joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140068a40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14049cc40]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x3c30]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
movss xmm0, dword [rax + 0x3c38]
movss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x50]
movss xmm0, dword [rsp + 0x24]
divss xmm0, dword [rax + 0x14]
movss dword [rsp + 0x3c], xmm0
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, qword [rsp + 0x70]
call fcn.140010770
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x80]
cmp qword [rsp + 0x30], rax
jae 0x140068b8e
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xa
jne 0x140068b50
movss xmm1, dword [rsp + 0x20]
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax]
call fcn.140039920
mov rax, qword [rsp + 0x70]
movss dword [rax], xmm0
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
movss dword [rax + 4], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0x98]
test eax, eax
je 0x140068b4b
jmp 0x140068b8e
jmp 0x140068ac1
cmp dword [rsp + 0x28], 0xd
jne 0x140068b5c
jmp 0x140068ac1
movzx edx, word [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.14005e9a0
mulss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x40], xmm0
movss xmm0, dword [rsp + 0x20]
addss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x20], xmm0
jmp 0x140068ac1
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [rax]
jbe 0x140068bad
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rsp + 0x20]
movss dword [rax], xmm0
cmp qword [rsp + 0x90], 0
je 0x140068be9
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
movaps xmm2, xmm0
movss xmm1, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.140010770
mov rax, qword [rax]
mov rcx, qword [rsp + 0x90]
mov qword [rcx], rax
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [0x14042ff20]
ja 0x140068c0d
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
ucomiss xmm0, dword [0x14042ff20]
jp 0x140068c27
jne 0x140068c27
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
movss dword [rax + 4], xmm0
cmp qword [rsp + 0x88], 0
je 0x140068c42
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x140099d20
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x490
mov rax, qword [0x140462680]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov edx, dword [rsp + 0x4a0]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x140099de2
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x438
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0x438
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x140099dd7
mov rcx, qword [rsp + 0x4a8]
call fcn.140099ef0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400993c0
test rax, rax
je 0x140099dc3
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
jmp 0x140099dd7
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140099d98
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x4a8]
call fcn.140099f10
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14033bfd0
add rsp, 0x490
pop rdi
ret
Function at 0x1400af1f0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x140462680]
xor rax, rsp
mov qword [rsp + 0xc0], rax
call fcn.14002c120
cvttss2si eax, xmm0
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
add eax, 5
cvtsi2ss xmm0, eax
call fcn.14002c270
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x34]
call fcn.1400af430
mov rcx, rax
call fcn.1400b9b40
mov rcx, rax
call fcn.14005f580
movss xmm1, dword [0x140430264]
xorps xmm0, xmm0
call fcn.14002bed0
cvtsi2ss xmm0, dword [rsp + 0x38]
call fcn.14002c270
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
lea rcx, [0x14049d210]
call fcn.1400b9870
mov r8, qword [rax]
lea rdx, [0x140426a04]
lea rcx, [rsp + 0xa8]
call fcn.140039bb0
mov dword [rsp + 0x20], 0xff
mov r9d, 0xff
mov r8d, 0xff
mov edx, 0xff
lea rcx, [rsp + 0x88]
call fcn.140010850
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x40]
call fcn.140039b30
mov rdx, rax
mov ecx, reloc.WS2_32.dll_setsockopt
call fcn.1400198f0
movzx eax, byte [0x14049d718]
test eax, eax
jne 0x1400af358
movss xmm0, dword [0x140430044]
movss dword [rsp + 0x20], xmm0
xorps xmm3, xmm3
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rsp + 0x58]
call fcn.1400107f0
lea rdx, [rsp + 0x58]
mov ecx, reloc.WS2_32.dll_shutdown
call fcn.1400198f0
movss xmm2, dword [0x14043013c]
movss xmm1, dword [0x140430184]
lea rcx, [rsp + 0x48]
call fcn.140010770
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0xa8]
call fcn.140060890
movzx eax, al
test eax, eax
je 0x1400af349
mov byte [0x14049d718], 1
mov ecx, 1
call fcn.1400199b0
jmp 0x1400af402
movss xmm0, dword [0x140430044]
movss dword [rsp + 0x20], xmm0
xorps xmm3, xmm3
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rsp + 0x68]
call fcn.1400107f0
lea rdx, [rsp + 0x68]
mov ecx, reloc.WS2_32.dll_shutdown
call fcn.1400198f0
movss xmm2, dword [0x14043013c]
movss xmm1, dword [0x140430184]
lea rcx, [rsp + 0x50]
call fcn.140010770
lea rdx, [rsp + 0x50]
lea rcx, [0x140426a08]
call fcn.140060890
movzx eax, al
mov dword [rsp + 0x30], 0
jmp 0x1400af3ca
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x67
jge 0x1400af3f8
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400af3f6
mov eax, dword [rsp + 0x30]
mov dword [reloc.OLEAUT32.dll_SysReAllocString], eax
mov byte [0x14049d718], 0
jmp 0x1400af3c0
mov ecx, 1
call fcn.1400199b0
mov ecx, 1
call fcn.1400199b0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14033bfd0
add rsp, 0xd8
ret
Function at 0x1400c6d10
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x288
mov rax, qword [0x140462680]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov dword [rsp + 0x30], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x1400c6d57
xor eax, eax
jmp 0x1400c6dd8
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rdx, [rsp + 0x5c]
mov rcx, qword [rsp + 0x290]
call fcn.1400c6f90
test eax, eax
jne 0x1400c6d8e
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
jmp 0x1400c6dd8
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400c6dcb
lea rdx, [rsp + 0x5c]
mov rcx, qword [rsp + 0x290]
call fcn.1400c6f90
test eax, eax
jne 0x1400c6dc9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
jmp 0x1400c6dd8
jmp 0x1400c6d8e
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14033bfd0
add rsp, 0x288
ret
Function at 0x1400c7fbc
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x68]
sub rsp, 0x168
xor ecx, ecx
lea rdi, [rsp + 0x40]
xor eax, eax
xor esi, esi
cpuid
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x2c], edx
mov edx, 0x114
mov dword [rsp + 0x20], eax
mov ecx, edx
xor eax, eax
mov qword [rsp + 0x30], rsi
rep stosb byte [rdi], al
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x40], edx
call qword [sym.imp.ntdll.dll_RtlGetVersion]
cmp dword [rsp + 0x44], 6
jb 0x1400c8115
jne 0x1400c8020
cmp dword [rsp + 0x48], esi
je 0x1400c8115
cmp dword [rsp + 0x4c], 0x1db0
je 0x1400c8115
call fcn.1400cde74
test al, al
jne 0x1400c8043
lea rdx, str.____Administrator_privileges_are_required__r_n
jmp 0x1400c811c
lea r8, [rbp + 0x98]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x90]
call fcn.1400cda88
test al, al
je 0x1400c807b
cmp byte [rbp + 0x90], sil
je 0x1400c807b
lea rdx, str.___Windows_HVCI_mode_detected_r_n___Please_turn_off_Memory_integrity_r_n
mov ecx, 1
call fcn.1400c963c
mov r8d, 8
mov dword [rbp + 0xa8], esi
lea r9, [rbp + 0xa8]
mov qword [rsp + 0x20], r8
lea rdx, [rsp + 0x20]
lea ecx, [r8 + 0x5f]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x1400c80fa
mov eax, dword [rsp + 0x24]
test al, 2
je 0x1400c80be
lea rcx, str.___Test_Mode_ENABLED_r_n
call fcn.1400c7d58
mov eax, dword [rsp + 0x24]
test al, al
jns 0x1400c80d2
lea rcx, str.___Debug_Mode_ENABLED_r_n
call fcn.1400c7d58
mov eax, dword [rsp + 0x24]
bt eax, 0xa
jae 0x1400c80e8
lea rcx, str.___HVCI_KMCI_ENABLED_r_n
call fcn.1400c7d58
mov eax, dword [rsp + 0x24]
bt eax, 0xe
jae 0x1400c80fa
lea rcx, str.___WHQL_enforcement_ENABLED_r_n
call fcn.1400c7d58
cmp byte [rbp + 0x90], sil
mov eax, dword [rsp + 0x4c]
setne byte [rsp + 0x30]
mov dword [rsp + 0x34], eax
mov rsi, qword [rsp + 0x30]
jmp 0x1400c8126
lea rdx, str.____Unsupported_r_n
mov ecx, 1
call fcn.1400c963c
mov rax, rsi
add rsp, 0x168
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400c82e8
Capabilities:
Map section object

Disassembly:
mov r11, rsp
sub rsp, 0x68
and qword [r11 + 0x10], 0
mov r10, rdx
and r10, 0xfffffffffffff000
mov eax, r8d
sub rax, r10
mov qword [r11 - 0x10], r10
add rax, rdx
lea r8, [r11 + 0x10]
mov qword [r11 - 0x18], rax
neg r9d
sbb eax, eax
xor r9d, r9d
and eax, 2
or rdx, 0xffffffffffffffff
add eax, 2
mov dword [rsp + 0x48], eax
lea rax, [r11 - 0x18]
and dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
mov qword [r11 - 0x38], rax
lea rax, [r11 - 0x10]
mov qword [r11 - 0x40], rax
and qword [r11 - 0x48], 0
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jns 0x1400c8369
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1400c836e
mov rax, qword [rsp + 0x78]
add rsp, 0x68
ret
Function at 0x1400c898c
Capabilities:
Access pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, edx
xor ebp, ebp
mov r14, r8
mov rsi, r9
mov r8, rcx
mov rdx, rcx
mov r10d, ebp
lea r11d, [rdi + 1]
shr r11d, 1
je 0x1400c89de
movzx eax, word [rdx]
lea rdx, [rdx + 2]
add r10d, eax
mov ecx, r10d
movzx r10d, r10w
shr ecx, 0x10
add r10d, ecx
add r11d, 0xffffffff
jne 0x1400c89c1
mov ebx, r10d
mov rcx, r8
shr ebx, 0x10
add bx, r10w
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x1400c8a15
movzx ecx, word [rax + 0x58]
cmp bx, cx
adc cx, bp
sub bx, cx
movzx ecx, word [rax + 0x5a]
cmp bx, cx
adc cx, bp
sub bx, cx
mov ecx, dword [rax + 0x58]
jmp 0x1400c8a1a
mov ecx, edi
movzx ebx, bp
movzx eax, bx
add eax, edi
test r14, r14
je 0x1400c8a27
mov dword [r14], ecx
test rsi, rsi
je 0x1400c8a2e
mov dword [rsi], eax
mov rbx, qword [rsp + 0x30]
cmp eax, ecx
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
sete al
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400c8a50
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov r14, 0xffffffff80000002
mov rsi, rdx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ebx, ebx
test eax, eax
je 0x1400c8b83
lea rax, [rbp + 0x190]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400c8ac2
cmp eax, 2
je 0x1400c8b83
xor eax, eax
jmp 0x1400c8b88
mov rdi, rsi
test rsi, rsi
jne 0x1400c8acf
mov rdi, rbx
jmp 0x1400c8add
cmp word [rsi], bx
je 0x1400c8add
add rdi, 2
cmp word [rdi], bx
jne 0x1400c8ad4
mov eax, 0x5c
cmp word [rdi - 2], ax
je 0x1400c8af2
mov word [rdi], ax
add rdi, 2
mov word [rdi], bx
mov r15d, 0x104
jmp 0x1400c8b1c
mov r9, r15
lea r8, [rsp + 0x40]
mov rdx, r15
mov rcx, rdi
call fcn.1400cecd8
mov rdx, rsi
mov rcx, r14
call fcn.1400c8a50
test eax, eax
je 0x1400c8b5d
mov rcx, qword [rbp + 0x190]
lea rax, [rbp + 0x198]
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x180]
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x40]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x20], rbx
mov dword [rbp + 0x180], r15d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400c8afa
mov rcx, qword [rbp + 0x190]
mov word [rdi - 2], bx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
sete bl
mov eax, ebx
jmp 0x1400c8b88
mov eax, 1
mov rbx, qword [rsp + 0x288]
add rsp, 0x250
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c8ba0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xc0
mov rdi, rcx
mov rbx, r8
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor r8d, r8d
test rbx, rbx
je 0x1400c8bf9
lea rax, [rsp + 0x40]
cmp rax, rbx
je 0x1400c8bf9
movzx ecx, word [rbx]
lea rax, [rsp + 0x40]
test cx, cx
je 0x1400c8bf5
lea rdx, [rsp + 0x40]
sub rbx, rdx
mov word [rax], cx
add rax, 2
movzx ecx, word [rbx + rax]
test cx, cx
jne 0x1400c8be5
mov word [rax], r8w
lea rax, [rsp + 0x40]
cmp word [rsp + 0x40], r8w
je 0x1400c8c10
add rax, 2
cmp word [rax], r8w
jne 0x1400c8c06
lea rcx, [rsp + 0x40]
mov r9d, 1
sub rax, rcx
lea rdx, [rsp + 0x30]
sar rax, 1
mov rcx, rdi
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret
Function at 0x1400c8c58
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
xor esi, esi
mov rbx, rdx
mov qword [rbp + 0x30], rsi
mov rdi, rcx
mov qword [rbp - 8], rsi
mov dword [rbp - 0x10], esi
test rcx, rcx
je 0x1400c8ca3
xor r9d, r9d
lea rdx, [rbp - 0x10]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
jne 0x1400c8ca3
mov eax, 0xc00000f0
jmp 0x1400c8de5
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x30]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov rdx, rbx
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400c8ce6
mov ebx, 0xc0000022
jmp 0x1400c8dce
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x20]
mov r14d, 4
mov dword [rbp + 0x20], 1
mov dword [rsp + 0x28], r14d
lea rdx, str.ErrorControl
mov r9d, r14d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x1400c8db9
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], r14d
lea rdx, str.Type
mov r9d, r14d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x1400c8db9
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], r14d
lea rdx, str.Start
mov r9d, r14d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], 3
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x1400c8db9
test rdi, rdi
je 0x1400c8db9
movzx eax, word [rbp - 0x10]
lea r9d, [r14 - 2]
mov rcx, qword [rbp + 0x30]
lea rdx, str.ImagePath
add eax, r9d
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rax, qword [rbp - 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg ebx
mov ebx, 0xc0000022
sbb ecx, ecx
and ebx, ecx
test rdi, rdi
je 0x1400c8de3
cmp qword [rbp - 8], rsi
je 0x1400c8de3
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400c8dfc
Capabilities:
Install driver
Unload driver

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x250
xor r14d, r14d
mov rbx, rdx
mov rsi, r9
mov bpl, r8b
mov rdx, rcx
test rcx, rcx
je 0x1400c8efc
test rbx, rbx
jne 0x1400c8e3f
mov eax, 0xc00000f0
jmp 0x1400c8f01
xor eax, eax
mov qword [rsp + 0x20], rdx
lea rdi, [rsp + 0x40]
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rcx, [rsp + 0x40]
mov edx, 0x104
lea r9, str.RegistryMachine
lea r8, str._wSSystemCurrentControlSetServices_wS
call fcn.1400c7e14
test eax, eax
js 0x1400c8efc
lea rdx, [rsp + 0x64]
mov rcx, rbx
call fcn.1400c8c58
test eax, eax
js 0x1400c8f01
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
test rsi, rsi
je 0x1400c8eb0
mov rdx, qword [rsp + 0x280]
lea rcx, [rsp + 0x30]
call rsi
test eax, eax
js 0x1400c8f01
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
test bpl, bpl
je 0x1400c8ef1
cmp eax, 0xc000010e
je 0x1400c8ed5
cmp eax, 0xc0000035
je 0x1400c8ed5
cmp eax, 0x40000000
jne 0x1400c8f01
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
test eax, eax
js 0x1400c8f01
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
jmp 0x1400c8f01
cmp eax, 0x40000000
cmove eax, r14d
jmp 0x1400c8f01
mov eax, 0xc00000ef
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x1400c8f20
Capabilities:
Unload driver

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x660
mov rdx, rcx
lea rdi, [rsp + 0x40]
xor eax, eax
mov qword [rsp + 0x20], rdx
mov ecx, 0x20a
lea r9, str.RegistryMachine
rep stosb byte [rdi], al
lea rcx, [rsp + 0x40]
mov edx, 0x104
lea r8, str._wSSystemCurrentControlSetServices_wS
call fcn.1400c7e14
test eax, eax
jns 0x1400c8f6b
mov eax, 0xc00000ef
jmp 0x1400c8fd9
lea rdx, [rsp + 0x64]
xor ecx, ecx
call fcn.1400c8c58
test eax, eax
js 0x1400c8fd9
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtUnloadDriver]
mov ebx, eax
test eax, eax
js 0x1400c8fd7
xor eax, eax
lea rdi, [rsp + 0x250]
mov ecx, 0x410
lea r8, [rsp + 0x64]
rep stosb byte [rdi], al
lea rcx, [rsp + 0x250]
mov r9d, 0x104
mov edx, 0x208
call fcn.1400cecd8
lea rdx, [rsp + 0x250]
call fcn.1400c8a50
mov eax, ebx
mov rbx, qword [rsp + 0x670]
add rsp, 0x660
pop rdi
ret

Function at 0x1400c9184
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
call fcn.1400cd7d4
test rax, rax
je 0x1400c91b6
mov rcx, qword gs:[0x30]
mov r8, rax
mov rbx, qword [rax + 0x18]
xor edx, edx
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400c92c8
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
and qword [rcx], 0
lea rdi, [rbp - 0x20]
and dword [rbp + 0x20], 0
mov r15, rcx
and qword [rdx], 0
xor eax, eax
mov word [rbp + 0x24], 0x500
mov ebx, 8
mov r14, rdx
mov edx, ebx
lea ecx, [rax + 0x18]
rep stosb byte [rdi], al
mov rax, qword gs:[0x30]
lea r8d, [rbx + 0x20]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
jne 0x1400c933a
mov edi, 0xc000009a
jmp 0x1400c948d
mov ecx, 1
call qword [sym.imp.ntdll.dll_RtlLengthRequiredSid]
mov ecx, 2
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlLengthRequiredSid]
add eax, 0x18
mov edx, ebx
add edi, eax
mov rax, qword gs:[0x30]
mov r8d, edi
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x1400c9385
mov edi, 0xc000009a
jmp 0x1400c9471
mov r8d, 2
mov edx, edi
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlCreateAcl]
mov edi, eax
test eax, eax
js 0x1400c9455
mov r8b, 1
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call qword [sym.imp.ntdll.dll_RtlInitializeSid]
xor edx, edx
lea rcx, [rbp - 0x20]
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov edi, 0x10000000
lea r9, [rbp - 0x20]
mov r8d, edi
mov edx, 2
mov rcx, rbx
mov dword [rax], reloc.WS2_32.dll_select
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
mov r8b, 2
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call qword [sym.imp.ntdll.dll_RtlInitializeSid]
xor edx, edx
lea rcx, [rbp - 0x20]
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov edx, 1
lea rcx, [rbp - 0x20]
mov dword [rax], 0x20
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
lea r9, [rbp - 0x20]
mov r8d, edi
mov edx, 2
mov rcx, rbx
mov dword [rax], 0x220
call qword [sym.imp.ntdll.dll_RtlAddAccessAllowedAce]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlCreateSecurityDescriptor]
mov edi, eax
test eax, eax
js 0x1400c9455
xor r9d, r9d
mov r8, rbx
mov dl, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlSetDaclSecurityDescriptor]
mov edi, eax
test eax, eax
jns 0x1400c9491
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor ebx, ebx
xor esi, esi
mov qword [r15], rsi
mov eax, edi
mov qword [r14], rbx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret