joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002400
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x14002a380]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x20], 0
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
mov rdi, rax
lea rsi, [rcx + 0x60000]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov r8d, 0x18
lea rdx, [rsp + 0x30]
mov ecx, dword [rsp + 0x70]
call fcn.140001ae0
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
lea rcx, [0x140024320]
call sub.ntoskrnl.exe_DbgPrint
call fcn.140005190
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x28], rax
jb 0x1400024eb
mov rax, qword [rsp + 0x40]
add rax, 0xea60
cmp qword [rsp + 0x28], rax
ja 0x1400024eb
cmp qword [rsp + 0x80], 0
je 0x1400024cb
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
cmp qword [rsp + 0x88], 0
je 0x1400024e6
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
mov byte [rsp + 0x20], 1
mov rax, qword [rsp + 0x78]
add rax, 0x60000
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140021990
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x140002e10
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, [0x1400244f0]
call sub.ntoskrnl.exe_DbgPrint
mov byte [0x14002a618], 0
lea rcx, [0x140002cc0]
call fcn.140009030
cmp qword [0x14002a620], 0
je 0x140002e54
mov rcx, qword [0x14002a620]
call fcn.1400089d0
mov qword [0x14002a620], 0
mov dword [0x14002b680], 0
lea rcx, [0x140024510]
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x28
ret

Function at 0x140002fe0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
lea rcx, [0x140024660]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x20], 0xc0000001
movzx eax, byte [0x14002b684]
test eax, eax
je 0x140003017
mov dword [rsp + 0x20], 0
jmp 0x14000304f
call fcn.140001270
call fcn.140009050
call fcn.140008ea0
mov rcx, qword [rsp + 0x48]
call fcn.1400020e0
mov rcx, qword [rsp + 0x40]
call fcn.140004750
mov dword [rsp + 0x20], 0
mov byte [0x14002b684], 1
xor eax, eax
test eax, eax
jne 0x140003002
movzx eax, byte [0x14002b684]
test eax, eax
jne 0x14000305f
call fcn.1400030a0
movzx eax, byte [0x14002b684]
mov r8d, dword [rsp + 0x20]
mov edx, eax
lea rcx, [0x140024680]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x1400030a0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, [0x1400246b0]
call sub.ntoskrnl.exe_DbgPrint
movzx eax, byte [0x14002b685]
test eax, eax
je 0x1400030db
call fcn.140002e10
call fcn.140008fd0
call fcn.140009090
call fcn.140001570
call fcn.140004a60
mov byte [0x14002b684], 0
lea rcx, [0x1400246d0]
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x28
ret
Function at 0x140003100
Capabilities:
Print debug messages

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov edx, dword [rsp + 0x50]
lea rcx, [0x1400246f0]
call sub.ntoskrnl.exe_DbgPrint
mov byte [rsp + 0x20], 0
movzx eax, byte [0x14002b686]
test eax, eax
jne 0x14000312a
jmp 0x14000315d
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x50]
lea rdx, [rsp + 0x28]
mov ecx, eax
call fcn.14000a6b0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140003152
jmp 0x14000315d
mov byte [rsp + 0x20], 1
xor eax, eax
test eax, eax
jne 0x14000311d
movzx eax, byte [rsp + 0x20]
add rsp, 0x48
ret

Function at 0x140003170
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, [0x140024710]
call sub.ntoskrnl.exe_DbgPrint
movzx eax, byte [0x14002b686]
test eax, eax
je 0x140003197
lea rcx, [0x140024730]
call fcn.14000b060
add rsp, 0x28
ret

Function at 0x1400032d0
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0x68]
or eax, 0x20
mov rcx, qword [rsp + 0x48]
mov dword [rcx + 0x68], eax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.140002fe0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x70]
lea rdx, [0x1400031d0]
mov qword [rcx + rax + 0x70], rdx
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x70]
lea rdx, [0x1400031d0]
mov qword [rcx + rax + 0x70], rdx
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x70]
lea rdx, [0x140003210]
mov qword [rcx + rax + 0x70], rdx
mov eax, 8
imul rax, rax, 0x10
mov rcx, qword [rsp + 0x70]
lea rdx, [0x140003290]
mov qword [rcx + rax + 0x70], rdx
mov rax, qword [rsp + 0x70]
lea rcx, [0x140003240]
mov qword [rax + 0x68], rcx
lea rdx, [0x140024750]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [0x14002b688]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x22
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jl 0x1400033f3
mov rcx, qword [0x14002b688]
call qword [sym.imp.ntoskrnl.exe_IoRegisterShutdownNotification]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jl 0x1400033f3
mov byte [0x14002b690], 1
xor eax, eax
add rsp, 0x68
ret
Function at 0x140004a80
Capabilities:
Map section object

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x398
mov rax, qword [0x14002a380]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x54], 0xc0000001
mov rax, qword [rsp + 0x3b0]
cmp qword [rax], 0
je 0x140004adf
mov rax, qword [rsp + 0x3b0]
cmp qword [rax + 8], 0
jne 0x140004aec
mov dword [rsp + 0x50], 2
jmp 0x140004cd6
lea rax, [rsp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rax, [rsp + 0x170]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov qword [rsp + 0x80], rax
movzx r8d, byte [rsp + 0x58]
lea rdx, [0x140024780]
lea rcx, [rsp + 0x110]
call fcn.140003b80
mov rcx, rax
call fcn.140004dd0
mov qword [rsp + 0x78], rax
movzx r8d, byte [rsp + 0x59]
lea rdx, [0x140024350]
lea rcx, [rsp + 0xd0]
call fcn.140004140
mov rcx, rax
call fcn.140004d50
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x80]
mov r8, rax
mov edx, 0x103
lea rcx, [rsp + 0x170]
call fcn.140002d80
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x90], 0x30
mov qword [rsp + 0x98], 0
mov dword [rsp + 0xa8], 0x240
lea rax, [rsp + 0xc0]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
lea r8, [rsp + 0x90]
mov edx, 6
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwOpenSection]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jge 0x140004c22
mov dword [rsp + 0x50], 0x12
jmp 0x140004cd6
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], 0x100000
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jge 0x140004c94
mov dword [rsp + 0x50], 0x12
jmp 0x140004cd6
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x140004cb0
mov dword [rsp + 0x50], 0x12
jmp 0x140004cd6
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x3b0]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x50], 0
xor eax, eax
test eax, eax
jne 0x140004ac2
cmp qword [rsp + 0x60], 0
je 0x140004cf0
mov rdx, qword [rsp + 0x60]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
cmp qword [rsp + 0x68], 0
je 0x140004d03
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.140021990
add rsp, 0x398
pop rdi
pop rsi
ret
Function at 0x140004ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 4]
mov dword [rsp + 8], eax
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x18], rax
mov dword [rsp], 0
jmp 0x140004f19
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp], eax
jge 0x140004fc6
mov eax, dword [rsp + 4]
inc eax
movzx eax, al
mov dword [rsp + 4], eax
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x18]
movzx eax, byte [rcx + rax]
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0xc]
mov ecx, dword [rsp + 8]
add ecx, eax
mov eax, ecx
movzx eax, al
mov dword [rsp + 8], eax
movsxd rax, dword [rsp + 8]
mov rcx, qword [rsp + 0x18]
movzx eax, byte [rcx + rax]
mov dword [rsp + 0x10], eax
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x18]
movzx edx, byte [rsp + 0x10]
mov byte [rcx + rax], dl
movsxd rax, dword [rsp + 8]
mov rcx, qword [rsp + 0x18]
movzx edx, byte [rsp + 0xc]
mov byte [rcx + rax], dl
movsxd rax, dword [rsp]
mov ecx, dword [rsp + 0x10]
mov edx, dword [rsp + 0xc]
add edx, ecx
mov ecx, edx
movzx ecx, cl
mov rdx, qword [rsp + 0x18]
movzx ecx, byte [rdx + rcx]
mov rdx, qword [rsp + 0x38]
movzx eax, byte [rdx + rax]
xor eax, ecx
movsxd rcx, dword [rsp]
mov rdx, qword [rsp + 0x38]
mov byte [rdx + rcx], al
jmp 0x140004f11
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 4]
mov dword [rax], ecx
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 8]
mov dword [rax + 4], ecx
add rsp, 0x28
ret

Function at 0x1400051f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
movzx eax, byte [0x14002b6a1]
test eax, eax
je 0x140005208
jmp 0x1400052e2
mov dword [rsp + 0x10], 0xffffffff
lea rax, [rsp + 0x14]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
mov eax, 0x40000000
xor ecx, ecx
cpuid
lea rdi, [rsp + 0x10]
mov dword [rdi], eax
mov dword [rdi + 4], ebx
mov dword [rdi + 8], ecx
mov dword [rdi + 0xc], edx
lea rax, [rsp + 0x20]
lea rcx, [rsp + 0x14]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov byte [rsp], 0x4d
mov byte [rsp + 1], 0x69
mov byte [rsp + 2], 0x63
mov byte [rsp + 3], 0x72
mov byte [rsp + 4], 0x6f
mov byte [rsp + 5], 0x73
mov byte [rsp + 6], 0x6f
mov byte [rsp + 7], 0x66
mov byte [rsp + 8], 0x74
mov byte [rsp + 9], 0x20
mov byte [rsp + 0xa], 0x48
mov byte [rsp + 0xb], 0x76
mov byte [rsp + 0xc], 0
lea rax, [rsp + 0x20]
lea rcx, [rsp]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x1400052c1
inc rax
test dl, dl
jne 0x1400052ae
xor eax, eax
jmp 0x1400052c6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1400052d1
mov byte [0x14002b6a2], 1
mov byte [0x14002b6a1], 1
xor eax, eax
test eax, eax
jne 0x1400051f8
movzx eax, byte [0x14002b6a2]
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400053b0
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x28], 0xc0000001
mov qword [rsp + 0x30], 0
cmp qword [rsp + 0x68], 0
je 0x1400053e4
cmp qword [rsp + 0x70], 0
jne 0x1400053e9
jmp 0x14000557a
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x140005416
mov rax, qword [rsp + 0x60]
add rax, 0x500
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
jne 0x14000541b
jmp 0x14000557a
lea rdx, [rsp + 0x30]
mov ecx, 4
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
je 0x140005434
jmp 0x14000557a
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
jne 0x14000544b
jmp 0x14000557a
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
and rax, 0xfff
test rax, rax
jne 0x140005476
mov dword [rsp + 0x28], 0
jmp 0x14000557a
mov dword [rsp + 0x24], 0x200
jmp 0x14000548b
mov eax, dword [rsp + 0x24]
add eax, 4
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x500
jae 0x140005570
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x1400054d6
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x11]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
jne 0x1400054db
jmp 0x140005570
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x30]
cmp dword [rcx + rax], 0
je 0x1400054ec
jmp 0x140005480
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx + rax + 8]
and rax, 0xfff
cmp rax, 1
je 0x14000550b
jmp 0x140005480
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax + 0x10]
cmp eax, 1
je 0x140005523
jmp 0x140005480
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx + rax + 8]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x60]
movzx eax, byte [rcx + rax + 0x10]
mov byte [rsp + 0x20], al
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
movzx ecx, byte [rsp + 0x20]
mov byte [rax], cl
mov dword [rsp + 0x28], 0
jmp 0x140005570
xor eax, eax
test eax, eax
jne 0x1400053d4
cmp qword [rsp + 0x30], 0
je 0x14000558d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [rsp + 0x28]
add rsp, 0x58
ret
Function at 0x140007af0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
cmp qword [rsp + 0x80], 0
je 0x140007b78
cmp qword [rsp + 0x90], 0
je 0x140007b78
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x60]
add rsp, 0x70
pop rdi
ret

Function at 0x140007b90
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140007cd0
cmp dword [rsp + 0x30], 1
je 0x140007be1
cmp dword [rsp + 0x30], 2
je 0x140007c50
jmp 0x140007d12
mov rcx, qword [rsp + 0x90]
call fcn.140007d20
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jl 0x140007c4b
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0xe
mov r9d, 8
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jl 0x140007c4b
xor eax, eax
jmp 0x140007d17
jmp 0x140007d12
mov dword [rsp + 0x20], 5
mov r9d, 0x18
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x140007cce
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0xe
mov r9d, 8
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x140007cce
xor eax, eax
jmp 0x140007d17
jmp 0x140007d12
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0xe
mov r9d, 8
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x140007d12
xor eax, eax
jmp 0x140007d17
mov eax, 5
add rsp, 0x80
pop rdi
ret
Function at 0x140007d20
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov dword [rsp + 0x38], 0
lea rax, [rsp + 0x3c]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 0xe
mov r9d, 8
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x140007d8b
mov rax, qword [rsp + 0x38]
jmp 0x140007d92
mov rax, 0xffffffffffffffff
add rsp, 0x50
pop rdi
ret

Function at 0x140008670
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x4a8
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0xc0000001
mov eax, dword [rsp + 0x4d0]
mov qword [rsp + 0x50], rax
mov rdi, qword [rsp + 0x4c8]
xor eax, eax
mov rcx, qword [rsp + 0x50]
rep stosb byte [rdi], al
lea rdx, [0x140025cb0]
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x58], 0x30
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x70], 0x40
mov rax, qword [rsp + 0x4c0]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
lea r8, [rsp + 0x58]
mov edx, 0x80000000
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x14000872b
jmp 0x1400087ea
lea rax, [rsp + 0xa0]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0xa0]
mov r8d, 1
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140008787
jmp 0x1400087ea
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
mov ecx, dword [rsp + 0x4d0]
sub rcx, 2
cmp rax, rcx
jbe 0x1400087b6
mov dword [rsp + 0x30], 0xc0000023
jmp 0x1400087ea
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 8]
mov rdx, qword [rsp + 0x38]
add rdx, rcx
mov rcx, rdx
mov rdi, qword [rsp + 0x4c8]
mov rsi, rcx
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
xor eax, eax
test eax, eax
jne 0x140008699
cmp qword [rsp + 0x40], 0
je 0x1400087fd
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x30]
add rsp, 0x4a8
pop rdi
pop rsi
ret
Function at 0x140008ea0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
lea rcx, [0x140025cd0]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x20], 0xc0000001
movzx eax, byte [0x14002bee0]
test eax, eax
je 0x140008ecd
mov dword [rsp + 0x20], 0
jmp 0x140008efd
xor edx, edx
lea rcx, [0x140008f30]
call fcn.140006230
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x140008ee8
jmp 0x140008efd
mov dword [rsp + 0x20], 0
mov byte [0x14002bee0], 1
xor eax, eax
test eax, eax
jne 0x140008eb8
movzx eax, byte [0x14002bee0]
test eax, eax
jne 0x140008f0d
call fcn.140008fd0
movzx eax, byte [0x14002bee0]
mov r8d, dword [rsp + 0x20]
mov edx, eax
lea rcx, [0x140025cf0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x1400090d0
Capabilities:
Print debug messages

Disassembly:
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
cmp qword [rsp + 0x70], 0
jne 0x140009104
jmp 0x14000929d
cmp qword [rsp + 0x78], 0
je 0x14000911e
mov rax, qword [rsp + 0x70]
and rax, 0xfff
mov rcx, qword [rsp + 0x78]
mov dword [rcx], eax
mov r8d, 0x73676767
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14000914f
lea rcx, [0x140025d30]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000929d
mov rdi, qword [rsp + 0x20]
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
movabs rax, 0x7ffffffffffff000
mov rcx, qword [rsp + 0x70]
and rcx, rax
mov rax, rcx
mov edx, 0x1000
mov rcx, rax
call fcn.14000a5c0
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14000919d
lea rcx, [0x140025d50]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000929d
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400091d0
lea rcx, [0x140025d80]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000929d
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x70]
lea rcx, [0x140025db0]
call sub.ntoskrnl.exe_DbgPrint
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov ecx, 0x1000
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x38]
mov r8, qword [rcx + rax]
mov rdx, qword [0x140038698]
lea rcx, [0x140025df0]
call sub.ntoskrnl.exe_DbgPrint
movzx eax, byte [rsp + 0x80]
test eax, eax
je 0x140009248
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x38]
mov qword [rcx + rax], 0
mov rax, qword [rsp + 0x38]
mov rcx, qword [0x140038698]
lea rax, [rax + rcx*8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
shr rax, 0xc
and rax, 0xfffffff
shl rax, 0xc
mov rcx, qword [rsp + 0x40]
movabs rdx, 0xffffff0000000fff
mov rcx, qword [rcx]
and rcx, rdx
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
xor eax, eax
test eax, eax
jne 0x1400090f7
cmp qword [rsp + 0x28], 0
je 0x1400092af
mov rcx, qword [rsp + 0x28]
call fcn.14000ad90
mov rax, qword [rsp + 0x30]
add rsp, 0x58
pop rdi
pop rsi
ret