joyce8/EMBER2024-capa huggingface dataset:
Function at 0x19e50
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rsi
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x70
xor eax, eax
xor edi, edi
lea r8, [r11 - 0x38]
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x10], rax
mov qword [r11 - 0x20], rax
mov rax, qword [0x0002ece0]
mov rcx, qword [rax]
mov dword [rsp + 0x40], 0x30
mov rsi, r9
mov qword [r11 - 0x30], rcx
mov dword [rsp + 0x58], 0x240
mov qword [r11 - 0x28], rdx
lea rcx, [r11 + 0x10]
mov edx, 0x20019
mov qword [r11 + 0x10], rdi
mov dword [r11 + 8], edi
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x10], rdi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jns 0x19ed4
xor al, al
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret
mov edx, 0x1000
xor ecx, ecx
mov r8d, 0x70656472
mov qword [rsp + 0x90], rbx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x1a00a
xor edx, edx
mov r8d, 0x1000
mov rcx, rax
call fcn.0002b780
xor edx, edx
mov r8d, 0x1000
mov rcx, rbx
call fcn.0002b780
mov rcx, qword [rsp + 0x88]
xor edx, edx
lea r11, [rsp + 0x80]
lea r8d, [rdx + 1]
mov r9, rbx
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, 0x8000001a
je 0x19fea
test eax, eax
js 0x19f9f
cmp dword [rbx + 0x10], 0
je 0x19f9f
mov r8d, dword [rbx + 8]
mov r9d, dword [rbx + 0xc]
xor eax, eax
mov qword [rsp + 0x32], rax
mov dword [rsp + 0x3a], eax
mov word [rsp + 0x3e], ax
movzx eax, word [rbx + 0x10]
lea rdx, [rsp + 0x30]
add r8, rbx
mov word [rsp + 0x30], ax
mov word [rsp + 0x32], ax
lea rax, [rbx + 0x14]
mov rcx, rsi
mov qword [rsp + 0x38], rax
call fcn.0001aa10
test al, al
je 0x19fea
xor edx, edx
mov r8d, 0x1000
mov rcx, rbx
inc edi
call fcn.0002b780
mov rcx, qword [rsp + 0x88]
lea r11, [rsp + 0x80]
mov r9, rbx
mov r8d, 1
mov qword [rsp + 0x28], r11
mov edx, edi
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
cmp eax, 0x8000001a
jne 0x19f52
mov edx, 0x70656472
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, 1
jmp 0x1a01a
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor al, al
mov rbx, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret
Function at 0x1a030
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rcx
lea rdx, [0x00011668]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [0x0002ece0]
xor r11d, r11d
mov rcx, qword [rax]
xor edi, edi
mov qword [rsp + 0x38], r11
lea rax, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
lea rcx, [rsp + 0x78]
lea r8, [rsp + 0x30]
mov edx, 0xf003f
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x48], 0x240
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x1a0d7
mov rcx, qword [rsp + 0x78]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rdx, [0x00011678]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [0x0002ece0]
xor r11d, r11d
mov rcx, qword [rax]
mov qword [rsp + 0x38], r11
lea rax, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
lea rcx, [rsp + 0x78]
lea r8, [rsp + 0x30]
mov edx, 0xf003f
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x48], 0x240
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x1a16f
mov rcx, qword [rsp + 0x78]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1a180
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rcx
lea rdx, [0x00011688]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [0x0002ece0]
xor r11d, r11d
mov rcx, qword [rax]
xor edi, edi
mov qword [rsp + 0x38], r11
lea rax, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
lea rcx, [rsp + 0x78]
lea r8, [rsp + 0x30]
mov edx, 0xf003f
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x48], 0x240
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x1a227
mov rcx, qword [rsp + 0x78]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rdx, [0x00011698]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [0x0002ece0]
xor r11d, r11d
mov rcx, qword [rax]
mov qword [rsp + 0x38], r11
lea rax, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
lea rcx, [rsp + 0x78]
lea r8, [rsp + 0x30]
mov edx, 0xf003f
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x48], 0x240
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x1a2bf
mov rcx, qword [rsp + 0x78]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x1a2d0
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rcx
lea rdx, [0x000116a8]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [0x0002ece0]
xor r11d, r11d
mov rcx, qword [rax]
xor edi, edi
mov qword [rsp + 0x38], r11
lea rax, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
lea rcx, [rsp + 0x78]
lea r8, [rsp + 0x30]
mov edx, 0xf003f
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x48], 0x240
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jns 0x1a36b
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rcx, qword [rsp + 0x78]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov rcx, qword [rsp + 0x78]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp ebx, 0xc0000034
cmove ebx, edi
test ebx, ebx
mov rbx, qword [rsp + 0x70]
setns al
add rsp, 0x60
pop rdi
ret
Function at 0x1a3a0
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 8], ecx
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x90
mov rbp, rdx
lea rcx, [rsp + 0x50]
lea rdx, [0x000116b8]
mov rsi, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor eax, eax
mov qword [rsp + 0x42], rax
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
movzx eax, word [rbp]
xor r12d, r12d
mov r8d, 0x70656472
add ax, word [rsi]
xor ecx, ecx
mov word [rsp + 0x40], r12w
add ax, 4
movzx edi, ax
mov word [rsp + 0x42], ax
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x1a41b
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.0002b780
mov qword [rsp + 0x48], rbx
test rbx, rbx
jne 0x1a435
xor al, al
add rsp, 0x90
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rsp + 0x40]
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [0x000116c4]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea rcx, [rsp + 0x40]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
mov rax, qword [0x0002ece0]
xor r11d, r11d
mov rcx, qword [rax]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x70], r11
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x78], r11
mov qword [rsp + 0x80], r11
mov qword [rsp + 0x88], r11
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0xd0]
xor r9d, r9d
mov edx, 0x20006
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0xd0], r12
mov dword [rsp + 0xc8], r12d
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x60], 0x30
mov dword [rsp + 0x78], 0x240
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], r12
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
jns 0x1a508
xor bl, bl
jmp 0x1a54e
mov rcx, qword [rsp + 0xd0]
lea rax, [rsp + 0xc0]
lea rdx, [rsp + 0x40]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0xd0]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
setns bl
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1a563
mov edx, 0x70656472
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, bl
add rsp, 0x90
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1a580
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x70
mov rsi, rdx
mov rbp, rcx
lea rdx, [0x000116b8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor eax, eax
xor r12d, r12d
mov qword [rsp + 0x22], rax
mov dword [rsp + 0x2a], eax
mov word [rsp + 0x2e], ax
movzx eax, word [rbp]
mov r8d, 0x70656472
xor ecx, ecx
add ax, word [rsi]
mov word [rsp + 0x20], r12w
add ax, 4
movzx edi, ax
mov word [rsp + 0x22], ax
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x1a5fc
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.0002b780
mov qword [rsp + 0x28], rbx
test rbx, rbx
jne 0x1a60d
xor al, al
jmp 0x1a6fb
lea rcx, [rsp + 0x20]
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [0x000116c4]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea rcx, [rsp + 0x20]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
mov rax, qword [0x0002ece0]
xor r11d, r11d
mov rcx, qword [rax]
mov qword [rsp + 0x48], r11
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x68], r11
lea rcx, [rsp + 0x90]
lea r8, [rsp + 0x40]
mov edx, 0xf003f
mov qword [rsp + 0x90], r12
mov dword [rsp + 0x40], 0x30
mov dword [rsp + 0x58], 0x240
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jns 0x1a6b2
xor bl, bl
jmp 0x1a6e4
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov rcx, qword [rsp + 0x90]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp ebx, 0xc0000034
cmove ebx, r12d
test ebx, ebx
setns bl
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1a6f9
mov edx, 0x70656472
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, bl
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1a710
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rcx
lea rdx, [0x000116c8]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [0x0002ece0]
xor r11d, r11d
mov rcx, qword [rax]
xor edi, edi
mov qword [rsp + 0x38], r11
lea rax, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
lea rcx, [rsp + 0x78]
lea r8, [rsp + 0x30]
mov edx, 0xf003f
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x48], 0x240
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jns 0x1a7ab
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rcx, qword [rsp + 0x78]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov rcx, qword [rsp + 0x78]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp ebx, 0xc0000034
cmove ebx, edi
test ebx, ebx
mov rbx, qword [rsp + 0x70]
setns al
add rsp, 0x60
pop rdi
ret

Function at 0x1a7e0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
mov esi, edx
mov rbx, rcx
lea rdx, [0x000116d8]
lea rcx, [rsp + 0x48]
mov edi, r8d
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r11d, r11d
xor eax, eax
mov dword [rsp + 0xb8], r11d
mov dword [rsp + 0xbc], eax
test edi, edi
jne 0x1a83d
mov rcx, qword [0x0002ece0]
lea rdx, [rsp + 0x48]
mov r8, rbx
call fcn.00019d90
jmp 0x1a91f
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov rax, qword [0x0002ece0]
mov dword [rsp + 0xbc], edi
mov dword [rsp + 0xb8], esi
mov rcx, qword [rax]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x60], rcx
lea r8, [rsp + 0x58]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0xb0]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r11d
xor r9d, r9d
mov edx, 0x20006
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x40], r11
mov dword [rsp + 0xb0], r11d
mov dword [rsp + 0x58], 0x30
mov dword [rsp + 0x70], 0x240
mov qword [rsp + 0x78], r11
mov qword [rsp + 0x80], r11
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
jns 0x1a8e1
xor al, al
jmp 0x1a91f
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0xb8]
mov r9d, 3
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
setns al
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1a940
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rcx
lea rdx, [0x000116e8]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [0x0002ece0]
xor r11d, r11d
mov rcx, qword [rax]
xor edi, edi
mov qword [rsp + 0x38], r11
lea rax, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
lea rcx, [rsp + 0x78]
lea r8, [rsp + 0x30]
mov edx, 0xf003f
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x48], 0x240
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jns 0x1a9db
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rcx, qword [rsp + 0x78]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov rcx, qword [rsp + 0x78]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp ebx, 0xc0000034
cmove ebx, edi
test ebx, ebx
mov rbx, qword [rsp + 0x70]
setns al
add rsp, 0x60
pop rdi
ret

Function at 0x1aed0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
mov esi, 0xb
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov ecx, esi
mov edi, ebp
mov dword [rsp + 0x30], ebp
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov edx, dword [rsp + 0x30]
xor ecx, ecx
mov r8d, 0x6d61736b
add edx, 0x400
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x1af91
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
add r8d, 0x400
mov ecx, esi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
js 0x1af48
mov rbp, qword [rbx + 0x18]
mov edi, dword [rbx + 0x20]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test rbp, rbp
je 0x1af91
test edi, edi
je 0x1af91
lea rbx, [0x0002ea80]
lea rdi, str.CmRegisterCallback
nop word [rax + rax]
mov rdx, rdi
mov rcx, rbp
call fcn.00019610
add rbx, 0x38
add rdi, 0x38
sub rsi, 1
mov qword [rbx - 0x38], rax
jne 0x1af70
mov al, 1
jmp 0x1af93
xor al, al
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1b280
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
cmp byte [0x0002ed20], 0
mov r12, r8
mov esi, edx
mov rdi, rcx
jne 0x1b2b5
mov ebx, 0xc00000a3
jmp 0x1b44c
cmp edx, 0x148
jb 0x1b447
test rcx, rcx
je 0x1b447
mov ebp, 0x5a4d
cmp word [rcx], bp
jne 0x1b447
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1b447
mov ecx, 0x8664
cmp word [rax + rdi + 4], cx
jne 0x1b447
cmp word [rax + rdi + 0x5c], 1
jne 0x1b447
lea r8, [0x0002e450]
mov rcx, rdi
call fcn.00029530
test al, al
je 0x1b440
mov edx, esi
mov rcx, rdi
xor ebx, ebx
call fcn.00023710
mov rsi, rax
test rax, rax
je 0x1b44c
mov rcx, rax
call fcn.000238c0
test al, al
je 0x1b44c
mov rcx, rsi
call fcn.00023ca0
test al, al
je 0x1b44c
cmp word [rsi], bp
jne 0x1b44c
movsxd rbp, dword [rsi + 0x3c]
cmp dword [rbp + rsi], 0x4550
jne 0x1b44c
lea edx, [rbx + 0x68]
lea ecx, [rbx + 1]
mov r8d, 0x64727665
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
jne 0x1b390
mov ebx, 0xc000009a
jmp 0x1b407
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x68]
call fcn.0002b780
mov rdx, r12
mov rcx, rdi
call fcn.0001afb0
mov ebx, eax
test eax, eax
js 0x1b407
mov qword [rdi + 0x50], rsi
mov eax, dword [rbp + rsi + 0x28]
add rax, rsi
mov qword [rdi + 0x48], rax
mov rax, qword [0x0002ed28]
mov qword [rdi + 0x60], rax
mov rax, qword [0x0002eaf0]
mov qword [0x0002ed28], rdi
test rax, rax
jne 0x1b3f4
call fcn.0001aed0
mov rax, qword [0x0002eaf0]
test rax, rax
jne 0x1b3f4
mov ebx, 0xc0000001
jmp 0x1b407
lea rcx, [rdi + 0x18]
lea rdx, [0x0001b1d0]
call rax
mov ebx, eax
test eax, eax
jns 0x1b44c
test rdi, rdi
je 0x1b430
cmp qword [0x0002ed28], rdi
jne 0x1b420
mov rax, qword [rdi + 0x60]
mov qword [0x0002ed28], rax
mov rcx, rdi
mov qword [rdi + 0x50], 0
call fcn.0001b0e0
mov edx, 0x70656472
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x1b44c
mov ebx, 0xc0000022
jmp 0x1b44c
mov ebx, 0xc000000d
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret
Function at 0x1ba80
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, rcx
mov edi, r9d
mov rsi, rdx
lea rcx, [0x0002f2a8]
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov r11, qword [0x0002f2c0]
test r11, r11
je 0x1bace
xchg dword [r11], ebx
mov dword [0x0002f2c8], ebx
mov eax, dword [rsp + 0x68]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov r8, qword [0x0002f2c0]
mov ebx, eax
test r8, r8
je 0x1bb09
mov edx, dword [0x0002f2c8]
xchg dword [r8], edx
lea rcx, [0x0002f2a8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1bc80
Capabilities:
Install driver

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0xa0
xor eax, eax
mov rbx, rcx
mov edx, 0x18
mov ecx, 0x16
mov word [rsp + 0x42], dx
mov word [rsp + 0x52], dx
mov word [rsp + 0x40], cx
mov word [rsp + 0x50], cx
mov ecx, 0xa
xor esi, esi
mov word [rsp + 0x70], dx
mov word [r11 - 0x28], cx
mov word [rsp + 0x30], si
mov qword [r11 - 0x76], rax
mov dword [rsp + 0x3a], eax
mov word [rsp + 0x3e], ax
lea rax, [0x000118e0]
mov word [r11 - 0x16], cx
mov qword [r11 - 0x60], rax
lea rax, [0x000118f8]
mov edi, 0x208
mov qword [r11 - 0x50], rax
mov eax, 0x12
lea ecx, [rsi + 1]
mov word [rsp + 0x60], ax
mov eax, 0x14
mov r8d, 0x62746c6b
mov word [rsp + 0x62], ax
lea rax, [0x00011910]
mov rdx, rdi
mov qword [r11 - 0x40], rax
mov eax, 0x1a
mov word [rsp + 0x72], ax
lea rax, [0x00011928]
mov qword [r11 - 0x30], rax
mov eax, 0xc
mov word [r11 - 0x26], ax
lea rax, [0x00011948]
mov qword [r11 - 0x20], rax
mov eax, 8
mov word [r11 - 0x18], ax
lea rax, [0x00011958]
mov qword [r11 - 0x10], rax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1bec8
lea rdx, [0x0002ea40]
lea rcx, [rsp + 0x30]
mov word [rsp + 0x32], di
mov word [rsp + 0x30], si
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [rbx + 0xc]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
or rcx, 0xffffffffffffffff
xor eax, eax
lea r9, [rbx + 0x214]
lea r8d, [rsi + 1]
lea rdx, [rsp + 0x40]
mov rdi, r9
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.0001bb40
lea r9, [rbx + 0x41c]
cmp word [r9], si
je 0x1be08
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r9
repne scasw ax, word [rdi]
lea r8d, [rsi + 1]
lea rdx, [rsp + 0x50]
not rcx
lea eax, [rcx + rcx]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.0001bb40
or rcx, 0xffffffffffffffff
xor eax, eax
lea r9, [rbx + 0x624]
mov rdi, r9
lea rdx, [rsp + 0x60]
mov r8d, 2
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.0001bb40
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
mov r9, rbx
mov r8d, 4
mov dword [rsp + 0x20], 4
call fcn.0001bb40
lea r9, [rbx + 4]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
mov r8d, 4
mov dword [rsp + 0x20], 4
call fcn.0001bb40
lea r9, [rbx + 8]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
mov r8d, 4
mov dword [rsp + 0x20], 4
call fcn.0001bb40
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwLoadDriver]
mov rcx, qword [rsp + 0x38]
mov edi, eax
test rcx, rcx
je 0x1becd
mov edx, 0x62746c6b
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
jmp 0x1becd
mov eax, 0xc0000001
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret