joyce8/EMBER2024-capa huggingface dataset:
Function at 0x125d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 8]
push eax
push 0xa
lea ecx, [ebp - 0x20]
push ecx
push 0xb
call dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 8]
push edx
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x12721
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0xb
call dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x12715
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 4]
add edx, 4
mov dword [ebp - 0xc], edx
push 0x19180
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe__stricmp]
add esp, 8
test eax, eax
jne 0x12682
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x2c], edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 0x2c]
jmp 0x12723
mov dword [ebp - 0x10], 0
jmp 0x12694
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x24]
jae 0x12715
push 0x5c
mov eax, dword [ebp - 0xc]
add eax, 0x1c
push eax
call fcn.00011110
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x126c1
mov ecx, dword [ebp - 0xc]
add ecx, 0x1c
mov dword [ebp - 0x14], ecx
jmp 0x126ca
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ntoskrnl.exe__stricmp]
add esp, 8
test eax, eax
jne 0x12704
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
mov dword [ecx], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 0x2c]
jmp 0x12723
mov edx, dword [ebp - 0xc]
add edx, 0x11c
mov dword [ebp - 0xc], edx
jmp 0x1268b
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x12ee0
Capabilities:
Find process by pid

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x12f28
mov ecx, dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov edx, dword [ebp - 0xc]
push edx
call fcn.00012190
test eax, eax
jne 0x12f24
mov eax, dword [ebp - 0xc]
push eax
call fcn.00012110
test eax, eax
je 0x12f28
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret 4
Function at 0x14450
Capabilities:
Get system information on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov dword [ebp - 8], 0xc0000001
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
jne 0x1447d
mov eax, 0xc000000d
jmp 0x14534
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0xb
call dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xc0000004
je 0x144a7
mov eax, 0xc0000001
jmp 0x14534
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x144c3
mov eax, 0xc0000001
jmp 0x14534
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
push 0xb
call dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x144f3
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0xc0000001
jmp 0x14534
mov esi, dword [ebp - 4]
add esi, 4
mov ecx, 0x47
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x1c
push ecx
push str.GetKernelModuleInfo_ImageName:__s__Base:_0x_08x__Size:_0x_08x_n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 0x10
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x14b20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov byte [ebp - 5], 0
call dword [sym.imp.HAL.dll_KeGetCurrentIrql]
movzx eax, al
cmp eax, 1
jle 0x14b75
call dword [sym.imp.HAL.dll_KeGetCurrentIrql]
movzx ecx, al
push ecx
push str.EX:_Pageable_code_called_at_IRQL__d_n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 8
mov edx, 1
test edx, edx
je 0x14b6e
call fcn.00011130
mov dword [ebp - 0xc], 0
jmp 0x14b75
mov dword [ebp - 0xc], 1
push 0x63666c73
push 0x10
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x14b8f
jmp 0x14bba
xor eax, eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 1
mov byte [ebp - 5], 1
xor edx, edx
jne 0x14b75
movzx eax, byte [ebp - 5]
test eax, eax
jne 0x14bd6
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00014810
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x14be0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.HAL.dll_KeGetCurrentIrql]
movzx eax, al
cmp eax, 1
jle 0x14c28
call dword [sym.imp.HAL.dll_KeGetCurrentIrql]
movzx ecx, al
push ecx
push 0x1a940
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 8
mov edx, 1
test edx, edx
je 0x14c21
call fcn.00011130
mov dword [ebp - 4], 0
jmp 0x14c28
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov al, byte [eax + 0x40]
mov esp, ebp
pop ebp
ret 4

Function at 0x14c40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.HAL.dll_KeGetCurrentIrql]
movzx eax, al
cmp eax, 1
jle 0x14c88
call dword [sym.imp.HAL.dll_KeGetCurrentIrql]
movzx ecx, al
push ecx
push 0x1a8f0
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 8
mov edx, 1
test edx, edx
je 0x14c81
call fcn.00011130
mov dword [ebp - 4], 0
jmp 0x14c88
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
call fcn.00011000
mov ecx, dword [ebp + 8]
add ecx, 8
push ecx
call dword [sym.imp.ntoskrnl.exe_ExInitializeResourceLite]
mov edx, dword [ebp + 8]
mov byte [edx + 0x40], 1
mov eax, dword [ebp + 8]
mov dword [eax + 0x44], 0
mov esp, ebp
pop ebp
ret 4
Function at 0x14cc0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0xc]
push eax
push 0xa
lea ecx, [ebp - 0x20]
push ecx
push 0xb
call dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0xc]
add edx, 0xa
push edx
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x14df0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0xb
call dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x14de4
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 4]
add edx, 4
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
jmp 0x14d3b
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x24]
jae 0x14de4
push 0x5c
mov edx, dword [ebp - 8]
add edx, 0x1c
push edx
call fcn.00011110
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x14d6c
mov eax, dword [ebp - 8]
add eax, 0x1c
mov dword [ebp - 0x14], eax
jmp 0x14d75
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0
je 0x14dd4
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 8]
jbe 0x14dd4
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp - 8]
add edx, dword [eax + 0xc]
cmp dword [ebp + 8], edx
jae 0x14dd4
push 0x104
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push 0xfa
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ntoskrnl.exe_strncpy]
add esp, 0xc
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 1
jmp 0x14df2
mov eax, dword [ebp - 8]
add eax, 0x11c
mov dword [ebp - 8], eax
jmp 0x14d32
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x14e70
Capabilities:
Find process by pid
Parse pe header
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1b1f8
push 0x18b7c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
cmp dword [ebp + 0xc], 0
je 0x15030
mov eax, dword [ebp + 0xc]
push eax
call fcn.00012ee0
movzx ecx, al
test ecx, ecx
je 0x15030
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 8
and eax, 1
jne 0x15030
cmp dword [ebp + 8], 0
je 0x15030
push str.NPGGNT.DES
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0
push 1
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_FsRtlIsNameInExpression]
movzx ecx, al
test ecx, ecx
je 0x15030
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jge 0x14f12
jmp 0x15030
push str.find_np_dll_inject_r_n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 4
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.ntoskrnl.exe_KeAttachProcess]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 4]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 0
push 1
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov dword [ebp - 4], 0xffffffff
jmp 0x14f72
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
add ecx, 0x18
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x38]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x14fa5
mov ecx, dword [ebp - 0x48]
cmp dword [ecx], 0x4550
je 0x14faa
jmp 0x15030
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
add eax, dword [edx + 0x10]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.ntoskrnl.exe_MmGetPhysicalAddress]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x2c], eax
push 1
push 5
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.ntoskrnl.exe_ProbeForWrite]
cli
push eax
mov eax, cr0
and eax, 0xfffeffff
mov cr0, eax
pop eax
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
mov byte [ebp - 0x21], al
mov edx, dword [ebp - 0x44]
mov eax, dword [0x1c014]
mov dword [edx], eax
mov cl, byte [0x1c018]
mov byte [edx + 4], cl
mov cl, byte [ebp - 0x21]
call dword [sym.imp.HAL.dll_KfLowerIrql]
push eax
mov eax, cr0
or eax, 0x10000
mov cr0, eax
pop eax
sti
call dword [sym.imp.ntoskrnl.exe_KeDetachProcess]
mov ecx, dword [ebp - 0x40]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x16cc0
Capabilities:
Find process by pid

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x10], 0xff676980
mov dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [0x1cb14]
push ecx
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x16d87
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x3c]
add edx, 0x50
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x2c]
je 0x16d65
mov eax, dword [ebp - 0x18]
sub eax, 0x1b0
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
movsx edx, byte [ecx + 0x164]
test edx, edx
je 0x16d55
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 1
jmp 0x16d65
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov dword [ebp - 0x18], eax
jmp 0x16d23
cmp dword [ebp - 0x34], 0
jne 0x16d87
lea ecx, [ebp - 0x10]
push ecx
push 1
push 0
call dword [sym.imp.ntoskrnl.exe_KeDelayExecutionThread]
mov ecx, dword [ebp - 0x14]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x16cdb
cmp dword [ebp - 8], 0
jne 0x16d8f
jmp 0x16db2
cmp dword [ebp - 0x24], 0
jne 0x16d9b
mov edx, dword [ebp - 4]
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0
je 0x16db2
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00016a20
mov esp, ebp
pop ebp
ret 8

Function at 0x18620
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx ecx, al
test ecx, ecx
je 0x186b2
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
push str._ByPassTp__Dr0___08X_n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 8
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
push str._ByPassTp__Dr1___08X_n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
push str._ByPassTp__Dr2___08X_n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 8
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
push eax
push str._ByPassTp__Dr3___08X_n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 8
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
push edx
push str._ByPassTp__Dr6___08X_n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
push ecx
push str._ByPassTp__Dr7___08X_n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 8
pop ebp
ret 4
Function at 0x186c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx ecx, al
test ecx, ecx
je 0x18735
push str._n_____________ClearDrRegBegin______________n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 4
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0
mov edx, dword [ebp + 8]
push edx
call fcn.00018620
push str._n_____________ClearDrRegEnd______________n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 4
pop ebp
ret 4

Function at 0x18740
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x1caec
call fcn.00011020
movzx eax, al
test eax, eax
je 0x1876c
push 0x1aec8
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 4
mov eax, 1
jmp 0x187ce
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0x1caec
mov dword [ebp - 4], 0x1caec
mov ecx, dword [ebp - 4]
push ecx
push 0x1aee0
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 8
cmp dword [ebp - 4], 0
je 0x187cc
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
cmp eax, dword [ebp + 8]
jne 0x187ca
mov ecx, dword [ebp - 4]
push ecx
push 0x1aef0
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 8
mov eax, dword [ebp - 4]
jmp 0x187ce
jmp 0x18793
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x438c97
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x438a14
mov edx, 0x1306a11d
sub edx, edx
call fcn.00438ce1
sub ecx, edx
and ecx, ecx
add ecx, 0x5786914e
xor dword [esi], eax
sub edx, 0xacf1a31d
add ecx, 0xf146ed40
add esi, 1
add ecx, ecx
push 0x15d51023
pop edx
cmp esi, ebx
jne fcn.00438c97
inc edx
and ecx, edx
ret
Function at 0x4204ac
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.0042b07e
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0042b07e
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0x10
call fcn.0042b07e
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x42d6d0
call fcn.0042b096
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
je 0x420565
mov eax, 0
jmp 0x4206a9
cmp dword [ebp + 0xc], 0
jne 0x420591
mov dword [ebp - 0x18], esp
mov eax, 0x27
call fcn.0042b090
cmp dword [ebp - 0x18], esp
je 0x42058e
push 6
call fcn.0042b08a
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0x4205b9
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4205b3
push ebx
call fcn.0042b084
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 0x28
call fcn.0042b090
cmp dword [ebp - 0x18], esp
je 0x4205e4
push 6
call fcn.0042b08a
add esp, 4
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x4c9b62
mov eax, 0x29
call fcn.0042b090
cmp dword [ebp - 0x18], esp
je 0x420610
push 6
call fcn.0042b08a
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0x2a
call fcn.0042b090
cmp dword [ebp - 0x18], esp
je 0x4206a4
push 6
call fcn.0042b08a
add esp, 4
jmp 0x4206a9
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0042b084
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.0042b084
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.0042b084
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4375c0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b39bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004a5cdd
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x437642
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004a32c0
mov eax, dword [eax]
push 0x636254
push eax
call fcn.004953a4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004a5f68
test bl, bl
je 0x437642
push 0x636254
lea ecx, [esp + 0xc]
call fcn.004a6344
push 0x639de0
lea ecx, [esp + 0xc]
call fcn.004a6344
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x43767e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004a5f68
jmp 0x437749
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x437702
lea edx, [esp + 0x7c]
push 0x639ddc
push edx
call fcn.004953a4
add esp, 8
test eax, eax
je 0x437702
lea eax, [esp + 0x7c]
push 0x639dd8
push eax
call fcn.004953a4
add esp, 8
test eax, eax
je 0x437702
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x437692
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004a5f68
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x437f60
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x437fc2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc