joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005a3c0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x1005a3f3
push esi
call fcn.10068770
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x1005a3ec
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x1005a479
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x1005a462
mov eax, dword [esi + 8]
test eax, eax
je 0x1005a417
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x1005a45e
cmp eax, 2
je 0x1005a462
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1005a40a
cmp eax, 3
je 0x1005a43d
cmp eax, 1
jne 0x1005a40a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x1005a40a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x1005a40a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.1005a4a0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x1005a488
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.1005a4a0
add esp, 4
pop esi
ret

Function at 0x1005ad10
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x1005ad31
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x1005ad31
mov eax, dword [eax + 0x44]
test eax, eax
je 0x1005ad31
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1005b180
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x1005b18b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x1005b28e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x10585d60]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10585d60]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10585d60]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10585d60]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10585d60]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10585d60]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10585d60]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x10585d60]
xor eax, edx
inc ecx
dec edi
jne 0x1005b1a6
pop edi
test esi, esi
je 0x1005b2b0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x10585d60]
xor eax, edx
inc ecx
dec esi
jne 0x1005b292
pop esi
pop ebx
not eax
ret
Function at 0x10075a70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push ebx
push esi
push edi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.d3d9.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Direct3DCreate9
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push 0x105d23fc
lea eax, [esp + 0x14]
and ecx, 3
push 1
push eax
rep movsb byte es:[edi], byte [esi]
push 0x105d2404
call fcn.10075b20
add esp, 0x14
test al, al
pop edi
pop esi
pop ebx
jne 0x10075af2
push 0x105ae67c
call fcn.10075b00
add esp, 4
xor eax, eax
add esp, 0x104
ret
mov eax, 1
add esp, 0x104
ret

Function at 0x10076480
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x10076523
test eax, eax
jbe 0x10076523
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x10076523
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x100764ce
xor esi, esi
jmp 0x100764d4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x100764ff
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.10016850
add esi, eax
push esi
mov ebx, esi
call fcn.10016850
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x100764e0
pop ebp
test edi, edi
pop edi
jne 0x10076523
test ebx, ebx
je 0x10076523
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.1008d750
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x10076640
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x1007675d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1007675d
mov eax, dword [esi + 0x3c]
push eax
call fcn.1009e475
mov esi, eax
test esi, esi
je 0x1007675d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x1007675d
mov ecx, esi
call fcn.100765d0
cmp edi, eax
jge 0x1007675d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x100766e3
mov dword [esp + 0x34], 1
jmp 0x1007673e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x1007675d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.10075bd0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x100787a0
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3c]
test esi, esi
push edi
jne 0x100787bc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x100787d8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x18]
test eax, eax
mov dword [esp + 0x2c], ecx
je 0x10078811
mov dx, word [eax]
mov ax, word [eax + 4]
mov word [esp + 0x40], dx
mov word [esp + 0x42], ax
mov ecx, dword [esp + 0x40]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x10078811
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x14]
cmp eax, 1
je 0x10078822
mov ebp, dword [esp + 0x34]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
and edx, 0xffff
and eax, 0xffff
push edx
push eax
call fcn.100786b0
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
add esp, 8
push eax
push edi
call ebx
test eax, eax
jne 0x10078855
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push esi
call fcn.100786d0
mov esi, eax
add esp, 4
test esi, esi
je 0x10078873
push esi
call fcn.1008ef3b
push esi
call fcn.1008d84e
add esp, 8
cmp dword [esp + 0x34], 1
jne 0x1007888e
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x1007888e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov ecx, dword [esp + 0x2c]
push ecx
push edi
call ebx
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x18
ret
Function at 0x1007c9a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x1007cac1
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x1007caa5
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x1007c9f7
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x1007c9d5
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18

Function at 0x1007d509
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1007d560
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x1007d560
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x1007d560
xor eax, eax
inc eax
jmp 0x1007d562
xor eax, eax
leave
ret 0x10
Function at 0x1007d58b
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x1007d5f9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x1058b57c
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1007d5f0
cmp dword [ebp - 0xc], 4
jne 0x1007d5f0
cmp dword [ebp - 0x10], edi
je 0x1007d5f0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x105aff88], edi
xor eax, eax
jmp 0x1007d638
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x105aff88], edi
jge 0x1007d633
lea eax, [ebp - 0x34]
push eax
mov dword [0x105aff88], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x1007d633
cmp word [ebp - 0x14], 5
jb 0x1007d633
call fcn.1007d566
test eax, eax
je 0x1007d633
emms
mov dword [0x105aff88], 1
mov eax, dword [0x105aff88]
pop edi
leave
ret

Function at 0x1009ee19
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1009ee51
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.1009cecd
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.1009cea5
jmp 0x1009ee5d
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x100a0507
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x100a0549
call fcn.100a5fda
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x100a0549
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x100a0540
xor eax, eax
jmp 0x100a0551
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.100a0557
pop edi
pop esi
pop ebx
ret 4
Function at 0x10001210
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, eax
push esi
xor ebx, ebx
push 0x10001690
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
push 0x1fffff
lea edi, [esi + 4]
push edi
mov dword [ebp - 0x18], 0x18
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], 0x200
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
cmp eax, ebx
jl 0x10001298
mov edx, dword [sym.imp.ntoskrnl.exe_PsThreadType]
mov eax, dword [edx]
push ebx
lea ecx, [esi + 8]
push ecx
mov ecx, dword [edi]
push ebx
push eax
push 0x1fffff
push ecx
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov ebx, eax
test ebx, ebx
jge 0x10001287
call fcn.100011b0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [edi], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001990
Capabilities:
Find process by pid

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
xor esi, esi
lea eax, [ebp - 8]
push eax
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x28], 0x18
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jl 0x10001a2a
cmp dword [ebp - 8], esi
je 0x10001a2a
lea ebx, [ebp - 8]
mov ecx, edi
call fcn.10001cb0
test eax, eax
jl 0x10001a2a
cmp dword [ebp - 8], esi
je 0x10001a2a
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x28]
push edx
push 1
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
test eax, eax
jl 0x10001a18
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x10001a18
push esi
push eax
call dword [sym.imp.ntoskrnl.exe_ZwTerminateProcess]
test eax, eax
jge 0x10001a20
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001a40
Capabilities:
Find process by pid
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
mov al, 1
push edi
mov byte [ebp - 1], al
cmp dword [ebp + 8], esi
je 0x10001b15
mov eax, 4
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jl 0x10001af1
mov ecx, dword [ebp - 8]
mov edi, ecx
test ecx, ecx
je 0x10001af1
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push edi
call dword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov ebx, eax
mov eax, edi
mov dword [ebp - 0x10], ebx
call fcn.100017d0
mov edx, dword [ebp + 8]
push edx
mov esi, eax
push esi
push edi
call dword [sym.imp.ntoskrnl.exe_PsGetProcessInheritedFromUniqueProcessId]
push eax
push ebx
push edi
push str.KillProcessByName_EProcess_p_ProcessId_u_ParentProcessId_u_ProcessFile_wZ_ProcName_ws_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 0x18
mov ecx, esi
call fcn.10002060
test al, al
je 0x10001af1
mov ebx, dword [ebp + 8]
mov eax, esi
call fcn.100020f0
test al, al
je 0x10001af1
mov edi, dword [ebp - 0x10]
mov eax, dword [esi + 4]
push edi
push eax
push str.Kill_ProcessName_ws_ProcessId_u
call sub.ntoskrnl.exe_DbgPrint
add esp, 0xc
call fcn.10001990
test al, al
jne 0x10001af1
mov byte [ebp - 1], al
mov eax, dword [ebp - 0xc]
add eax, 4
mov dword [ebp - 0xc], eax
cmp eax, 0x186a0
jb 0x10001a61
test esi, esi
je 0x10001b12
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10001b20
Capabilities:
Find process by pid
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push edi
xor ecx, ecx
push 0x206
xor eax, eax
push ecx
lea edx, [ebp - 0x222]
push edx
mov word [ebp - 0x10], ax
mov dword [ebp - 0xe], eax
mov word [ebp - 0xa], ax
mov byte [ebp - 5], 1
mov word [ebp - 0x224], cx
call sub.ntoskrnl.exe_memset
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x10001b6c
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, 4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
push ecx
push eax
mov dword [ebp - 0x18], 0
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jl 0x10001c7c
mov ecx, dword [ebp - 0x18]
mov esi, ecx
test ecx, ecx
je 0x10001c7c
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push esi
call dword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov edi, eax
lea ebx, [ebp - 0x10]
mov ecx, edi
call fcn.100018b0
cmp eax, 0x80000005
jne 0x10001be0
push 0x6b4d4d
push 0x400
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edx, 0x400
mov ecx, edi
mov dword [ebp - 0xc], eax
mov word [ebp - 0xe], dx
call fcn.100018b0
test eax, eax
jl 0x10001c7c
lea ecx, [ebp - 0x10]
call fcn.10002060
test al, al
je 0x10001c7c
mov ebx, dword [ebp + 8]
push ebx
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_PsGetProcessInheritedFromUniqueProcessId]
push eax
push edi
push esi
push str.EProcess_p_ProcessId_u_ParentProcessId_u_ProcessPath_wZ_ProcPath_ws_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 0x18
push ebx
lea eax, [ebp - 0x224]
call fcn.10001f50
test al, al
je 0x10001c7c
lea eax, [ebp - 0x224]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001c30
sub eax, edx
mov edx, dword [ebp - 0xc]
sar eax, 1
push eax
lea ecx, [ebp - 0x224]
push ecx
push edx
call sub.ntoskrnl.exe__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x10001c7c
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x224]
push eax
push ecx
push edi
push str.Kill_ProcessId_u_ProcessPath_ws_ParentDosPath_ws
call sub.ntoskrnl.exe_DbgPrint
add esp, 0x10
call fcn.10001990
test al, al
jne 0x10001c7c
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
cmp eax, 0x186a0
jb 0x10001b74
mov edx, dword [ebp - 0xc]
push 0
push edx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100022f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, eax
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
push edi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
xor edi, edi
mov dword [esi + 0x24], eax
push edi
lea eax, [esi + 8]
push 1
lea ebx, [esi + 0x14]
mov dword [eax + 4], eax
mov dword [eax], eax
push ebx
mov dword [esi + 0x10], edi
call dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
push esi
push 0x10002150
push 0
push 0
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
push 0x1fffff
lea edi, [esi + 4]
push edi
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x14], 0x200
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov dword [ebp - 4], eax
test eax, eax
jge 0x10002389
push eax
push str.Cant_create_thread_Status_0x_x
push 3
call fcn.100017a0
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [sym.imp.ntoskrnl.exe_PsThreadType]
mov edx, dword [ecx]
mov eax, dword [edi]
push 0
push esi
push 0
push edx
push 0x1fffff
push eax
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [ebp - 4], eax
test eax, eax
jge 0x100023f5
push eax
push str.Cant_create_thread_Status_0x_x
push 3
call fcn.100017a0
add esp, 0xc
mov byte [esi + 0x24], 1
xchg dword [ebp - 8], eax
push 0
push 0
push ebx
call dword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov ecx, dword [edi]
push 0
push 0
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
mov edx, dword [edi]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov esi, dword [esi]
test esi, esi
je 0x100023f2
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret