x140030306
xorps xmm1, xmmword [0x14004af70]
movaps xmm0, xmm1
jmp 0x14003030e
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14003030e
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140042150
add rsp, 0x80
pop rbx
ret
Function at 0x140040710
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa7], 0
je 0x140040738
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x72]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xa6
jb 0x140040720
mov byte [rcx + 0xa7], 0
ret

Function at 0x140040740
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x9e], 0
je 0x140040768
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x72]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x9d
jb 0x140040750
mov byte [rcx + 0x9e], 0
ret

Function at 0x140040770
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa6], 0
je 0x140040798
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x72]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xa5
jb 0x140040780
mov byte [rcx + 0xa6], 0
ret

Function at 0x1400407a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa0], 0
je 0x1400407c8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x72]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x9f
jb 0x1400407b0
mov byte [rcx + 0xa0], 0
ret

Function at 0x1400407d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa5], 0
je 0x1400407f8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x72]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xa4
jb 0x1400407e0
mov byte [rcx + 0xa5], 0
ret

Function at 0x140040800
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa8], 0
je 0x140040828
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x72]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xa7
jb 0x140040810
mov byte [rcx + 0xa8], 0
ret

Function at 0x140040830
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa4], 0
je 0x140040858
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x72]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xa3
jb 0x140040840
mov byte [rcx + 0xa4], 0
ret

Function at 0x140040860
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x9f], 0
je 0x140040888
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x72]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x9e
jb 0x140040870
mov byte [rcx + 0x9f], 0
ret

Function at 0x140040890
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa2], 0
je 0x1400408b8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x72]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xa1
jb 0x1400408a0
mov byte [rcx + 0xa2], 0
ret

Function at 0x140042e78
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140042ec2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140042ec2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140042ec2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140042ec2
cmp dword [rcx + 0x84], 0xe
jbe 0x140042ec2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140042ec4
xor al, al
add rsp, 0x28
ret
Function at 0x160b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rdx
cmp r9d, 0x24
jae 0x160db
xor edx, edx
mov rax, qword [rsp + 0x68]
mov dword [rax], edx
mov edx, 0xc0000004
jmp 0x1615f
cmp dword [rsp + 0x60], 4
jae 0x160f2
xor edx, edx
mov rax, qword [rsp + 0x68]
mov dword [rax], edx
mov edx, 0xc0000023
jmp 0x1615f
mov rdi, qword [rdx + 0x18]
mov edx, dword [rdi + 0x18]
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov edx, 4
mov r8d, edx
mov rcx, qword [rdi + 0x1c]
call qword [sym.imp.ntoskrnl.exe_ProbeForWrite]
nop
mov rax, qword [rdi + 0x1c]
mov qword [rsp + 0x28], rax
mov eax, dword [rdi + 0x18]
mov dword [rsp + 0x20], eax
mov r9, qword [rdi + 0x10]
mov r8d, dword [rdi + 0xc]
mov edx, dword [rdi + 8]
mov rcx, qword [rdi]
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
jmp 0x1614c
xor edx, edx
mov rcx, qword [rsp + 0x68]
mov dword [rcx], 4
mov rcx, qword [rbx + 0x18]
mov dword [rcx], eax
mov eax, edx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x16df0
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0xa0
xor edx, edx
lea rcx, [rsp + 0x24]
mov dword [rsp + 0xb0], 0x78
lea r8d, [rdx + 0x74]
mov dword [rsp + 0x20], 0
call fcn.0002b750
mov r8d, 0x78
lea r9, [rsp + 0xb0]
lea ecx, [r8 - 0x68]
lea rdx, [rsp + 0x20]
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov edx, dword [rsp + 0xb0]
xor ecx, ecx
add edx, 0x1000
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
je 0x16e90
mov r8d, dword [rsp + 0xb0]
xor r9d, r9d
mov rdx, rax
lea ecx, [r9 + 0x10]
add r8d, 0x1000
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
jns 0x16e8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
add rsp, 0xa0
pop rbx
ret
mov rax, rbx
add rsp, 0xa0
pop rbx
ret
Function at 0x18d90
Capabilities:
Get system information on windows

Disassembly:
push rdi
push r12
push r14
push r15
sub rsp, 0x28
xor edi, edi
mov r14, r8
mov r15, rdx
mov r12, rcx
mov dword [rsp + 0x60], edi
test r8, r8
je 0x18f23
test rcx, rcx
je 0x18f23
lea r9, [rsp + 0x60]
lea ecx, [rdi + 0xb]
xor r8d, r8d
xor edx, edx
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
js 0x18de4
mov eax, 0xc00000bb
add rsp, 0x28
pop r15
pop r14
pop r12
pop rdi
ret
cmp eax, 0xc0000004
jne 0x18e92
mov eax, dword [rsp + 0x60]
mov ecx, 1
mov r8d, 0x65786b72
add eax, 0x400
mov qword [rsp + 0x50], rbx
mov edx, eax
mov dword [rsp + 0x60], eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
jne 0x18e32
mov eax, 0xc0000017
mov rbx, qword [rsp + 0x50]
add rsp, 0x28
pop r15
pop r14
pop r12
pop rdi
ret
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x20], r13
call fcn.0002b750
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
mov rdx, rbx
mov ecx, 0xb
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov r13d, eax
test eax, eax
js 0x18f10
and qword [rbx], 0xffff
mov rax, qword [rbx]
cmp rax, 1
jae 0x18e9e
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0xc00000bb
mov r13, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
add rsp, 0x28
pop r15
pop r14
pop r12
pop rdi
ret
test rax, rax
je 0x18f10
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x68], rsi
mov rsi, rdi
lea rbp, [rbx + 0x2e]
nop word [rax + rax]
movzx eax, word [rbp]
mov rdx, r12
add rax, rsi
lea rcx, [rax + rbx + 0x30]
call sub.ntoskrnl.exe__stricmp
test eax, eax
je 0x18ef0
inc rdi
add rsi, 0x128
add rbp, 0x128
cmp rdi, qword [rbx]
jb 0x18ec0
jmp 0x18f06
imul rdi, rdi, 0x128
mov rax, qword [rdi + rbx + 0x18]
mov qword [r15], rax
mov eax, dword [rdi + rbx + 0x20]
mov dword [r14], eax
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, r13d
jmp 0x18e88
mov eax, 0xc0000001
add rsp, 0x28
pop r15
pop r14
pop r12
pop rdi
ret
Function at 0x18f40
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbp
push rsi
sub rsp, 0x70
xor eax, eax
mov rsi, rdx
xor edx, edx
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x28], rax
mov dword [rsp + 0x38], 0x30
mov qword [r11 - 0x38], rdx
mov dword [rsp + 0x50], 0x240
mov qword [r11 - 0x30], rcx
mov qword [r11 - 0x48], rdx
mov dword [r11 + 8], edx
mov qword [r11 - 0x20], rdx
mov qword [r11 - 0x18], rdx
lea rcx, [r11 - 0x48]
lea r8, [r11 - 0x40]
mov edx, 0xf003f
mov rbp, r9
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x190ee
mov edx, 0x1000
xor ecx, ecx
mov r8d, 0x62736374
mov qword [rsp + 0x90], rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
jne 0x18fe5
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc0000001
jmp 0x190e6
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x80]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov r8d, 2
mov rdx, rsi
mov dword [rsp + 0x20], 0x1000
mov qword [rsp + 0x88], rbx
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
cmp eax, 0xc0000023
je 0x19029
cmp eax, 0x80000005
jne 0x19093
mov ebx, dword [rsp + 0x80]
mov edx, 0x62736374
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rdx, rbx
xor ecx, ecx
mov r8d, 0x62736374
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
jne 0x19069
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc0000001
jmp 0x190de
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x80]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov r8d, 2
mov rdx, rsi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
js 0x190ce
mov ecx, dword [rdi + 8]
mov rax, qword [rsp + 0xa8]
mov dword [rax], ecx
cmp dword [rsp + 0xa0], ecx
jb 0x190c9
mov r8, rcx
lea rdx, [rdi + 0xc]
mov rcx, rbp
call fcn.0002b3c0
jmp 0x190ce
mov ebx, 0xc0000023
mov edx, 0x62736374
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x98]
add rsp, 0x70
pop rsi
ret
Function at 0x19bb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x80
xor eax, eax
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x18], r12
mov r12, qword [0x0002ece0]
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x40], rax
mov rax, qword [r12]
mov dword [rsp + 0x30], 0x30
xor edi, edi
mov qword [r11 - 0x20], r13
mov r13, r8
mov qword [r11 - 0x50], rax
mov dword [rsp + 0x48], 0x240
mov qword [r11 - 0x28], r14
mov edx, 0x1000
xor ecx, ecx
mov r8d, 0x70656472
mov qword [r11 - 0x48], rdi
mov qword [r11 - 0x38], rdi
mov qword [r11 - 0x30], rdi
mov r14, r9
mov dword [r11 + 0x10], edi
mov qword [r11 + 8], rax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x19c4f
xor edx, edx
mov r8d, 0x1000
mov rcx, rax
call fcn.0002b750
test rbx, rbx
je 0x19d55
mov rcx, qword [rsp + 0x90]
lea rax, [rsp + 0x98]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov r8d, 2
mov rdx, r13
mov dword [rsp + 0x20], 0x1000
mov qword [rsp + 0xa8], rbp
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov edi, eax
cmp eax, 0xc0000023
je 0x19c9f
cmp eax, 0x80000005
jne 0x19d16
mov ebp, dword [rsp + 0x98]
mov edx, 0x70656472
mov rcx, rbx
mov qword [rsp + 0x78], rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r8d, 0x70656472
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x19cdf
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.0002b750
mov rsi, qword [rsp + 0x78]
test rbx, rbx
je 0x19d4d
mov rcx, qword [rsp + 0x90]
lea rax, [rsp + 0x98]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov r8d, 2
mov rdx, r13
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov edi, eax
test edi, edi
js 0x19d3f
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rbx + 8]
cmp dword [rax], ecx
jb 0x19d3a
mov r8, rcx
lea rdx, [rbx + 0xc]
mov rcx, r14
call fcn.0002b3c0
jmp 0x19d3f
mov edi, 0xc0000023
mov edx, 0x70656472
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbp, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x90]
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
cmp rcx, qword [r12]
mov rbx, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x70]
je 0x19d80
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test edi, edi
setns al
add rsp, 0x80
pop rdi
ret
Function at 0x19e50
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rsi
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x70
xor eax, eax
xor edi, edi
lea r8, [r11 - 0x38]
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x10], rax
mov qword [r11 - 0x20], rax
mov rax, qword [0x0002ece0]
mov rcx, qword [rax]
mov dword [rsp + 0x40], 0x30
mov rsi, r9
mov qword [r11 - 0x30], rcx
mov dword [rsp + 0x58], 0x240
mov qword [r11 - 0x28], rdx
lea rcx, [r11 + 0x10]
mov edx, 0x20019
mov qword [r11 + 0x10], rdi
mov dword [r11 + 8], edi
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x10], rdi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jns 0x19ed4
xor al, al
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret
mov edx, 0x1000
xor ecx, ecx
mov r8d, 0x70656472
mov qword [rsp + 0x90], rbx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x1a00a
xor edx, edx
mov r8d, 0x1000
mov rcx, rax
call fcn.0002b750
xor edx, edx
mov r8d, 0x1000
mov rcx, rbx
call fcn.0002b750
mov rcx, qword [rsp + 0x88]
xor edx, edx
lea r11, [rsp + 0x80]
lea r8d, [rdx + 1]
mov r9, rbx
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, 0x8000001a
je 0x19fea
test eax, eax
js 0x19f9f
cmp dword [rbx + 0x10], 0
je 0x19f9f
mov r8d, dword [rbx + 8]
mov r9d, dword [rbx + 0xc]
xor eax, eax
mov qword [rsp + 0x32], rax
mov dword [rsp + 0x3a], eax
mov word [rsp + 0x3e], ax
movzx eax, word [rbx + 0x10]
lea rdx, [rsp + 0x30]
add r8, rbx
mov word [rsp + 0x30], ax
mov word [rsp + 0x32], ax
lea rax, [rbx + 0x14]
mov rcx, rsi
mov qword [rsp + 0x38], rax
call fcn.0001aa10
test al, al
je 0x19fea
xor edx, edx
mov r8d, 0x1000
mov rcx, rbx
inc edi
call fcn.0002b750
mov rcx, qword [rsp + 0x88]
lea r11, [rsp + 0x80]
mov r9, rbx
mov r8d, 1
mov qword [rsp + 0x28], r11
mov edx, edi
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, 0x8000001a
jne 0x19f52
mov edx, 0x70656472
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, 1
jmp 0x1a01a
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor al, al
mov rbx, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret
Function at 0x1a3a0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x90
mov rbp, rdx
lea rcx, [rsp + 0x50]
lea rdx, [0x000116b8]
mov rsi, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor eax, eax
mov qword [rsp + 0x42], rax
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
movzx eax, word [rbp]
xor r12d, r12d
mov r8d, 0x70656472
add ax, word [rsi]
xor ecx, ecx
mov word [rsp + 0x40], r12w
add ax, 4
movzx edi, ax
mov word [rsp + 0x42], ax
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x1a41b
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.0002b750
mov qword [rsp + 0x48], rbx
test rbx, rbx
jne 0x1a435
xor al, al
add rsp, 0x90
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rsp + 0x40]
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [0x000116c4]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea rcx, [rsp + 0x40]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
mov rax, qword [0x0002ece0]
xor r11d, r11d
mov rcx, qword [rax]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x70], r11
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x78], r11
mov qword [rsp + 0x80], r11
mov qword [rsp + 0x88], r11
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0xd0]
xor r9d, r9d
mov edx, 0x20006
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0xd0], r12
mov dword [rsp + 0xc8], r12d
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x60], 0x30
mov dword [rsp + 0x78], 0x240
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], r12
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
jns 0x1a508
xor bl, bl
jmp 0x1a54e
mov rcx, qword [rsp + 0xd0]
lea rax, [rsp + 0xc0]
lea rdx, [rsp + 0x40]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0xd0]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
setns bl
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1a563
mov edx, 0x70656472
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, bl
add rsp, 0x90
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret