joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1f484
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
movsx rax, word [rcx + 0x1c]
cmp word [rcx + 0x1c], 0x37
mov rbx, rcx
mov byte [rax + rcx + 0x1e], 0x80
jle 0x1f4de
jmp 0x1f4a9
movsx rax, ax
mov byte [rax + rcx + 0x1e], 0
inc word [rcx + 0x1c]
movzx eax, word [rcx + 0x1c]
cmp ax, 0x40
jl 0x1f4a0
call fcn.0001f294
jmp 0x1f4cc
movsx rax, word [rbx + 0x1c]
mov byte [rax + rbx + 0x1e], 0
inc word [rbx + 0x1c]
cmp word [rbx + 0x1c], 0x38
jl 0x1f4be
jmp 0x1f4ec
movsx rax, ax
mov byte [rax + rcx + 0x1e], 0
inc word [rcx + 0x1c]
movzx eax, word [rcx + 0x1c]
cmp ax, 0x38
jl 0x1f4d5
mov ecx, dword [rbx + 0x18]
mov eax, ecx
shr eax, 0x18
mov byte [rbx + 0x56], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rbx + 0x58], cl
mov ecx, dword [rbx + 0x14]
mov byte [rbx + 0x57], al
mov al, byte [rbx + 0x18]
mov byte [rbx + 0x59], al
mov eax, ecx
shr eax, 0x18
mov byte [rbx + 0x5a], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rbx + 0x5c], cl
mov rcx, rbx
mov byte [rbx + 0x5b], al
mov al, byte [rbx + 0x14]
mov byte [rbx + 0x5d], al
add rsp, 0x20
pop rbx
jmp fcn.0001f294

Function at 0x1f540
Capabilities:
Hash data using sha1

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0xa0
mov rax, qword [0x0004b108]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor ebx, ebx
mov rbp, r8
mov edi, edx
mov rsi, rcx
cmp rcx, rbx
je 0x1f6a8
cmp r8, rbx
je 0x1f6a8
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x38], ebx
mov word [rsp + 0x3c], bx
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x30], 0xc3d2e1f0
movzx edx, bx
mov dword [r11 - 0x38], ebx
mov dword [r11 - 0x34], ebx
mov eax, ebx
lea r12d, [rbx + 1]
lea r13d, [rbx + 0x40]
cmp edi, ebx
je 0x1f647
dec edi
cmp eax, ebx
jne 0x1f6a3
mov al, byte [rsi]
movsx rcx, dx
mov byte [rsp + rcx + 0x3e], al
mov dx, word [rsp + 0x3c]
mov eax, dword [rsp + 0x84]
add dx, r12w
add dword [rsp + 0x34], 8
mov word [rsp + 0x3c], dx
jne 0x1f617
add dword [rsp + 0x38], r12d
cmove eax, r12d
mov dword [rsp + 0x84], eax
cmp dx, r13w
jne 0x1f633
lea rcx, [rsp + 0x20]
call fcn.0001f294
mov eax, dword [rsp + 0x84]
mov dx, word [rsp + 0x3c]
add rsi, r12
cmp edi, ebx
jne 0x1f5d7
cmp eax, ebx
jne 0x1f6a3
cmp dword [rsp + 0x80], ebx
jne 0x1f670
lea rcx, [rsp + 0x20]
call fcn.0001f484
lea rcx, [rsp + 0x3e]
mov r8, r13
xor edx, edx
call fcn.000407c0
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x80], r12d
mov r9, rbx
mov rdx, r9
mov eax, ebx
mov ecx, 3
sar rdx, 2
and eax, 3
add ebx, r12d
mov r8d, dword [rsp + rdx*4 + 0x20]
sub ecx, eax
add r9, r12
shl ecx, 3
shr r8d, cl
mov byte [rbp], r8b
add rbp, r12
cmp ebx, 0x14
jl 0x1f673
mov eax, r12d
jmp 0x1f6aa
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.00040240
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1f83c
Capabilities:
Check os version

Disassembly:
sub rsp, 0x38
mov eax, dword [0x00063be0]
test eax, eax
jne 0x1f87a
cmp dword [0x00063be4], eax
jne 0x1f917
lea r8, [0x00063be8]
lea rdx, [0x00063be4]
lea rcx, [0x00063be0]
xor r9d, r9d
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov eax, dword [0x00063be0]
cmp eax, 5
jne 0x1f88a
cmp dword [0x00063be4], 1
jae 0x1f890
cmp eax, eax
jbe 0x1f917
xor eax, eax
lea rdx, [0x00041580]
lea rcx, [rsp + 0x20]
mov qword [0x00063bf0], rax
mov qword [0x00063bf8], rax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
lea rdx, [0x000415b0]
lea rcx, [rsp + 0x20]
mov qword [0x00063bf0], rax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov r9, qword [0x00063bf0]
mov qword [0x00063bf8], rax
test r9, r9
je 0x1f917
test rax, rax
je 0x1f917
lea rdx, [0x00063bd8]
lea rcx, [0x0001f928]
mov r8, rdx
call r9
mov dword [0x00063bec], 1
mov eax, 1
add rsp, 0x38
ret

Function at 0x1fa04
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
mov esi, dword [r8]
mov rdi, rdx
mov edx, dword [rdx]
mov rbx, r8
mov r11, rcx
mov rbp, rcx
mov r12d, 0x10
mov r13d, 0xff
xor edx, dword [rbp]
add rbp, 4
mov ecx, edx
movzx r10d, dx
mov r9d, edx
shr ecx, 8
and r10w, r13w
movzx r8d, cx
shr ecx, 8
mov eax, ecx
and r8w, r13w
shr eax, 8
movzx edx, al
movzx eax, cx
mov edx, dword [r11 + rdx*4 + 0x48]
movzx ecx, al
movzx eax, r8w
add edx, dword [r11 + rcx*4 + 0x448]
xor edx, dword [r11 + rax*4 + 0x848]
movzx eax, r10w
add edx, dword [r11 + rax*4 + 0xc48]
xor edx, esi
sub r12, 1
mov esi, r9d
jne 0x1fa38
mov ecx, dword [r11 + 0x40]
mov eax, dword [r11 + 0x44]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
xor ecx, edx
xor eax, r9d
mov dword [rdi], eax
mov rdi, qword [rsp + 0x30]
mov dword [rbx], ecx
mov rbx, qword [rsp + 0x18]
pop r13
pop r12
ret
Function at 0x1fb8c
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x0004b108]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov byte [rsp + 0x28], 0x10
mov byte [rsp + 0x29], 0x41
mov byte [rsp + 0x2a], 0x1e
mov byte [rsp + 0x2b], 0x33
mov byte [rsp + 0x2c], 0x98
mov byte [rsp + 0x2d], 0xcc
xor edi, edi
mov qword [r11 - 0x4a], rax
cmp r8b, dil
mov qword [r11 - 0x42], rax
mov qword [r11 - 0x3a], rax
lea rax, [fcn.0001fa04]
lea rbp, [0x0001fac8]
mov r13, rcx
lea r8d, [rdi + 6]
lea r9, [r11 - 0x4a]
cmovne rbp, rax
mov eax, 0x2aaaaaab
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
inc r8d
lea ecx, [rdx + rdx*2]
add ecx, ecx
sub eax, ecx
movsxd rcx, eax
mov al, byte [rsp + rcx + 0x28]
xor al, byte [r9 - 1]
mov byte [r9], al
inc r9
cmp r8d, 0x18
jl 0x1fc00
lea r14, [0x00069600]
xor edx, edx
mov r8d, 0x1048
mov rcx, r14
call fcn.000407c0
lea rcx, [0x00063c00]
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
lea rsi, [0x00069648]
lea rdx, [0x00045070]
mov rcx, rsi
mov r8d, 0x1000
mov r12b, al
call fcn.00040300
mov r11, rdi
mov rcx, rdi
mov edx, edi
mov r8d, 4
movzx eax, byte [rsp + r11 + 0x28]
shl edx, 8
inc r11
or edx, eax
cmp r11, 0x12
cmovge r11, rdi
sub r8, 1
jne 0x1fc84
lea rax, [0x00045020]
mov eax, dword [rcx + rax]
xor eax, edx
mov dword [rcx + r14], eax
add rcx, 4
cmp rcx, 0x48
jl 0x1fc7c
mov dword [rsp + 0x24], edi
mov dword [rsp + 0x20], edi
mov rbx, r14
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x24]
mov rcx, r14
call fcn.0001fa04
mov r11d, dword [rsp + 0x24]
mov eax, dword [rsp + 0x20]
mov dword [rbx], r11d
mov dword [rbx + 4], eax
add rbx, 8
cmp rbx, rsi
jl 0x1fcc5
lea rbx, [0x0006964c]
mov esi, 0x80
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x24]
mov rcx, r14
call fcn.0001fa04
mov r11d, dword [rsp + 0x24]
mov eax, dword [rsp + 0x20]
mov dword [rbx - 4], r11d
mov dword [rbx], eax
add rbx, 8
sub rsi, 1
jne 0x1fcfb
lea rax, [0x0006a64c]
cmp rbx, rax
jl 0x1fcf6
mov ebx, edi
movsxd rax, ebx
mov rcx, r14
lea rdx, [r13 + rax*4]
lea r8, [rdx + 4]
call rbp
inc edi
add ebx, 2
cmp edi, 1
jl 0x1fd34
lea rcx, [0x00063c00]
mov dl, r12b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.00040240
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1ff80
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
mov ecx, 0x1c
lea rax, [0x00052998]
mov r11b, 0xcc
lea r10d, [rcx - 0x1b]
xor byte [rax], r11b
add rax, r10
sub rcx, r10
jne 0x1ffae
lea r8d, [rcx + 0x26]
lea rax, [0x00052358]
mov rcx, r8
xor byte [rax], r11b
add rax, r10
sub rcx, r10
jne 0x1ffc7
lea rax, [0x000529b4]
mov ecx, 7
xor byte [rax], r11b
add rax, r10
sub rcx, r10
jne 0x1ffde
lea rax, [0x000529c0]
mov ecx, 0x12
xor byte [rax], r11b
add rax, r10
sub rcx, r10
jne 0x1fff5
lea r15, [0x000529d8]
lea edx, [rcx + 0x11]
mov rax, r15
mov rcx, rdx
xor byte [rax], r11b
add rax, r10
sub rcx, r10
jne 0x20010
lea r14, [0x000529f0]
mov ecx, 0xb
mov rax, r14
xor byte [rax], r11b
add rax, r10
sub rcx, r10
jne 0x2002a
lea r13, [0x00052a00]
mov ecx, 0xe
mov rax, r13
xor byte [rax], r11b
add rax, r10
sub rcx, r10
jne 0x20044
lea r12, [0x00052a10]
lea r9d, [rcx + 0x2d]
mov rax, r12
mov rcx, r9
xor byte [rax], r11b
add rax, r10
sub rcx, r10
jne 0x20060
lea rbp, [0x00052a40]
mov ecx, 0x10
mov rax, rbp
xor byte [rax], r11b
add rax, r10
sub rcx, r10
jne 0x2007a
lea rsi, [0x00052a50]
mov ecx, 0xc
mov rax, rsi
xor byte [rax], r11b
add rax, r10
sub rcx, r10
jne 0x20094
lea rdi, [0x00052a60]
mov rax, rdi
xor byte [rax], r11b
add rax, r10
sub rdx, r10
jne 0x200a9
lea rbx, [0x00052a78]
mov rax, rbx
xor byte [rax], r11b
add rax, r10
sub r8, r10
jne 0x200be
lea rdx, [0x00052aa0]
lea ecx, [r8 + 6]
mov rax, rdx
xor byte [rax], r11b
add rax, r10
sub rcx, r10
jne 0x200d7
lea rcx, [0x00052aa8]
mov rax, rcx
xor byte [rax], r11b
add rax, r10
sub r9, r10
jne 0x200ec
lea rax, [0x00052998]
mov qword [0x00063c50], rbp
mov rbp, qword [rsp + 0x30]
mov qword [0x00063c10], rax
lea rax, [0x00052358]
mov qword [0x00063c58], rsi
mov rsi, qword [rsp + 0x38]
mov qword [0x00063c18], rax
lea rax, [0x000529b4]
mov qword [0x00063c20], rax
lea rax, [0x000529c0]
mov qword [0x00063c60], rdi
mov rdi, qword [rsp + 0x40]
mov qword [0x00063c68], rbx
mov rbx, qword [rsp + 0x28]
mov qword [0x00063c28], rax
mov qword [0x00063c30], r15
mov qword [0x00063c38], r14
mov qword [0x00063c40], r13
mov qword [0x00063c48], r12
mov qword [0x00063c70], rdx
mov qword [0x00063c78], rcx
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x20238
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xc0
xor ebx, ebx
mov r13, r8
mov rsi, rcx
mov rbp, rdx
lea rcx, [rsp + 0x7c]
lea r8d, [rbx + 0x14]
xor edx, edx
mov dword [rsp + 0x78], ebx
call fcn.000407c0
xor eax, eax
lea r8d, [rbx + 0x28]
lea rcx, [rsp + 0x98]
xor edx, edx
mov r12d, ebx
mov qword [rsp + 0x108], rbx
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x6c], eax
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x90], ebx
call fcn.000407c0
mov dword [rsp + 0xf0], ebx
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x64], ebx
cmp rsi, rbx
je 0x204dd
cmp rbp, rbx
je 0x204dd
lea r8d, [rbx + 4]
lea r9, [rsp + 0xf0]
mov dl, 1
mov rcx, rsi
call sub.ntoskrnl.exe_RtlImageDirectoryEntryToData
mov r11, rax
cmp rax, rbx
je 0x204dd
mov eax, dword [rsp + 0xf0]
cmp eax, ebx
je 0x204dd
cmp eax, 0x9000
ja 0x204dd
sub rax, rsi
mov rdi, r11
sub rdi, rsi
mov esi, 0x500000
add rax, r11
cmp rax, rsi
jge 0x204dd
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x90]
lea rcx, [rsp + 0x108]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x90], 0x30
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0xa8], 0x240
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rbx
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
cmp eax, ebx
jl 0x204dd
mov rcx, qword [rsp + 0x108]
lea r9d, [rbx + 0x18]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x68]
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp eax, ebx
jl 0x204cf
mov ecx, dword [rsp + 0xf0]
mov eax, dword [rsp + 0x80]
add rcx, rdi
cmp rcx, rax
ja 0x204cf
cmp dword [rsp + 0x80], esi
ja 0x204cf
lea ecx, [rbx + 1]
mov edx, 0x9000
mov r8d, 0x20736649
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x60], edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbp, rax
cmp rax, rbx
je 0x204bc
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xf0]
xor r9d, r9d
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov edi, ebx
lea rsi, [0x00063c10]
cmp qword [rsi], rbx
je 0x204b1
mov rcx, qword [rsi]
lea edx, [rcx + 1]
mov al, byte [rcx]
inc rcx
cmp al, bl
jne 0x2046f
mov r8d, dword [rsp + 0xf0]
sub ecx, edx
mov rdx, qword [rsi]
mov r9d, ecx
mov rcx, rbp
call fcn.00020198
cmp rax, rbx
jne 0x204a2
inc edi
add rsi, 8
cmp edi, 0xe
jb 0x20464
jmp 0x204b1
mov r12d, 1
cmp r13, rbx
je 0x204b1
mov dword [r13], edi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov ebx, r12d
jmp 0x204dd
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0xf8]
add rsp, 0xc0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x20ac4
Capabilities:
Map section object

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbx
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0xb8
mov r13, rdx
xor r12d, r12d
mov qword [rsp + 0x58], r12
and qword [rdx], r12
and qword [rax + 0x20], r12
and qword [rsp + 0x60], r12
mov dword [rax - 0x70], 0x30
and qword [rax - 0x68], r12
mov dword [rax - 0x58], 0x240
mov qword [rax - 0x60], rcx
and qword [rax - 0x50], r12
and qword [rax - 0x48], r12
mov dword [rsp + 0x28], 0x60
mov dword [rsp + 0x20], 5
lea r9, [rax - 0x80]
lea r8, [rax - 0x70]
mov edx, 0x100020
lea rcx, [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov ebx, eax
test eax, eax
js 0x20c12
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x20], 0x10
xor r9d, r9d
xor r8d, r8d
lea edx, [r12 + 0xf]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_ZwCreateSection]
mov ebx, eax
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
js 0x20c0b
mov dword [rsp + 0x48], 4
and dword [rsp + 0x40], r12d
lea esi, [r12 + 1]
mov dword [rsp + 0x38], esi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], r12
and qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x108]
or rdx, 0xffffffffffffffff
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov ebx, eax
test eax, eax
jns 0x20be9
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x20c17
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0xf0], rax
jmp 0x20c17
mov esi, 1
jmp 0x20c17
mov esi, 1
test ebx, ebx
jns 0x20c22
xor al, al
jmp 0x20d0e
mov r8d, 0x10
mov rdx, rsi
mov rcx, qword [rsp + 0x100]
call fcn.00020988
test rax, rax
je 0x20ccd
mov rdx, rax
mov rcx, qword [rsp + 0x100]
call fcn.00020a8c
mov r14, rax
test rax, rax
je 0x20ccd
movzx ebx, word [rax]
lea eax, [rbx + rbx]
mov r15d, eax
mov r8d, 0x20736552
lea rdx, [rax + 4]
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r12, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x20cac
lea r8, [r15 + 4]
xor edx, edx
mov rcx, rax
call fcn.000407c0
mov r8, rbx
mov rdx, r14
mov rcx, r12
call fcn.00040300
mov dword [rbx + r12], 0x58324546
mov byte [rsp + 0x50], sil
jmp 0x20cb4
xor sil, sil
mov byte [rsp + 0x50], sil
jmp 0x20cd0
xor sil, sil
test sil, sil
jne 0x20ce7
test r12, r12
je 0x20ceb
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x20ceb
mov qword [r13], r12
mov rdx, qword [rsp + 0x100]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, sil
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbx
ret
Function at 0x218e4
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x90
mov rsi, rcx
xor ebx, ebx
mov qword [rax - 0x60], rbx
mov dword [rax + 0x10], ebx
mov rdi, rbx
mov qword [rax + 0x20], rbx
mov qword [rax + 0x18], rbx
mov ecx, 0x10000
call fcn.00021800
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x78], 0x1c0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
lea r8, [rsp + 0x60]
mov edx, 0x30019
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov esi, eax
cmp eax, ebx
jl 0x21af4
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
mov r9, qword [rsp + 0x48]
xor r8d, r8d
lea rdx, [0x00045010]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, ebx
jl 0x219e7
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x60]
mov edx, 0xf003f
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov esi, eax
cmp eax, ebx
jl 0x21af4
jmp 0x21ac4
lea rax, [rsp + 0xc8]
cmp rax, rbx
jne 0x219fe
mov esi, 0xc000000d
jmp 0x21af4
lea rcx, [rsp + 0xc8]
call fcn.00021840
mov esi, eax
cmp eax, ebx
jl 0x21aec
mov esi, ebx
mov dword [rsp + 0x40], ebx
mov rdi, qword [rsp + 0xc8]
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
mov r9, qword [rsp + 0x48]
xor r8d, r8d
mov edx, esi
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, 0x8000001a
je 0x21ac4
cmp eax, ebx
jl 0x21ac4
mov rdx, qword [rsp + 0xb0]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
mov rax, qword [rsp + 0x48]
movzx r11d, word [rax + 0xc]
mov word [rsp + 0x52], r11w
mov word [rsp + 0x50], r11w
add rax, 0x10
mov qword [rsp + 0x58], rax
cmp word [rdi], bx
jbe 0x21a9f
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.0002188c
jmp 0x21aad
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
mov rcx, rdi
call fcn.000218e4
cmp eax, ebx
jge 0x21abf
inc esi
mov dword [rsp + 0x40], esi
jmp 0x21a23
mov rax, cr8
cmp al, bl
jne 0x21ada
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_ZwFlushKey]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov esi, eax
jmp 0x21af4
mov rdi, qword [rsp + 0xc8]
cmp rdi, rbx
je 0x21b07
mov edx, 0x6e72654b
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbx
je 0x21b1a
call qword [sym.imp.ntoskrnl.exe_NtClose]
mov rax, qword [rsp + 0x48]
cmp rax, rbx
je 0x21b32
mov edx, 0x6e72654b
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret
Function at 0x21b48
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov dword [rax + 8], ebx
mov rdi, rbx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
lea rdx, [0x00041740]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00041780]
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x000417a0]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
nop
mov ecx, 0x10000
call fcn.00021800
mov r13, rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x78], 0x1c0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
lea r8, [rsp + 0x60]
mov edx, 0x20019
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov esi, eax
cmp eax, ebx
jl 0x21d32
lea rax, [rsp + 0xe8]
cmp rax, rbx
jne 0x21c25
mov esi, 0xc000000d
jmp 0x21d32
lea rcx, [rsp + 0xe8]
call fcn.00021840
mov esi, eax
cmp eax, ebx
jl 0x21d2a
mov r12d, ebx
mov dword [rsp + 0x30], ebx
mov rdi, qword [rsp + 0xe8]
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
mov r9, r13
xor r8d, r8d
mov edx, r12d
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov esi, eax
cmp eax, 0x8000001a
jne 0x21c87
mov esi, ebx
jmp 0x21d32
cmp eax, ebx
jl 0x21d32
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
movzx r11d, word [r13 + 0xc]
mov word [rsp + 0x42], r11w
mov word [rsp + 0x40], r11w
lea rax, [r13 + 0x10]
mov qword [rsp + 0x48], rax
cmp word [rdi], bx
jbe 0x21ccb
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.0002188c
jmp 0x21cd9
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rdx, [rsp + 0xa0]
mov rcx, rdi
call fcn.0001f6e0
cmp ax, word [rdi]
jae 0x21cf0
jmp 0x21d1d
lea rdx, [rsp + 0x90]
mov rcx, rdi
call fcn.0001f6e0
cmp ax, word [rdi]
jae 0x21d1d
lea rdx, [0x00062950]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
mov rcx, rdi
call fcn.000218e4
inc r12d
mov dword [rsp + 0x30], r12d
jmp 0x21c4b
mov rdi, qword [rsp + 0xe8]
cmp rdi, rbx
je 0x21d45
mov edx, 0x6e72654b
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0xf0]
cmp rcx, rbx
je 0x21d58
call qword [sym.imp.ntoskrnl.exe_NtClose]
cmp r13, rbx
je 0x21d6b
mov edx, 0x6e72654b
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
add rsp, 0xb0
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x22478
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xc0
xor ebx, ebx
mov edx, 0x400
lea ecx, [rbx + 1]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
cmp rax, rbx
jne 0x224a4
xor eax, eax
jmp 0x2255e
xor edx, edx
mov r8d, 0x400
mov rcx, rax
call fcn.000407c0
mov eax, 0x200
lea rdx, [0x000418c0]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x38], rdi
mov word [rsp + 0x30], bx
mov word [rsp + 0x32], ax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x50]
call fcn.000407c0
mov rdx, qword [rsp + 0x48]
lea rax, [0x00041940]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x50]
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x58], 0x24
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x80], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp eax, ebx
jl 0x22551
movzx r8d, word [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
lea rcx, [0x00064210]
call fcn.00040300
mov ebx, 1
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret

Function at 0x22b38
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x0006209c], 0
mov rbx, rcx
jne 0x22bd4
call fcn.0001a7f4
test eax, eax
je 0x22bd4
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x22bd4
cmp dword [rbx + 0x3c], 0xffff
jg 0x22bd4
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x22bd4
movsxd rcx, dword [rbx + 0x3c]
mov eax, 0x4550
cmp dword [rcx + rbx], eax
jne 0x22bd4
mov eax, 0x10b
cmp word [rcx + rbx + 0x18], ax
je 0x22b9d
mov eax, 0x20b
cmp word [rcx + rbx + 0x18], ax
jne 0x22bd4
movzx eax, word [rcx + rbx + 0x5c]
mov edx, dword [rcx + rbx + 0x28]
and eax, 1
je 0x22bd4
add rbx, rdx
mov edx, 0x10
mov rcx, rbx
call fcn.0001a7f4
test eax, eax
je 0x22bd4
lea rdx, [0x00061cf8]
mov r8d, 0x10
mov rcx, rbx
call fcn.0001a728
add rsp, 0x20
pop rbx
ret