joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7fff25d4fb68
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
sub rsp, 0x6e0
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rbp + 0x680], rax
cmp dword [0x7fff25fd247c], 1
jne 0x7fff25d4fbc4
xor eax, eax
mov rcx, qword [rbp + 0x680]
xor rcx, rsp
call fcn.7fff25dce640
lea r11, [rsp + 0x6e0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
cmp dword [0x7fff25fd0294], 0x1000
jne 0x7fff25d4fb9d
xor edi, edi
mov dword [0x7fff25fd247c], 1
lea r8, [rbp + 8]
mov qword [rbp + 8], rdi
xor edx, edx
mov ecx, 0x2000000
call sym.KERNELBASE.dll_OpenGlobalizationUserSettingsKey
test eax, eax
js 0x7fff25d4fb9d
mov ecx, 0x200
mov word [rbp + 0x280], di
mov edx, ecx
lea rax, [rbp + 0x280]
cmp word [rax], di
je 0x7fff25d4fc18
add rax, 2
sub rdx, 1
jne 0x7fff25d4fc09
test rdx, rdx
je 0x7fff25ddc926
mov rax, rcx
sub rax, rdx
test rdx, rdx
je 0x7fff25ddc93f
lea rdx, [rbp + 0x280]
lea rdx, [rdx + rax*2]
sub rcx, rax
je 0x7fff25d4fc75
lea r8, [rax + 0x7ffffdfe]
add r8, rcx
lea rax, str.Control_PanelInternationalUser_Profile
sub rax, rdx
test r8, r8
je 0x7fff25d4fc75
movzx r9d, word [rax + rdx]
test r9w, r9w
je 0x7fff25d4fc75
mov word [rdx], r9w
dec r8
add rdx, 2
sub rcx, 1
jne 0x7fff25d4fc54
test rcx, rcx
lea rax, [rdx - 2]
cmovne rax, rdx
mov word [rax], di
je 0x7fff25ddc93f
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x18]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rax, qword [rbp + 8]
lea r8, [rbp + 0x28]
mov qword [rbp + 0x30], rax
lea rcx, [rbp]
lea rax, [rbp + 0x18]
mov dword [rbp + 0x28], 0x30
xorps xmm0, xmm0
mov qword [rbp + 0x38], rax
mov edx, 0x20019
mov dword [rbp + 0x40], 0x40
movdqu xmmword [rbp + 0x48], xmm0
mov dword [rbp + 0x14], edi
call qword [sym.imp.ntdll.dll_NtOpenKey]
nop dword [rax + rax]
mov rcx, qword [rbp + 8]
mov ebx, eax
test rcx, rcx
je 0x7fff25d4fcf9
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test ebx, ebx
js 0x7fff25d4fb9d
mov ebx, edi
xor edx, edx
mov rcx, qword [rbp]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x20], 0x20e
mov dword [rbp + 0x6c], edi
call qword [sym.imp.ntdll.dll_NtEnumerateKey]
nop dword [rax + rax]
cmp eax, 0x8000001a
je 0x7fff25d4fd5d
mov eax, dword [rbp + 0x6c]
lea rdx, [rbp + 0x70]
shr rax, 1
mov word [rbp + rax*2 + 0x70], di
mov rcx, qword [rbp]
call fcn.7fff25d4cd98
test eax, eax
jne 0x7fff25ddc92e
inc ebx
mov edx, ebx
jmp 0x7fff25d4fd05
mov rcx, qword [rbp]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov eax, 1
jmp 0x7fff25d4fb9f
mov rax, rdi
jmp 0x7fff25d4fc27
lea rdx, [rbp + 0x70]
mov ecx, eax
call 0x7fff25e16784
nop
jmp 0x7fff25d4fd57
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x7fff25d4fb9d
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
nop
jmp 0x7fff25d4fb9d
Function at 0x7fff25d505c4
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword gs:[0x60]
mov rdi, rcx
mov rbx, qword [rax + 0x20]
mov eax, dword [rbx + 0xa4]
bt eax, 9
jb 0x7fff25ddcac8
bt eax, 0xa
jb 0x7fff25ddcad7
mov rcx, qword [rcx + 8]
mov qword [rbx + 0x10], rcx
and qword [rsp + 0x70], 0
test rcx, rcx
je 0x7fff25d5064e
mov dword [rsp + 0x48], 8
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor r9d, r9d
and dword [rsp + 0x38], 0
lea rax, [rsp + 0x50]
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0x500023
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
nop dword [rax + rax]
test byte [rdi], 7
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [0x7fff25fd1000], xmm0
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [0x7fff25fd1010], xmm1
movsd xmm1, qword [rdi + 0x30]
movups xmmword [0x7fff25fd1020], xmm0
movsd qword [0x7fff25fd1030], xmm1
jne 0x7fff25d506c6
mov rax, qword [rsp + 0x70]
lea r8, [rsp + 0x78]
mov r9d, 8
or rax, 1
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x78], rax
lea edx, [r9 + 0x29]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
nop dword [rax + rax]
call fcn.7fff25d51b18
call fcn.7fff25d5125c
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x7fff25d506d8
test byte [rdi], 1
je 0x7fff25d506d8
mov qword [rbx + 0x20], rax
mov rax, qword [rdi + 0x20]
test rax, rax
jne 0x7fff25d506f5
mov rax, qword [rdi + 0x28]
test rax, rax
je 0x7fff25d50680
test byte [rdi], 4
je 0x7fff25d50680
mov qword [rbx + 0x30], rax
jmp 0x7fff25d50680
test byte [rdi], 2
je 0x7fff25d506e1
mov qword [rbx + 0x28], rax
jmp 0x7fff25d506e1
btr eax, 9
mov dword [rbx + 0xa4], eax
jmp 0x7fff25d505ee
btr eax, 0xa
mov dword [rbx + 0xa4], eax
jmp 0x7fff25d505f8
Function at 0x7fff25d518ac
Capabilities:
Access pe header
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
xorps xmm0, xmm0
lea rcx, [0x7fff25fd0fc0]
xor eax, eax
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x60]
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
mov rbx, qword [rax + 0x20]
movups xmmword [rbp - 0x20], xmm0
call qword [sym.imp.ntdll.dll_RtlInitializeCriticalSection]
nop dword [rax + rax]
xor edi, edi
test eax, eax
js 0x7fff25ddcf20
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
nop dword [rax + rax]
lea esi, [rdi + 1]
test rax, rax
je 0x7fff25d519d7
cmp word [rax + 0x5c], 3
mov al, sil
jne 0x7fff25d519d7
mov byte [0x7fff25fd0fa8], al
call fcn.7fff25d51b18
call fcn.7fff25d51a78
cmp dword [rbx + 0x408], edi
je 0x7fff25d51a39
cmp byte [0x7fff25fd0fa8], dil
je 0x7fff25d519df
test byte [rbx + 0x18], 4
jne 0x7fff25ddcea2
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x7fff25d51a50
cmp rdx, 0xfffffffffffffffc
ja 0x7fff25d51a66
xor r9d, r9d
mov word [rsp + 0x20], di
xor r8d, r8d
lea rcx, [rbp + 0x28]
call fcn.7fff25d52548
test eax, eax
js 0x7fff25ddcec3
mov rax, qword [rbp + 0x28]
movzx ecx, byte [rbp - 0x10]
test rax, rax
mov rdx, qword [rbx + 0x10]
cmovne ecx, esi
mov qword [rbp - 0x38], rax
test byte [rbx + 0x18], 2
mov byte [rbp - 0x10], cl
mov qword [rbp - 0x30], rdx
jne 0x7fff25ddcef3
lea rcx, [rbp - 0x40]
call fcn.7fff25d505c4
mov al, sil
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
mov al, dil
jmp 0x7fff25d5192d
mov eax, dword [rbx + 0xa4]
mov qword [rbx + 0x10], rdi
bt eax, 9
jb 0x7fff25d519fe
lea rcx, [rbx + 0x20]
call fcn.7fff25d524d8
mov eax, dword [rbx + 0xa4]
bt eax, 0xa
jb 0x7fff25d51a0d
lea rcx, [rbx + 0x28]
call fcn.7fff25d524d8
lea rcx, [rbx + 0x30]
call fcn.7fff25d524d8
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [0x7fff25fd1000], xmm0
mov qword [0x7fff25fd1030], rcx
movups xmmword [0x7fff25fd1010], xmm0
movups xmmword [0x7fff25fd1020], xmm0
jmp 0x7fff25d519c3
mov rax, qword gs:[0x30]
mov ecx, dword [rax + 0x40]
mov dword [rbx + 0x408], ecx
jmp 0x7fff25d51949
lea rcx, [rbp - 0x40]
call fcn.7fff25d4f86c
test eax, eax
jns 0x7fff25d519ba
jmp 0x7fff25ddcf0d
cmp rdx, 0xfffffffffffffffe
ja 0x7fff25d519ba
jmp 0x7fff25d51a50
lea rcx, [rbx + 0x20]
call fcn.7fff25d524d8
lea rcx, [rbx + 0x28]
call fcn.7fff25d524d8
lea rcx, [rbx + 0x30]
call fcn.7fff25d524d8
nop
jmp 0x7fff25d51960
cmp eax, 0xc0000022
jne 0x7fff25ddcf0d
lea rcx, [rbp + 0x20]
call 0x7fff25e40dd8
test eax, eax
js 0x7fff25ddcf0d
cmp byte [rbp + 0x20], dil
je 0x7fff25ddcf0d
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
nop
jmp 0x7fff25d51a50
lea rcx, [rbp - 0x40]
call fcn.7fff25dcc094
test eax, eax
jns 0x7fff25d519ba
lea rcx, [rbp - 0x40]
call 0x7fff25e40d48
lea rcx, [0x7fff25fd0fc0]
call qword [sym.imp.ntdll.dll_RtlDeleteCriticalSection]
nop dword [rax + rax]
xor al, al
jmp 0x7fff25d519c6
Function at 0x7fff25d51a78
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
cmp byte [0x7fff25fd2500], dil
jne 0x7fff25d51aef
mov rax, qword gs:[0x60]
mov ebp, 0x200
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
cmp word [rdx + 0x58], bp
jae 0x7fff25d51b05
movzx ebx, word [rdx + 0x58]
shr bx, 1
movzx r8d, word [rdx + 0x58]
lea rsi, [0x7fff25fd1040]
mov rdx, qword [rdx + 0x60]
mov rcx, rsi
mov word [0x7fff25fd1038], bx
call sub.ntdll.dll_memcpy
movzx eax, bx
add rax, rax
cmp rax, rbp
jae 0x7fff25d51b0c
mov word [rax + rsi], di
mov byte [0x7fff25fd2500], 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ebx, 0xff
jmp 0x7fff25d51aba
call fcn.7fff25dce7e0
int3

Function at 0x7fff25d51e84
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov ebx, ecx
mov rsi, rdx
mov rcx, qword gs:[0x60]
mov edx, 8
mov r14, r8
mov rdi, r9
mov rcx, qword [rcx + 0x30]
lea r8d, [rdx + 0x48]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor r8d, r8d
mov r10, rax
test rax, rax
je 0x7fff25ddd005
mov dword [rax], ebx
test rdi, rdi
jne 0x7fff25ddcfe6
cmp ebx, 0x4af
jbe 0x7fff25d51f06
lea eax, [rbx - 0x2ee2]
cmp eax, 0xbb7d
jbe 0x7fff25d51f06
lea eax, [rbx - 0x4b2]
cmp eax, 0x2a2d
ja 0x7fff25ddcff8
movzx edx, word [rsi]
lea rax, [rsi + 2]
lea rcx, [rdx + 1]
add dx, word [rsi + rdx*2]
mov qword [r10 + 0x10], rax
lea rax, [rsi + rcx*2]
mov qword [r10 + 0x18], rax
lea rcx, [rax + 0x202]
cmp word [rax + 0x200], r8w
je 0x7fff25d51f3d
mov qword [r10 + 0x20], rcx
add rcx, 0x200
mov qword [r10 + 0x28], rcx
cmp word [rcx], r8w
ja 0x7fff25d51f71
movzx ecx, dx
inc rcx
lea rcx, [rsi + rcx*2]
mov qword [r10 + 0x38], rcx
mov qword [r14], r10
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
lea rax, [rcx + 2]
mov qword [r10 + 0x30], rax
jmp 0x7fff25d51f47
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x40], rcx
mov qword [rax + 8], rdi
jmp 0x7fff25d51f55
mov qword [r10 + 0x10], r8
mov qword [r10 + 8], r8
jmp 0x7fff25d51f55
mov eax, 0xe
jmp 0x7fff25d51f5a
Function at 0x7fff25d522f8
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword gs:[0x60]
cmp qword [0x7fff25fd0e28], 0
mov rcx, qword [rax + 0x30]
mov qword [0x7fff25fd0e30], rcx
jne 0x7fff25d52344
xor r9d, r9d
lea rdx, [rsp + 0x50]
lea r8d, [r9 + 8]
lea ecx, [r9 + 0x32]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov rax, qword [rsp + 0x50]
mov qword [0x7fff25fd0e28], rax
lea rbx, [0x7fff25fd0e40]
mov edx, 0x10
mov r8, rbx
mov ecx, 0xffff
call qword [sym.imp.ntdll.dll_RtlInitializeHandleTable]
nop dword [rax + rax]
mov rax, qword [0x7fff25fd0e30]
mov qword [rsp + 0x20], rax
mov rax, qword [0x7fff25fd0e28]
mov qword [rsp + 0x28], rbx
movups xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movsd xmm1, qword [rsp + 0x30]
movsd qword [0x7fff25fd0cd0], xmm1
movups xmmword [0x7fff25fd0cc0], xmm0
add rsp, 0x40
pop rbx
ret
Function at 0x7fff25d533f0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rax, qword [0x7fff25fd0dd0]
mov rdi, rcx
mov edx, dword [rax + 0x9c8]
cmp edx, 0xffffffff
je 0x7fff25d53432
lea rcx, [rsp + 0x30]
call 0x7fff25e49ea4
mov ebx, eax
jmp 0x7fff25d5346b
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov r8d, 0xac
lea ecx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
jns 0x7fff25d5345d
mov ecx, eax
call fcn.7fff25d6b370
jmp 0x7fff25d53470
lea rdx, [rsp + 0x20]
call fcn.7fff25dd689c
mov ebx, dword [rsp + 0x20]
cmp ebx, 0xffffffff
jne 0x7fff25d53475
or eax, 0xffffffff
jmp 0x7fff25d53496
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.7fff25d532d0
lea r8, [rdi + 0x58]
lea rdx, [rdi + 4]
lea rcx, [rsp + 0x30]
call fcn.7fff25d54bb0
mov eax, ebx
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.7fff25dce640
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rdi
ret

Function at 0x7fff25d53c38
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov rax, qword [0x7fff25fd0dd0]
mov edx, dword [rax + 0x9c8]
cmp edx, 0xffffffff
je 0x7fff25d53c57
add rsp, 0x28
jmp 0x7fff25e49de4
xor r9d, r9d
mov rdx, rcx
mov r8d, 0x1b0
lea ecx, [r9 + 0x66]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
jns 0x7fff25d53c83
mov ecx, eax
call fcn.7fff25d6b370
or eax, 0xffffffff
jmp 0x7fff25d53c91
lea rdx, [rsp + 0x38]
call fcn.7fff25dd689c
mov eax, dword [rsp + 0x38]
add rsp, 0x28
ret

Function at 0x7fff25d55d90
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test cl, 3
jne 0x7fff25d55dd1
call qword [sym.imp.ntdll.dll_LdrUnloadDll]
nop dword [rax + rax]
test eax, eax
js 0x7fff25d55e5f
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rsi, rbx
and rsi, 0xfffffffffffffffc
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
nop dword [rax + rax]
test rax, rax
je 0x7fff25dddeb8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrRemoveLoadAsDataTable]
nop dword [rax + rax]
mov rcx, rbx
call fcn.7fff25d55e74
mov rcx, rbx
call qword [sym.imp.ntdll.dll_LdrUnloadAlternateResourceModule]
nop dword [rax + rax]
mov rdi, qword gs:[0x30]
mov ecx, 0x80
mov rdx, rsi
movzx ebx, word [rdi + 0x17ee]
movzx eax, bx
or ax, cx
or rcx, 0xffffffffffffffff
mov word [rdi + 0x17ee], ax
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
nop dword [rax + rax]
mov word [rdi + 0x17ee], bx
jmp 0x7fff25d55db3
mov ecx, eax
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25d55dc0
mov eax, 0xc000007b
jmp 0x7fff25d55db3
Function at 0x7fff25d56024
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
and qword [rsp + 0x30], 0
mov rdi, rcx
lea rcx, [rbp - 0x80]
xor edx, edx
mov r8d, 0x214
call sub.ntdll.dll_memset
test rdi, rdi
je 0x7fff25dddf44
lea rdx, str.RegistryMachineSYSTEMCurrentControlSetControlMUIStringCacheSettings
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x40]
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x50]
mov dword [rsp + 0x50], 0x30
mov edx, 1
mov dword [rsp + 0x68], 0x40
lea rcx, [rsp + 0x30]
movdqu xmmword [rsp + 0x70], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25d5614e
lea rdx, str.StringCacheGeneration
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x80]
mov r8d, 1
mov dword [rsp + 0x20], 0x214
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25d56181
cmp dword [rbp - 0x7c], 4
jne 0x7fff25d56181
test ebx, ebx
js 0x7fff25d56137
mov eax, dword [rbp - 0x78]
mov ecx, dword [rbp + rax - 0x80]
mov dword [rdi], ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
and qword [rsp + 0x30], 0
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.7fff25dce640
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov ebx, 0xc000014c
jmp 0x7fff25d5612a
mov eax, 0x57
jmp 0x7fff25d5615c
Function at 0x7fff25d57924
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edx, edx
mov rcx, qword gs:[0x60]
lea r8d, [rdx + 0x10]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x7fff25d579f2
and qword [rax], 0
and dword [rax + 8], 0
mov byte [rax + 0xc], 0
mov rbx, rdi
test rdi, rdi
je 0x7fff25dde846
mov rax, qword [r14]
mov rcx, rdi
mov r8, qword [r14 + 8]
mov r9d, dword [rax + 8]
mov rdx, qword [rax]
mov rax, qword [r14 + 0x10]
mov r8, qword [r8]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
call fcn.7fff25d57d4c
mov esi, 0x800710d8
mov ebp, eax
cmp eax, esi
je 0x7fff25dde876
test eax, eax
js 0x7fff25dde883
mov rax, qword [r14 + 0x18]
xor ebx, ebx
xor esi, esi
mov rcx, qword [rax]
mov qword [rcx], rdi
test rbx, rbx
jne 0x7fff25dde8af
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
xor edi, edi
jmp 0x7fff25d57977
mov rcx, qword [rsp + 0x38]
lea rax, [0x7fff25f9ee04]
mov esi, 0x8007000e
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, str.onecore_base_appmodel_statemanager_apisetlib_statecontainer.cpp
mov edx, 0x6d
call fcn.7fff25d8291c
nop
jmp 0x7fff25d579cb
mov rcx, qword [r14 + 0x10]
cmp dword [rcx], 2
je 0x7fff25d579cb
mov rcx, qword [rsp + 0x38]
lea rax, [0x7fff25fa1568]
mov r9d, ebp
mov qword [rsp + 0x20], rax
lea r8, str.onecore_base_appmodel_statemanager_apisetlib_statecontainer.cpp
mov edx, 0x79
call fcn.7fff25d8291c
mov esi, ebp
jmp 0x7fff25d579cb
mov rcx, rbx
call fcn.7fff25e24484
nop
jmp 0x7fff25d579d4
Function at 0x7fff25d6aa50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x60
mov rbx, r9
mov r11, rdx
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r10d, r10d
test r9, r9
je 0x7fff25d6aa80
mov dword [r9], r10d
cmp ecx, 0xfffffff4
jae 0x7fff25d6abaa
mov rsi, qword [rsp + 0x90]
mov qword [rsp + 0x40], r10
mov rcx, rdi
test rsi, rsi
jne 0x7fff25d6ab04
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x28], r11
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWriteFile]
nop dword [rax + rax]
mov ecx, eax
cmp eax, 0x103
je 0x7fff25de53d0
test ecx, ecx
js 0x7fff25d6ab97
test rbx, rbx
je 0x7fff25d6aaeb
mov eax, dword [rsp + 0x58]
mov dword [rbx], eax
mov eax, 1
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov qword [rsi], 0x103
mov eax, dword [rsi + 0x10]
mov dword [rsp + 0x70], eax
mov eax, dword [rsi + 0x14]
mov dword [rsp + 0x74], eax
mov rdx, qword [rsi + 0x18]
test dl, 1
mov r9, r10
cmove r9, rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtWriteFile]
nop dword [rax + rax]
mov ecx, eax
and ecx, 0xc0000000
cmp eax, 0x103
jne 0x7fff25d6ab69
mov ecx, eax
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25d6aaf0
cmp ecx, 0xc0000000
je 0x7fff25d6ab5e
test rbx, rbx
je 0x7fff25d6aaeb
mov eax, dword [rsi + 8]
mov dword [rbx], eax
jmp 0x7fff25d6aaeb
mov eax, ecx
and eax, 0xc0000000
cmp eax, 0x80000000
jne 0x7fff25d6ab60
jmp 0x7fff25de53f2
je 0x7fff25de53ba
cmp ecx, 0xfffffff5
je 0x7fff25de53a4
cmp ecx, 0xfffffff6
jne 0x7fff25d6aa89
jmp 0x7fff25de538e
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x20]
mov rdi, qword [rcx + 0x20]
jmp 0x7fff25d6aa89
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x20]
mov rdi, qword [rcx + 0x28]
jmp 0x7fff25d6aa89
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x20]
mov rdi, qword [rcx + 0x30]
jmp 0x7fff25d6aa89
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
cmovns ecx, dword [rsp + 0x50]
jmp 0x7fff25d6aad8
test rbx, rbx
je 0x7fff25d6ab60
mov eax, dword [rsp + 0x58]
mov dword [rbx], eax
jmp 0x7fff25d6ab60
Function at 0x7fff25d6aeb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rsi
push rdi
push r14
sub rsp, 0x60
mov rbx, r9
mov r10, rdx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor edi, edi
test r9, r9
je 0x7fff25d6aedd
mov dword [r9], edi
cmp ecx, 0xfffffff4
jae 0x7fff25de5474
mov r14, qword [rsp + 0xa0]
mov qword [rsp + 0x40], rdi
mov rcx, rsi
test r14, r14
jne 0x7fff25d6af5f
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x28], r10
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_NtReadFile]
nop dword [rax + rax]
mov ecx, eax
cmp eax, 0x103
je 0x7fff25de54c6
test ecx, ecx
js 0x7fff25d6aff8
test rbx, rbx
je 0x7fff25d6af48
mov eax, dword [rsp + 0x58]
mov dword [rbx], eax
mov eax, 1
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
mov qword [r14], 0x103
mov eax, dword [r14 + 0x10]
mov dword [rsp + 0x80], eax
mov eax, dword [r14 + 0x14]
mov dword [rsp + 0x84], eax
mov rdx, qword [r14 + 0x18]
test dl, 1
mov r9, rdi
cmove r9, r14
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r14
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtReadFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25d6afe3
cmp eax, 0x103
je 0x7fff25d6afe3
test rbx, rbx
je 0x7fff25d6af48
mov eax, dword [r14 + 8]
mov dword [rbx], eax
jmp 0x7fff25d6af48
cmp eax, 0xc0000011
je 0x7fff25d6b023
mov ecx, eax
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25d6af4d
cmp ecx, 0xc0000011
jne 0x7fff25d6b010
test rbx, rbx
je 0x7fff25d6af48
mov dword [rbx], edi
jmp 0x7fff25d6af48
mov eax, ecx
and eax, 0xc0000000
cmp eax, 0x80000000
jne 0x7fff25d6afec
jmp 0x7fff25de54e8
test rbx, rbx
je 0x7fff25d6b02a
mov dword [rbx], edi
mov ecx, 0xc0000011
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25d6af4d
je 0x7fff25de54b0
cmp ecx, 0xfffffff5
je 0x7fff25de549a
cmp ecx, 0xfffffff6
jne 0x7fff25d6aee6
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x20]
mov rsi, qword [rcx + 0x20]
jmp 0x7fff25d6aee6
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x20]
mov rsi, qword [rcx + 0x28]
jmp 0x7fff25d6aee6
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x20]
mov rsi, qword [rcx + 0x30]
jmp 0x7fff25d6aee6
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
cmovns ecx, dword [rsp + 0x50]
jmp 0x7fff25d6af35
test rbx, rbx
je 0x7fff25d6afec
mov eax, dword [rsp + 0x58]
mov dword [rbx], eax
jmp 0x7fff25d6afec