joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7fff25d72f20
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb0
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rsi, qword [rbp + 0x7f]
mov rax, rcx
mov r14, r9
mov dword [rbp - 0x61], 0x5c
mov rbx, r8
lea rcx, [rbp - 0x61]
mov r15, rdx
xor r12d, r12d
test rax, rax
lea rdx, [rbp - 0x51]
cmovne rcx, rax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
nop dword [rax + rax]
test al, al
je 0x7fff25de7a72
mov rdi, qword [rbp - 0x49]
lea rax, [rbp - 0x51]
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x800021
lea r9, [rbp - 0x41]
mov qword [rbp - 0x21], rax
lea r8, [rbp - 0x31]
mov dword [rbp - 0x31], 0x30
mov edx, 0x100000
mov qword [rbp - 0x29], r12
lea rcx, [rbp - 0x59]
mov dword [rbp - 0x19], 0x40
movdqu xmmword [rbp - 0x11], xmm0
mov dword [rsp + 0x20], 3
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25d730d4
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x59]
lea r9d, [r12 + 0x18]
lea r8, [rbp - 1]
mov dword [rsp + 0x20], 3
lea rdx, [rbp - 0x41]
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x59]
mov edi, eax
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test edi, edi
js 0x7fff25de7a89
mov rax, qword gs:[0x60]
mov r10d, dword [rbp - 1]
mov edi, dword [rbp + 7]
mov r9d, dword [rbp + 0xf]
mov r11d, dword [rax + 0x2c8]
or eax, 0xffffffff
and r11d, 8
cmp dword [rbp + 3], r12d
cmovne r10d, eax
cmp dword [rbp + 0xb], r12d
cmovne edi, eax
test r15, r15
je 0x7fff25d73079
mov dword [r15], r9d
mov r8d, dword [rbp + 0x13]
test rbx, rbx
je 0x7fff25d73085
mov dword [rbx], r8d
or r15, 0xffffffffffffffff
mov ebx, 0x7fffffff
test r14, r14
je 0x7fff25d7309f
test r11, r11
jne 0x7fff25de7a96
mov dword [r14], edi
test rsi, rsi
je 0x7fff25d730b0
test r11, r11
jne 0x7fff25de7ac4
mov dword [rsi], r10d
mov eax, 1
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0xb0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, eax
call fcn.7fff25d6b370
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test rbx, rbx
je 0x7fff25d73101
mov dword [rbx], r12d
xor eax, eax
jmp 0x7fff25d730b5
mov ecx, 3
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
nop
jmp 0x7fff25d73101
mov ecx, edi
call fcn.7fff25d6b370
nop
jmp 0x7fff25d73101
xor edx, edx
mov rax, r15
div r8
cmp r9, rax
ja 0x7fff25d7309c
xor edx, edx
mov ecx, r8d
imul ecx, r9d
mov eax, ebx
div ecx
cmp eax, edi
jae 0x7fff25d7309c
mov dword [r14], eax
jmp 0x7fff25d7309f
xor edx, edx
mov rax, r15
div r8
cmp r9, rax
ja 0x7fff25d730ad
imul r8d, r9d
xor edx, edx
mov eax, ebx
div r8d
cmp eax, r10d
jae 0x7fff25d730ad
mov dword [rsi], eax
jmp 0x7fff25d730b0
Function at 0x7fff25d73b1c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rbx, qword [rsp + 0x88]
xor r15d, r15d
mov edi, r9d
mov r14, r8
mov rbp, rcx
mov esi, r15d
test rbx, rbx
jne 0x7fff25d73c22
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rcx, qword [r14]
mov r8, rdi
xor edx, edx
call sub.ntdll.dll_memset
mov r9, qword [r14]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov r8d, 1
mov dword [rsp + 0x20], edi
mov rcx, rbp
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
mov edi, eax
cmp eax, 0x80000005
je 0x7fff25d73c2a
mov rcx, qword [r14]
mov r8d, 0xc000014c
mov eax, dword [rcx + 4]
cmp eax, dword [rsp + 0x80]
cmovne edi, r8d
test edi, edi
js 0x7fff25d73c15
cmp eax, 1
jne 0x7fff25d73bf5
test byte [rcx + 0xc], al
jne 0x7fff25de7dec
cmp dword [rcx + 0xc], 2
jb 0x7fff25de7dec
mov edx, dword [rcx + 0xc]
mov eax, dword [rcx + 8]
shr rdx, 1
add rcx, rax
cmp word [rcx + rdx*2 - 2], r15w
jne 0x7fff25de7dec
test edi, edi
js 0x7fff25d73c15
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
test rbx, rbx
jne 0x7fff25d73cb0
mov eax, edi
jmp 0x7fff25d73bfb
mov dword [rbx], r15d
jmp 0x7fff25d73b54
test rbx, rbx
je 0x7fff25d73baa
mov rcx, qword gs:[0x60]
mov edx, 8
mov r8d, dword [rsp + 0x78]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x7fff25de7de2
mov r8d, dword [rsp + 0x78]
xor edx, edx
mov rcx, rax
mov qword [r14], rax
call sub.ntdll.dll_memset
mov r9, qword [r14]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
mov eax, dword [rsp + 0x78]
mov r8d, 1
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
mov edi, eax
mov dword [rbx], 1
jmp 0x7fff25d73baa
cmp dword [rbx], r15d
je 0x7fff25d73c1e
jmp 0x7fff25de7df4
mov eax, 0xc0000017
jmp 0x7fff25d73bfb
mov edi, r8d
jmp 0x7fff25d73bf5
test rsi, rsi
je 0x7fff25de7e17
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov dword [rbx], r15d
jmp 0x7fff25d73c1e

Function at 0x7fff25d74d50
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rbx, rcx
xor ecx, ecx
lea r8d, [r9 + 0x40]
call qword [sym.imp.ntdll.dll_RtlGetNativeSystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x7fff25d74dbb
xor r9d, r9d
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0xc]
lea ecx, [r9 + 1]
call qword [sym.imp.ntdll.dll_RtlGetNativeSystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x7fff25d74dbb
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.7fff25d74e68
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0x80
pop rbx
ret
Function at 0x7fff25d74de0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rbx, rcx
xor ecx, ecx
lea r8d, [r9 + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x7fff25d74e4b
xor r9d, r9d
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0xc]
lea ecx, [r9 + 1]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x7fff25d74e4b
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.7fff25d74e68
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0x80
pop rbx
ret

Function at 0x7fff25d74e68
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
xorps xmm0, xmm0
xor edi, edi
movups xmmword [r8], xmm0
mov rbx, r8
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
movzx eax, word [rdx]
mov word [r8], ax
mov eax, dword [rcx + 8]
mov dword [r8 + 4], eax
mov rax, qword [rcx + 0x20]
mov qword [r8 + 8], rax
mov rax, qword [rcx + 0x28]
mov qword [r8 + 0x10], rax
mov rax, qword [rcx + 0x30]
mov qword [r8 + 0x18], rax
movsx eax, byte [rcx + 0x38]
mov dword [r8 + 0x20], eax
movzx eax, word [rdx + 2]
mov word [r8 + 0x2c], ax
movzx eax, word [rdx + 4]
mov word [r8 + 0x2e], ax
cmp word [rdx], di
je 0x7fff25de8640
cmp word [rdx], 9
mov eax, edi
mov r8d, 0x21d8
cmove eax, r8d
mov dword [rbx + 0x24], eax
mov eax, dword [rcx + 0x18]
mov dword [rbx + 0x28], eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x20]
cmp dword [rcx + 8], edi
jl 0x7fff25d74f32
mov r9d, 0x40
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x30]
or rcx, 0xffffffffffffffff
lea edx, [r9 - 0x1b]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
nop dword [rax + rax]
test eax, eax
js 0x7fff25de8667
cmp dword [rsp + 0x54], 0x30033
jb 0x7fff25d74f41
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
mov dword [rbx + 0x2c], edi
jmp 0x7fff25d74f32
insb byte [rdi], dx
add byte [rax], al
add byte [rbp + rax*2 + 0x4d], dl
push rax
fadd qword [rdx]
add byte [rax], al
add eax, 0x5000000
add byte [rax], al
add byte [rbp + rbx*4], ah
add byte [rcx], al
add byte [rax], al
add byte [rdx], bh
ficom word [rbp + 0x4a7d418c]
push rbx
and bl, al
mov dword [rbx], ecx
js 0x7fff25de867f
or edi, dword [rax + 0x15]
push rdi
pop rsp
sgdt [rcx]
add byte [rcx], al
invalid
add byte gs:[rsi], ch
je 0x7fff25de8685
add byte [rcx], r12b
je 0x7fff25de868b
invalid
Function at 0x7fff25d75208
Capabilities:
Delete registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r12d, r12d
mov rbx, rdx
mov qword [rax + 0x18], r12
mov r14, rcx
mov qword [rax + 0x10], r12
mov edi, r12d
mov esi, r12d
lea r13d, [r12 + 2]
test rdx, rdx
je 0x7fff25d752d1
movzx eax, word [rdx]
cmp ax, r13w
jb 0x7fff25d752d1
test al, 1
jne 0x7fff25d752d1
cmp qword [rdx + 8], r12
je 0x7fff25d752d1
sub ax, r13w
mov rbp, r14
mov word [rdx], ax
call fcn.7fff25dd0fbc
test al, al
je 0x7fff25d7527f
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ext_ms_win_kernel32_registry_l1_1_0.dll_TermsrvDeleteValue]
nop dword [rax + rax]
mov r15d, r14d
and r15d, r13d
jne 0x7fff25d752f2
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.ntdll.dll_NtDeleteValueKey]
nop dword [rax + rax]
mov ebp, eax
test r15d, r15d
jne 0x7fff25d75333
test rdi, rdi
jne 0x7fff25de8719
mov ecx, ebp
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp qword [rdx + 8], r12
jne 0x7fff25d752eb
cmp word [rdx], r13w
jne 0x7fff25d752eb
mov eax, r13d
cmp word [rdx + 2], r12w
je 0x7fff25d7525a
mov eax, 0x57
jmp 0x7fff25d752bb
lea rax, [rsp + 0x80]
mov r8d, 0x2000000
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov rdx, r14
xor ecx, ecx
call fcn.7fff25da7558
test eax, eax
js 0x7fff25d75343
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
test rdi, rdi
je 0x7fff25d75287
jmp 0x7fff25de86e2
cmp eax, 0xc0000034
jne 0x7fff25d752a4
jmp 0x7fff25de86ee
mov ecx, eax
jmp 0x7fff25d752af
invalid
add byte [rcx], ah
je 0x7fff25de86f3
invalid
add al, 0x41
invalid
Function at 0x7fff25d7b2fc
Capabilities:
Map section object

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
and qword [rax - 0x58], 0
mov rbx, r9
xor r9d, r9d
mov dword [rax - 0x60], 0x8000080
mov r14, r8
mov dword [rax - 0x68], 3
mov r15, rdx
mov r12, rcx
mov edx, 0x80000000
lea r8d, [r9 + 1]
call sym.KERNELBASE.dll_CreateFileW
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x7fff25d7b448
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x20]
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000000
xor r8d, r8d
mov dword [rsp + 0x20], 2
lea edx, [r9 + 4]
call qword [sym.imp.ntdll.dll_NtCreateSection]
nop dword [rax + rax]
mov rcx, rsi
mov edi, eax
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test edi, edi
js 0x7fff25deb402
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
and qword [rbp - 0x18], 0
mov eax, 2
and qword [rbp - 0x10], 0
or rsi, 0xffffffffffffffff
mov dword [rsp + 0x48], eax
xor r9d, r9d
and dword [rsp + 0x40], 0
mov rdx, rsi
mov dword [rsp + 0x38], eax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x7fff25deb3f2
test rbx, rbx
je 0x7fff25d7b45b
mov r8, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
call fcn.7fff25d7b47c
mov edi, eax
test eax, eax
js 0x7fff25deb416
mov qword [r14], rcx
mov qword [r15], rdx
test rbx, rbx
je 0x7fff25d7b427
mov qword [rbx], r8
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call sym.KERNELBASE.dll_GetLastError
test eax, eax
jle 0x7fff25d7b429
movzx eax, ax
or eax, 0x80070000
jmp 0x7fff25d7b429
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor r8d, r8d
mov qword [rbp - 0x20], r8
jmp 0x7fff25d7b402
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
nop dword [rax + rax]
nop
jmp 0x7fff25d7b44d
mov qword [rsp + 0x28], rcx
mov r8, rdx
mov edx, edi
mov dword [rsp + 0x20], 0x38495241
mov rcx, r12
xor r9d, r9d
call fcn.7fff25e2bc80
mov rdx, qword [rbp - 0x18]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x7fff25deb45b
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov eax, edi
jmp 0x7fff25d7b429
Function at 0x7fff25d7bdec
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor ebp, ebp
mov qword [rsp + 0x58], rbp
xor edx, edx
mov rcx, qword gs:[0x60]
lea r8d, [rbp + 0x10]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x7fff25deb8a0
mov qword [rax], rbp
mov dword [rax + 8], ebp
mov byte [rax + 0xc], bpl
mov rbx, rdi
test rdi, rdi
je 0x7fff25deb8a8
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.7fff25d7bf00
mov rax, qword [r14 + 8]
lea r8, [rsp + 0x58]
mov rcx, qword [r14]
mov edx, dword [rax]
call fcn.7fff25d7bf48
mov esi, eax
test eax, eax
js 0x7fff25deb8bb
mov rax, qword [r14 + 0x18]
xor r9d, r9d
mov r8, qword [r14 + 0x10]
mov rcx, rdi
mov rdx, qword [rsp + 0x58]
mov eax, dword [rax]
mov r8, qword [r8]
mov dword [rsp + 0x20], eax
call fcn.7fff25d57d4c
mov esi, eax
test eax, eax
js 0x7fff25deb8c9
mov rax, qword [r14 + 0x10]
mov rcx, qword [rax]
test rcx, rcx
jne 0x7fff25d7bef0
mov qword [rsp + 0x58], rbp
mov rax, qword [r14 + 0x20]
mov rbx, rbp
mov esi, ebp
mov rcx, qword [rax]
mov qword [rcx], rdi
mov rdi, rbp
test rdi, rdi
jne 0x7fff25deb8f4
mov rcx, qword [rsp + 0x58]
test rcx, rcx
jne 0x7fff25d7bee9
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
call sym.KERNELBASE.dll_RegCloseKey
jmp 0x7fff25d7bed3
cmp word [rcx], bp
jne 0x7fff25d7beae
jmp 0x7fff25d7bea9
mov rdi, rbp
jmp 0x7fff25d7be3d
lea rax, [0x7fff25f9ee04]
mov esi, 0x8007000e
mov edx, 0x3d
jmp 0x7fff25deb8d5
lea rax, [0x7fff25fa1548]
mov edx, 0x40
jmp 0x7fff25deb8d5
lea rax, [0x7fff25fa1568]
mov edx, 0x48
mov rcx, qword [rsp + 0x48]
lea r8, str.onecore_base_appmodel_statemanager_apisetlib_statecontainer.cpp
mov r9d, esi
mov qword [rsp + 0x20], rax
call fcn.7fff25d8291c
nop
jmp 0x7fff25d7bec0
mov rcx, rbx
call fcn.7fff25e24484
nop
jmp 0x7fff25d7bec9

Function at 0x7fff25d7c624
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov rdi, rcx
mov ecx, 0xa4
movups xmmword [rsp + 0x20], xmm0
lea r8d, [r9 + 0x20]
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov ebx, eax
or ebx, 0x10000000
jl 0x7fff25debc62
test dword [rsp + 0x20], 0xa0000000
mov eax, 0
setne al
mov dword [rdi], eax
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.7fff25dce640
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [rsp + 0x58]
lea r8, str.minkernel_appmodelunlock_appmodelunlock.cpp
mov r9d, ebx
mov edx, 0x14
call fcn.7fff25d81fe8
mov eax, ebx
jmp 0x7fff25d7c68c
Function at 0x7fff25d7c9e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rbp + 0x3f], rax
and dword [rbp - 5], 0
mov rdi, r8
and dword [rbp + 0x13], 0
lea r8, [rbp - 9]
and qword [rbp - 0x11], 0
mov rsi, rdx
and dword [rbp - 0x19], 0
xorps xmm0, xmm0
and qword [rbp - 1], 0
mov edx, 0x20119
mov qword [rbp + 7], rcx
lea rcx, [rbp - 0x11]
movdqu xmmword [rbp + 0x17], xmm0
mov dword [rbp - 9], 0x30
mov dword [rbp + 0xf], 0x240
call qword [sym.imp.ntdll.dll_ZwOpenKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x7fff25d7caa3
mov rcx, qword [rbp - 0x11]
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x27]
mov r8d, 2
mov dword [rsp + 0x20], 0x18
mov rdx, rsi
call qword [sym.imp.ntdll.dll_ZwQueryValueKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x7fff25d7cad5
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ntdll.dll_ZwClose]
nop dword [rax + rax]
cmp ebx, 0xc0000034
jne 0x7fff25d7cab3
mov dword [rdi], 0xffff
xor ebx, ebx
mov eax, ebx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.7fff25dce640
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rbp + 0x33]
mov ecx, 1
cmp eax, ecx
ja 0x7fff25debe7c
cmp dword [rbp + 0x2b], 4
jne 0x7fff25d7cafa
cmp dword [rbp + 0x2f], 4
jb 0x7fff25d7cafa
test cl, cl
je 0x7fff25d7cafa
mov dword [rdi], eax
jmp 0x7fff25d7ca93
mov dword [rdi], 0xffff
jmp 0x7fff25d7ca93
cmp eax, 0xffff
je 0x7fff25d7cae6
xor cl, cl
jmp 0x7fff25d7cae6
Function at 0x7fff25d80690
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbp, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call sub.ntdll.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.7fff25d80884
test eax, eax
je 0x7fff25ded05c
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call sym.KERNELBASE.dll_LoadLibraryExW
mov rbx, rax
test rax, rax
je 0x7fff25d807a2
lea rdx, str.SortGetHandle
mov rcx, rax
call sym.KERNELBASE.dll_GetProcAddress
mov rdi, rax
test rax, rax
je 0x7fff25d8079a
lea rdx, str.SortCloseHandle
mov rcx, rbx
call sym.KERNELBASE.dll_GetProcAddress
mov rsi, rax
test rax, rax
je 0x7fff25d8079a
mov rcx, qword gs:[0x60]
mov edx, 8
mov rcx, qword [rcx + 0x30]
lea r8d, [rdx + 0x18]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
test rax, rax
je 0x7fff25d8079a
mov ecx, dword [rbp + 4]
and ecx, 0xffffff00
mov qword [rax + 8], rbx
mov dword [rax], ecx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x10], rdi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.7fff25dce640
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rcx, rbx
call sym.KERNELBASE.dll_FreeLibrary
xor eax, eax
jmp 0x7fff25d80770
mov rcx, rbp
call fcn.7fff25e1c268
test eax, eax
je 0x7fff25d807a2
lea rcx, str.kernel32.dll
jmp 0x7fff25d806ee

Function at 0x7fff25d82330
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov rax, qword gs:[0x60]
movzx eax, byte [rax + 2]
ret

Function at 0x7fff25d83b74
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov rsi, r8
mov edi, r15d
mov ebp, edx
mov r14, rcx
mov ebx, 0x210
test rdi, rdi
jne 0x7fff25dee3b6
mov rcx, qword gs:[0x60]
mov edx, dword [0x7fff25fd0c80]
mov r8d, ebx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x7fff25d83c40
mov r9d, ebx
mov dword [rsp + 0x20], ebp
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov ebx, dword [rdi]
add ebx, 8
cmp eax, 0x80000005
je 0x7fff25d83b9f
test eax, eax
js 0x7fff25dee3da
movzx ebx, word [rdi]
lea rdx, [rdi + 4]
mov r8d, ebx
mov rcx, rdi
call sub.ntdll.dll_memmove
shr rbx, 1
mov eax, 1
mov qword [rsi], rdi
mov word [rdi + rbx*2], r15w
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
mov eax, 0xc000009a
jmp 0x7fff25d83bfc
Function at 0x7fff25d86238
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rax, qword [rcx + 0x10]
lea rbx, [rcx + 0x18]
and dword [r11 + 0x18], 0
mov qword [r11 - 0x38], rax
mov eax, dword [rcx + 4]
mov rcx, rbx
and dword [rsp + 0x3c], 0
mov dword [rsp + 0x38], eax
mov byte [rsp + 0x70], 0
call qword [sym.imp.ntdll.dll_RtlAcquireSRWLockShared]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
xor ebp, ebp
mov esi, dword [r14]
xor edx, edx
mov rcx, qword [rcx + 0x30]
lea r8d, [rbp + 0x58]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x7fff25deed32
and qword [rax + 8], rbp
mov qword [rax], r15
mov dword [rax + 0x10], esi
lea rax, [rsp + 0x80]
mov qword [rdi + 0x18], rax
lea rax, [rsp + 0x70]
mov qword [rdi + 0x20], rax
lea rax, [rsp + 0x30]
mov qword [rdi + 0x28], rax
test rdi, rdi
je 0x7fff25deed39
lea rcx, [rdi + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitializeCriticalSection]
nop dword [rax + rax]
mov rbp, rdi
mov rcx, rdi
call fcn.7fff25d86380
mov esi, eax
test eax, eax
jns 0x7fff25d862f5
mov edi, 0x80070103
cmp eax, edi
jne 0x7fff25deedb1
mov eax, dword [rsp + 0x80]
mov dword [r14], eax
test eax, eax
jne 0x7fff25deed99
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlReleaseSRWLockShared]
nop dword [rax + rax]
test rbp, rbp
je 0x7fff25d86364
lea rcx, [rbp + 0x30]
call qword [sym.imp.ntdll.dll_RtlDeleteCriticalSection]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, rbp
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x78]
mov eax, edi
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret