joyce8/EMBER2024-capa huggingface dataset:
Function at 0x19a24
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push 0x2c
push 0x2cf08
call fcn.00027450
xor esi, esi
mov dword [ebp - 0x1c], esi
mov ebx, 0xc000000d
mov dword [ebp - 0x3c], esi
xor eax, eax
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x24], esi
cmp dword [ebp + 8], esi
je 0x19b1c
cmp dword [ebp + 0xc], esi
je 0x19b1c
mov edi, dword [ebp + 0x10]
cmp edi, esi
je 0x19b1c
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
cmp ebx, esi
jl 0x19b1c
cmp dword [ebp - 0x1c], esi
je 0x19b1c
push dword [ebp - 0x1c]
call sub.ntoskrnl.exe_PsGetProcessPeb
mov esi, eax
test esi, esi
jne 0x19a9c
mov ebx, 0xc0000001
jmp 0x19b1a
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp dword [ebp + 8], eax
je 0x19abb
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov dword [ebp - 0x24], 1
and dword [ebp - 4], 0
mov eax, dword [0x34314]
mov eax, dword [eax + esi]
mov ecx, dword [0x34340]
mov edx, dword [ecx + eax]
mov ecx, dword [0x3433c]
add ecx, eax
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x20], ecx
test dl, 1
jne 0x19ae6
add dword [ebp - 0x20], eax
push dword [ebp - 0x20]
call fcn.0001fb1e
pop ecx
cmp eax, edi
jb 0x19af6
lea eax, [edi - 1]
push eax
push dword [ebp - 0x20]
push dword [ebp + 0xc]
call fcn.0001fb4c
add esp, 0xc
jmp 0x19b13
mov dword [ebp - 4], 0xfffffffe
xor esi, esi
cmp dword [ebp - 0x24], esi
je 0x19b2b
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov ecx, dword [ebp - 0x1c]
cmp ecx, esi
je 0x19b38
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
call fcn.00027495
ret 0xc
Function at 0x1b2c2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
push esi
test edx, edx
je 0x1b3b1
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1b3b1
mov eax, dword [ebp + 8]
push edi
not eax
mov ecx, 0xff
cmp esi, 8
jb 0x1b393
mov edi, esi
shr edi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x305c0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x305c0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x305c0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x305c0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x305c0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x305c0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x305c0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x305c0]
inc edx
sub esi, 8
dec edi
jne 0x1b2f8
pop ebx
test esi, esi
je 0x1b3ac
movzx edi, byte [edx]
xor edi, eax
and edi, ecx
shr eax, 8
xor eax, dword [edi*4 + 0x305c0]
inc edx
dec esi
jne 0x1b397
not eax
pop edi
jmp 0x1b3b3
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x1b3be
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0x3c
xor esi, esi
push esi
push 0x34308
call sub.ntoskrnl.exe_memset
add esp, 0xc
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov ecx, dword [0x34338]
push 2
and ecx, 0xfffffffe
pop eax
or ecx, eax
cmp dword [ebp - 8], 6
mov dword [0x3432c], esi
mov dword [0x34328], 0x2c
mov dword [0x34338], ecx
jne 0x1b4bc
cmp dword [ebp - 4], 1
jne 0x1b45e
push 0x10
pop eax
mov dword [0x34310], 0x1a8
mov dword [0x34314], eax
mov dword [0x34318], 0x41
mov dword [0x3431c], 0x30
mov dword [0x34330], 0x4e
jmp 0x1b4fa
cmp dword [ebp - 4], esi
jne 0x1b53d
push 8
pop eax
push 0x18
pop ecx
push 0x1a
mov word [0x34320], cx
pop ecx
mov dword [0x34308], eax
mov dword [0x34310], 0x188
mov dword [0x34314], 0x10
mov dword [0x34318], 0x42
mov dword [0x3431c], 0x30
mov word [0x34322], cx
mov dword [0x34330], 0x50
mov dword [0x34340], eax
jmp 0x1b51b
cmp dword [ebp - 8], 5
jne 0x1b53d
cmp dword [ebp - 4], 1
jne 0x1b53d
mov dword [0x34310], 0x1b0
mov dword [0x34314], 0x10
mov dword [0x34318], 0x42
mov dword [0x3431c], 0x28
mov dword [0x34330], 0x50
push 0x18
mov dword [0x34308], eax
pop eax
push 0x1a
mov word [0x34320], ax
pop eax
mov dword [0x34340], 8
mov word [0x34322], ax
mov dword [0x34324], 0xc
mov dword [0x34334], 0x2d
mov dword [0x3433c], 0x38
mov al, 1
jmp 0x1b53f
xor al, al
pop esi
leave
ret
Function at 0x1b724
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
xor eax, eax
mov word [ebp - 0x10], ax
push ebx
push edi
lea edi, [ebp - 0xe]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x30], ebx
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
call dword [sym.imp.HAL.dll_KeGetCurrentIrql]
test al, al
jne 0x1b7dc
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x29758
lea eax, [ebp - 0x10]
push eax
call esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
push 0x20006
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0x240
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
mov dword [ebp - 8], eax
jl 0x1b7db
push 0x2974c
lea eax, [ebp - 0x18]
push eax
call esi
push 4
lea eax, [ebp + 8]
push eax
push 4
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.ntoskrnl.exe_ZwFlushKey]
pop esi
cmp dword [ebp - 4], ebx
pop edi
pop ebx
je 0x1b7ec
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp - 8]
leave
ret 4
Function at 0x1bab2
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
and dword [ebp - 0x34], 0
xor eax, eax
push esi
push edi
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x14], ax
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosw word es:[edi], ax
test esi, esi
jne 0x1baf9
mov dword [ebp - 8], 0xc000000d
jmp 0x1bc58
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1bafe
sub eax, edx
sar eax, 1
mov edi, eax
push edi
push esi
mov dword [ebp - 0xc], edi
call fcn.0001fcba
push 0x5c
lea eax, [esi + edi*2 - 2]
pop ecx
cmp cx, word [eax]
jne 0x1bb2c
xor ecx, ecx
dec dword [ebp - 0xc]
mov word [eax], cx
mov esi, dword [sym.imp.HAL.dll_ExAcquireFastMutex]
push ebx
mov ebx, 0x34568
mov ecx, ebx
call esi
push 0x208
push 0
mov edi, 0x34360
push edi
call sub.ntoskrnl.exe_memset
push 0x103
push dword [ebp + 8]
push edi
call fcn.0001fb4c
mov edi, dword [sym.imp.HAL.dll_ExReleaseFastMutex]
add esp, 0x18
mov ecx, ebx
call edi
mov ebx, 0x34790
mov ecx, ebx
call esi
push 0x208
push 0
mov esi, 0x34588
push esi
call sub.ntoskrnl.exe_memset
push dword [ebp + 8]
push 0x297d4
push 0x103
push esi
call fcn.00012e72
add esp, 0x1c
mov ecx, ebx
call edi
mov eax, dword [0x3435c]
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
test eax, eax
je 0x1bbb1
mov ebx, eax
jmp 0x1bbbe
lea ebx, [ebp - 0x1c]
push 0x29758
mov eax, ebx
push eax
call edi
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x34]
push eax
push 0x20006
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x34], 0x18
mov dword [ebp - 0x28], 0x240
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [ebp - 8], eax
test eax, eax
jl 0x1bc48
push 0x29822
lea eax, [ebp - 0x14]
push eax
call edi
mov eax, dword [ebp - 0xc]
mov ebx, dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
add eax, eax
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push 1
push 0
push eax
push dword [ebp - 4]
call ebx
mov dword [ebp - 8], eax
test eax, eax
jl 0x1bc48
push 0x29814
lea eax, [ebp - 0x14]
push eax
call edi
push esi
call fcn.0001fb1e
pop ecx
add eax, eax
push eax
push esi
push 1
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call ebx
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
pop ebx
je 0x1bc58
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 4
Function at 0x1c376
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x30f04]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
call sub.ntoskrnl.exe_memset
push ebx
push 0x298b8
lea eax, [ebp - 0x20c]
push 0x103
push eax
mov dword [edi], esi
call fcn.00012e72
add esp, 0x1c
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x18
pop ebx
push 0x100
push esi
push esi
push esi
push esi
push 0x60
push 1
push 1
push 0x80
lea eax, [ebp - 0x240]
mov dword [ebp - 0x230], eax
push esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x238]
push eax
push 0x80100000
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x22c], 0x240
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x224], esi
call dword [sym.imp.ntoskrnl.exe_IoCreateFile]
test eax, eax
jl 0x1c4db
push 5
push ebx
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jl 0x1c4db
cmp dword [ebp - 0x250], 0x600000
jae 0x1c4db
push 0x5349474e
push dword [ebp - 0x250]
push esi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x214], eax
cmp eax, esi
je 0x1c4db
push esi
push esi
push dword [ebp - 0x250]
push eax
lea eax, [ebp - 0x220]
push eax
push esi
push esi
push esi
push dword [ebp - 0x210]
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
jl 0x1c4db
mov eax, dword [ebp - 0x250]
mov dword [edi], eax
mov dword [ebp - 0x218], 1
cmp dword [ebp - 0x210], esi
je 0x1c4f5
push dword [ebp - 0x210]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [ebp - 0x210], esi
cmp dword [ebp - 0x218], esi
jne 0x1c518
cmp dword [ebp - 0x214], esi
je 0x1c518
push esi
push dword [ebp - 0x214]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [ebp - 0x214], esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0002738c
leave
ret 8
Function at 0x1c534
Capabilities:
Parse pe header

Disassembly:
push 0x2c
push 0x2cfc8
call fcn.00027774
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov dword [eax], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
lea edi, [esi + 0x3c]
cmp esi, ecx
je 0x1c689
push esi
mov ebx, dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
call ebx
test al, al
je 0x1c689
push edi
call ebx
test al, al
je 0x1c689
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1c689
mov edi, dword [edi]
add edi, esi
je 0x1c689
push edi
call ebx
test al, al
je 0x1c689
lea eax, [edi + 0xf8]
push eax
call ebx
test al, al
je 0x1c689
cmp dword [edi], 0x4550
jne 0x1c689
cmp word [edi + 6], 4
ja 0x1c689
mov eax, dword [edi + 0x28]
mov dword [ebp - 0x34], eax
cmp dword [esi + 0x28], eax
jb 0x1c689
movzx eax, word [edi + 0x14]
lea eax, [eax + edi + 0x18]
mov dword [ebp - 0x38], eax
and dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0x2c]
cmp cx, word [edi + 6]
jae 0x1c689
movzx ecx, cx
imul ecx, ecx, 0x28
lea esi, [ecx + eax]
lea ebx, [esi + 0x28]
test eax, eax
je 0x1c689
push eax
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1c689
push ebx
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1c689
mov eax, dword [esi]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
cmp byte [esi], 0x2e
jne 0x1c677
cmp byte [esi + 1], 0x74
jne 0x1c677
cmp byte [esi + 2], 0x65
jne 0x1c677
cmp byte [esi + 3], 0x78
jne 0x1c677
cmp al, 0x74
jne 0x1c677
cmp byte [esi + 5], 0
jne 0x1c677
cmp byte [esi + 6], 0
jne 0x1c677
cmp byte [esi + 7], 0
jne 0x1c677
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 0x34]
cmp ecx, eax
jbe 0x1c677
mov edx, dword [esi + 0x10]
add edx, eax
cmp ecx, edx
jae 0x1c677
mov eax, dword [ebp - 0x3c]
mov dword [eax], ecx
mov dword [ebp - 0x30], 1
jmp 0x1c689
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
jmp 0x1c5e3
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x30]
call fcn.000277bc
ret 8
Function at 0x1cd4c
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push 0x2c
push 0x2cfe8
call fcn.00027450
xor esi, esi
cmp dword [ebp + 0x10], esi
je 0x1ce87
mov ebx, dword [ebp + 0x14]
cmp ebx, esi
je 0x1ce87
cmp dword [ebp + 8], esi
je 0x1ce87
mov byte [ebp - 0x19], 0
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x3c], esi
xor eax, eax
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp dword [ebp + 0xc], 4
je 0x1ce66
cmp dword [ebp + 0xc], esi
je 0x1ce66
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, esi
jne 0x1ce66
mov eax, dword [ebp - 0x20]
cmp eax, esi
je 0x1ce66
mov ecx, dword [0x34310]
mov esi, dword [ecx + eax]
test esi, esi
je 0x1ce66
lea ecx, [ebp - 0x3c]
push ecx
push eax
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and dword [ebp - 4], 0
mov eax, dword [0x34324]
mov eax, dword [eax + esi]
test eax, eax
je 0x1ce3a
add eax, 0xc
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
test esi, esi
je 0x1ce3a
cmp esi, eax
je 0x1ce3a
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 0x18]
jb 0x1ce43
mov edx, dword [esi + 0x20]
add edx, dword [esi + 0x18]
cmp ecx, edx
jae 0x1ce43
movzx edi, word [esi + 0x24]
shr edi, 1
cmp edi, ebx
jb 0x1ce19
lea edi, [ebx - 1]
lea eax, [ebx + ebx]
push eax
push 0
push dword [ebp + 0x10]
call sub.ntoskrnl.exe_memset
push edi
push dword [esi + 0x28]
push dword [ebp + 0x10]
call fcn.0001fb4c
add esp, 0x18
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0xfffffffe
jmp 0x1ce5c
mov esi, dword [esi]
jmp 0x1cdef
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
cmp byte [ebp - 0x19], 0
jne 0x1ce75
push ebx
push dword [ebp + 0x10]
call fcn.0001cb28
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x1ce82
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, byte [ebp - 0x19]
jmp 0x1ce89
xor al, al
call fcn.00027495
ret 0x10

Function at 0x1ce96
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x30f04]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov eax, 0x347b0
push 0
push 0x347b8
mov dword [0x347b4], eax
mov dword [0x347b0], eax
call dword [sym.imp.ntoskrnl.exe_KeInitializeMutex]
xor esi, esi
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call sub.ntoskrnl.exe_memset
push 0x3f
push dword [esi + 0x309c0]
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.ntoskrnl.exe_wcsncpy]
lea eax, [ebp - 0x84]
add esp, 0x18
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1cf19
sub eax, ecx
sar eax, 1
push 0
pop ecx
je 0x1cf3a
xor word [ebp + ecx*2 - 0x84], 0x7b
inc ecx
cmp ecx, eax
jb 0x1cf2c
lea eax, [ebp - 0x84]
push eax
call fcn.0001c8d8
add esi, 4
cmp esi, 0x24
jb 0x1cee5
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0002738c
leave
ret
Function at 0x1d4b0
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push edi
xor edx, edx
xor eax, eax
lea edi, [ebp - 4]
push 9
mov dword [ebp - 8], edx
stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], edx
rep stosd dword es:[edi], eax
pop edi
cmp dword [ebp + 8], edx
jne 0x1d4d9
xor al, al
jmp 0x1d4f8
push 4
push 0x28
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jne 0x1d4d5
mov eax, dword [ebp - 0x10]
and eax, 0x10
leave
ret 4

Function at 0x1d63c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x30f04]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor eax, eax
mov word [ebp - 0x218], ax
lea edi, [ebp - 0x216]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
mov byte [ebp - 0x20d], bl
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp + 8]
add esp, 0xc
lea eax, [ebp - 0x218]
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x24c], 0x30
mov dword [ebp - 0x248], 0x299d2
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
cmp ecx, ebx
je 0x1d7a3
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x1d7a3
mov dword [ebp - 0x214], ecx
xor ecx, ecx
add eax, eax
push 0x29950
mov word [ebp - 0x218], cx
mov word [ebp - 0x216], ax
call fcn.0001fb1e
pop ecx
mov ecx, 0x103
mov edi, eax
cmp eax, ecx
jb 0x1d733
mov edi, ecx
push esi
xor esi, esi
cmp edi, ebx
jbe 0x1d77f
movzx ecx, word [esi*2 + 0x29950]
cmp cx, bx
je 0x1d77f
xor ecx, 0x7d
mov dl, cl
shr dl, 4
mov bl, cl
lea eax, [ebp + esi*2 - 0x20c]
mov word [eax], cx
and dl, 7
and bl, 0x88
and cl, 7
or dl, bl
movzx cx, cl
movzx dx, dl
shl cx, 4
or dx, cx
inc esi
xor ebx, ebx
mov word [eax], dx
cmp esi, edi
jb 0x1d73a
push ebx
push ebx
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x20c]
push eax
push 5
call dword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
pop esi
test eax, eax
jl 0x1d7a3
mov byte [ebp - 0x20d], 1
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x20d]
pop edi
xor ecx, ebp
pop ebx
call fcn.0002738c
leave
ret 8
Function at 0x1fd04
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
xor eax, eax
mov word [ebp - 0x10], ax
push ebx
push edi
lea edi, [ebp - 0xe]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x30], ebx
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 1], bl
mov dword [ebp - 8], ebx
stosd dword es:[edi], eax
cmp dword [ebp + 0xc], ebx
je 0x1fe5a
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x1fe59
cmp word [eax], bx
je 0x1fe59
cmp word [esi], 0xc
jb 0x1fe59
cmp dword [ebp + 0x10], 0x60
jb 0x1fe59
push 4
push 0x291a6
push eax
call dword [sym.imp.ntoskrnl.exe__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x1fe4b
movzx edi, word [esi]
mov eax, dword [esi + 4]
movzx ecx, di
push 0x5c
shr ecx, 1
pop edx
cmp dx, word [eax + ecx*2 - 2]
jne 0x1fda1
add edi, 0xfffe
movzx ecx, di
shr ecx, 1
push 0x5c
sub ecx, 4
push ecx
add eax, 8
push eax
call fcn.0001facc
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x1fe4b
mov cx, word [esi + 2]
inc eax
inc eax
mov dword [ebp - 0xc], eax
sub eax, dword [esi + 4]
push 0x21
sar eax, 1
add eax, eax
sub edi, eax
sub cx, ax
mov word [esi], ax
push 3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x100001
lea eax, [ebp - 8]
push eax
mov word [ebp - 0x10], di
mov word [ebp - 0xe], cx
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0x240
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
jl 0x1fe4b
xor eax, eax
push 1
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push 1
push 3
push dword [ebp + 0x10]
lea eax, [ebp - 0x18]
push dword [ebp + 0xc]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryDirectoryFile]
test eax, eax
jl 0x1fe4b
mov byte [ebp - 1], 1
cmp dword [ebp - 8], ebx
je 0x1fe59
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop esi
mov al, byte [ebp - 1]
pop edi
pop ebx
leave
ret 0xc
Function at 0x22c3e
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x22d84
cmp dword [ebp + 0xc], ebx
je 0x22d84
cmp dword [ebp + 0x10], ebx
je 0x22d84
xor eax, eax
mov word [ebp - 0x1c], ax
push esi
push edi
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
push dword [ebp + 8]
mov word [ebp - 0x14], ax
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0x34], ebx
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 4], ebx
xor edi, edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], 1
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x34], 0x18
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], 0x240
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
cmp byte [ebp + 0x18], bl
je 0x22cdb
mov dword [ebp - 8], 3
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
mov dword [ebp + 8], eax
jl 0x22d63
push 0x5a5a4d4d
mov esi, 0x800
push esi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
cmp edi, ebx
je 0x22d63
push esi
push ebx
push edi
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push esi
push edi
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, ebx
mov dword [ebp + 8], eax
jl 0x22d63
mov eax, dword [edi + 8]
cmp dword [ebp + 0x14], eax
jb 0x22d4a
push eax
lea eax, [edi + 0xc]
push eax
push dword [ebp + 0x10]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
cmp byte [ebp + 0x18], bl
je 0x22d63
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov byte [0x34b94], 1
cmp dword [ebp - 4], ebx
je 0x22d71
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp edi, ebx
je 0x22d7d
push ebx
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp + 8]
pop edi
pop esi
jmp 0x22d89
mov eax, 0xc000000d
pop ebx
leave
ret 0x14