joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ec30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9cad0
push 0x9b56a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x4904
call fcn.00049640
mov ecx, eax
push 0x491f
call fcn.00049640
mov esi, eax
push 0x48ad
call fcn.00049640
mov edi, eax
push 0x490a
call fcn.00049640
mov edx, eax
mov dword [ebp - 0x28], edx
push 0x4a1b
call fcn.00049640
mov dword [ebp - 0x2c], eax
xor ebx, ebx
cmp ecx, ebx
je 0x7ed9f
cmp esi, ebx
je 0x7ed9f
cmp edi, ebx
je 0x7ed9f
cmp edx, ebx
je 0x7ed9f
cmp eax, ebx
je 0x7ed9f
mov dword [ebp - 0x68], 0x4f005c
mov dword [ebp - 0x64], 0x6a0062
mov dword [ebp - 0x60], 0x630065
mov dword [ebp - 0x5c], 0x540074
mov dword [ebp - 0x58], 0x700079
mov dword [ebp - 0x54], 0x730065
mov dword [ebp - 0x50], ebx
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x34]
push edx
call ecx
mov dword [ebp - 0x4c], 0x18
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x40], 0x240
lea eax, [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x4c]
push ecx
push 1
lea edx, [ebp - 0x20]
push edx
call esi
test eax, eax
js 0x7ed9f
push ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push 0xf000f
mov ecx, dword [ebp - 0x20]
push ecx
call edi
cmp eax, ebx
jl 0x7ed98
push 0x877
call fcn.00049640
push eax
push 0x80000
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, ebx
je 0x7ed92
mov edx, dword [ebp - 0x1c]
mov dword [edi], edx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc]
push eax
push edi
mov esi, dword [ebp + 8]
call fcn.0007e690
mov dword [ebp - 4], 0xffffffff
jmp 0x7ed8c
push edi
call fcn.0008b8c0
mov ecx, dword [ebp - 0x1c]
call dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
push ecx
call dword [ebp - 0x2c]
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x8a9b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
xor ebx, ebx
push 0x4904
mov dword [ebp - 8], ebx
mov dword [ebp - 0x38], 0x44005c
mov dword [ebp - 0x34], 0x690072
mov dword [ebp - 0x30], 0x650076
mov dword [ebp - 0x2c], 0x5c0072
mov dword [ebp - 0x28], 0x690044
mov dword [ebp - 0x24], 0x6b0073
mov dword [ebp - 0x20], ebx
call fcn.00049640
push 0x4847
mov ecx, eax
call fcn.00049640
push 0x4901
mov esi, eax
call fcn.00049640
push 0x4907
mov edi, eax
call fcn.00049640
mov edx, eax
push 0x490a
mov dword [ebp - 0xc], edx
call fcn.00049640
mov dword [ebp - 0x14], eax
test ecx, ecx
je 0x8ab8b
test esi, esi
je 0x8ab8b
test edi, edi
je 0x8ab8b
test edx, edx
je 0x8ab8b
test eax, eax
je 0x8ab8b
lea eax, [ebp - 0x38]
push eax
lea edx, [ebp - 0x1c]
push edx
call ecx
mov ecx, dword [esi]
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ecx
push ebx
push ebx
push 0x40
lea edx, [ebp - 0x1c]
push edx
call edi
test eax, eax
jne 0x8ab8b
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x8ab7b
cmp dword [ebx + 0x2c], 7
jne 0x8ab70
test dword [ebx + 0x1c], 0x40
je 0x8ab70
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push ebx
mov dword [ebp - 4], 0
call dword [ebp - 0xc]
cmp eax, 0xc0000004
jne 0x8ab70
mov eax, dword [ebp - 4]
test eax, eax
je 0x8ab70
lea edi, [eax + 0x100]
push edi
xor ecx, ecx
call fcn.0008b8a0
mov esi, eax
test esi, esi
je 0x8ab70
mov eax, dword [ebp - 4]
lea edx, [ebp - 4]
push edx
push eax
push esi
push ebx
call dword [ebp - 0xc]
test eax, eax
jne 0x8ab64
lea ecx, [esi + 8]
cmp dword [esi + 4], ecx
jne 0x8ab64
movzx eax, word [esi]
lea edx, [eax + 8]
cmp edx, edi
jae 0x8ab64
mov ecx, dword [esi + 4]
shr eax, 1
xor edx, edx
mov word [ecx + eax*2], dx
mov edx, dword [esi + 4]
call fcn.0008f0a0
mov ecx, eax
test ecx, ecx
je 0x8ab64
add ecx, 2
call fcn.0008f1d0
cmp eax, 3
jne 0x8ab64
movzx eax, word [ecx]
mov edx, 0x44
cmp dx, ax
je 0x8ab3e
mov edx, 0x64
cmp dx, ax
jne 0x8ab64
movzx eax, word [ecx + 2]
mov edx, 0x52
cmp dx, ax
je 0x8ab56
mov edx, 0x72
cmp dx, ax
jne 0x8ab64
mov eax, 0x30
cmp ax, word [ecx + 4]
jne 0x8ab64
mov dword [ebp - 8], ebx
push esi
call fcn.0008b8c0
cmp dword [ebp - 8], 0
jne 0x8ab7b
mov ebx, dword [ebx + 0xc]
test ebx, ebx
jne 0x8aa86
mov ecx, dword [ebp - 0x10]
call dword [ebp - 0x14]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8aba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
mov byte [ebp - 1], 0
test ecx, ecx
je 0x8ad69
mov eax, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
movzx eax, word [eax]
mov edx, 0x893
mov byte [ebp - 1], 1
cmp dx, ax
je 0x8ad69
mov ecx, dword [ecx + 0x2c]
mov edx, 0x1770
cmp ax, dx
jae 0x8ad51
cmp ecx, 2
je 0x8abf8
cmp ecx, 7
je 0x8abf8
cmp ecx, 0x1f
je 0x8abf8
cmp ecx, 0x24
jne 0x8ad69
push 0x4904
call fcn.00049640
push 0x493d
mov ecx, eax
call fcn.00049640
push 0x490a
mov esi, eax
call fcn.00049640
mov edx, eax
push 0x4a24
mov dword [ebp - 0x14], edx
call fcn.00049640
push 0x4880
mov edi, eax
call fcn.00049640
push 0x4a27
mov ebx, eax
call fcn.00049640
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x8ad69
test esi, esi
je 0x8ad69
test edx, edx
je 0x8ad69
test edi, edi
je 0x8ad69
test ebx, ebx
je 0x8ad69
test eax, eax
je 0x8ad69
lea eax, [ebp - 0x5c]
push eax
lea edx, [ebp - 0x28]
push edx
mov dword [ebp - 0x5c], 0x44005c
mov dword [ebp - 0x58], 0x760065
mov dword [ebp - 0x54], 0x630069
mov dword [ebp - 0x50], 0x5c0065
mov dword [ebp - 0x4c], 0x6f004d
mov dword [ebp - 0x48], 0x6e0075
mov dword [ebp - 0x44], 0x500074
mov dword [ebp - 0x40], 0x69006f
mov dword [ebp - 0x3c], 0x74006e
mov dword [ebp - 0x38], 0x61004d
mov dword [ebp - 0x34], 0x61006e
mov dword [ebp - 0x30], 0x650067
mov dword [ebp - 0x2c], 0x72
call ecx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x80
lea edx, [ebp - 0x28]
push edx
call esi
test eax, eax
js 0x8ad69
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x8ad41
lea esi, [eax + 0x1c]
push esi
call edi
test eax, eax
jne 0x8ad41
lea ecx, [ebp - 0x20]
push ecx
push eax
push eax
push eax
push esi
mov dword [ebp - 0x20], 0xff676980
mov dword [ebp - 0x1c], 0xffffffff
call ebx
cmp eax, 0x102
je 0x8ad3d
push 0
push 1
push 0
push esi
call dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [ebp - 0x14]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 1], 0
mov ecx, dword [ebp - 0x10]
call dword [ebp - 0x14]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4a2d
call fcn.00049640
test eax, eax
je 0x8ad69
call eax
cmp al, 1
jne 0x8ad69
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8ba50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
xor cl, cl
push 0x4904
mov byte [ebp - 5], cl
call fcn.00049640
mov edi, eax
push 0x4925
mov dword [ebp - 0x18], edi
call fcn.00049640
mov edx, eax
push 0x4928
mov dword [ebp - 0x10], edx
call fcn.00049640
mov ebx, eax
push 0x4a1b
mov dword [ebp - 0x14], ebx
call fcn.00049640
xor esi, esi
mov dword [ebp - 0x1c], eax
cmp edi, esi
je 0x8bbee
cmp edx, esi
je 0x8bbee
cmp ebx, esi
je 0x8bbee
cmp eax, esi
je 0x8bbee
mov dword [ebp - 0x6c], 0x44005c
mov dword [ebp - 0x68], 0x73006f
mov dword [ebp - 0x64], 0x650044
mov dword [ebp - 0x60], 0x690076
mov dword [ebp - 0x5c], 0x650063
mov dword [ebp - 0x58], 0x5c0073
mov dword [ebp - 0x52], 0x3a
xor ebx, ebx
lea ecx, [ecx]
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x2c]
lea edx, [ebx + 0x41]
push ecx
mov word [ebp - 0x54], dx
call edi
lea eax, [ebp - 0x44]
push eax
push 0x80000000
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x2c]
push ecx
mov dword [ebp - 0x44], 0x18
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x38], 0x240
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
call dword [ebp - 0x10]
test eax, eax
js 0x8bbd4
push 0x877
mov dword [ebp - 0x24], 0x2080000
call fcn.00049640
push eax
push 0x208
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x8bbcd
movzx ecx, word [ebp - 0x22]
push ecx
push esi
push eax
call sub.ntoskrnl.exe_memset
mov eax, dword [ebp - 0xc]
add esp, 0xc
push esi
lea edx, [ebp - 0x24]
push edx
push eax
call dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
test eax, eax
js 0x8bbb6
mov ecx, dword [ebp - 0x24]
and ecx, 0xfffe
cmp ecx, 0x10
jbe 0x8bbb6
movzx esi, word [ebp - 0x24]
mov edx, dword [ebp + 8]
shr esi, 1
push esi
mov eax, edi
call fcn.0008efd0
test eax, eax
jne 0x8bbb4
mov edx, dword [ebp + 0x10]
mov ax, word [ebp - 0x54]
mov ecx, dword [ebp + 0xc]
mov dword [edx], esi
mov word [ecx], ax
mov byte [ebp - 5], 1
xor esi, esi
push 0x877
mov ecx, edi
call fcn.00049640
push eax
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edi, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
push edx
call dword [ebp - 0x1c]
mov al, byte [ebp - 5]
cmp al, 1
je 0x8bbf0
inc ebx
cmp ebx, 0x20
jb 0x8baf0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov al, cl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x8c440
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push edi
mov edx, esi
call fcn.0008a7b0
push 0x19
mov bl, al
call fcn.00088910
push 0xe
mov byte [ebp - 8], al
call fcn.00088910
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov ecx, dword [ebp - 0x10]
push ecx
push 0xe
call fcn.00088aa0
mov edx, dword [ebp - 8]
push edx
push 0x19
call fcn.00088aa0
mov ecx, dword [sym.imp.ntoskrnl.exe_MmSectionObjectType]
mov edx, dword [ecx]
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push edx
push 0x80000000
push eax
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
push 0x19
mov edi, eax
call fcn.00088910
push 0xf
mov byte [ebp - 8], al
call fcn.00088910
lea ecx, [ebp - 0x28]
push ecx
mov byte [ebp + 8], al
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov edx, dword [ebp + 8]
push edx
push 0xf
call fcn.00088aa0
mov eax, dword [ebp - 8]
push eax
push 0x19
call fcn.00088aa0
cmp bl, 1
jne 0x8c4e8
mov ecx, esi
call fcn.0008a870
test edi, edi
jne 0x8c546
mov edx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov ecx, 0x2800
cmp word [edx], cx
jae 0x8c521
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push ecx
call fcn.0008c2b0
mov ecx, dword [ebp - 0xc]
mov bl, al
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push edx
push eax
mov eax, dword [ebp - 0xc]
call fcn.0008c390
mov ecx, dword [ebp - 0xc]
mov bl, al
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x8d2b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
push ebx
push esi
push edi
push 0x4907
mov byte [esp + 0x13], 0
call fcn.00049640
push 0x492b
mov esi, eax
call fcn.00049640
push 0x4a0f
mov edi, eax
call fcn.00049640
mov ecx, eax
push 0x4a12
mov dword [esp + 0x20], ecx
call fcn.00049640
mov edx, eax
push 0x4a1b
mov dword [esp + 0x24], edx
call fcn.00049640
mov dword [esp + 0x24], eax
test esi, esi
je 0x8d47a
test edi, edi
je 0x8d47a
test ecx, ecx
je 0x8d47a
test edx, edx
je 0x8d47a
test eax, eax
je 0x8d47a
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
push 0
push 0
push ecx
mov dword [esp + 0x20], 0
call esi
cmp eax, 0xc0000004
jne 0x8d47a
mov eax, dword [esp + 0x10]
test eax, eax
je 0x8d47a
add eax, 0x100
push eax
xor ecx, ecx
mov dword [esp + 0x1c], eax
call fcn.0008b8a0
mov ebx, eax
test ebx, ebx
je 0x8d47a
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
lea edx, [esp + 0x10]
push edx
push eax
push ebx
push ecx
call esi
test eax, eax
jne 0x8d474
lea edx, [ebx + 8]
cmp dword [ebx + 4], edx
jne 0x8d474
movzx eax, word [ebx]
add eax, 8
cmp eax, dword [esp + 0x18]
jae 0x8d474
xor esi, esi
push esi
push esi
push 0x20
push 1
push 1
push 0x80
push esi
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x58]
push edx
push 0x100080
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x64], 0x18
mov dword [esp + 0x68], esi
mov dword [esp + 0x70], 0x240
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], esi
call edi
cmp eax, esi
jge 0x8d41f
push esi
push esi
push 0x20
push 1
push 3
push 0x80
push esi
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x58]
push edx
push 0x100001
lea eax, [esp + 0x3c]
push eax
call edi
cmp eax, esi
jl 0x8d474
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push esi
mov dword [esp + 0x34], ecx
mov ecx, dword [ebp + 0x18]
lea eax, [esp + 0x34]
push eax
push ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], edx
mov edx, dword [ebp + 0x14]
push edx
lea eax, [esp + 0x38]
push eax
push esi
push esi
push esi
push ecx
call dword [esp + 0x40]
cmp eax, 0x103
jne 0x8d462
mov edx, dword [esp + 0x14]
push esi
push esi
push edx
call dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
cmp eax, esi
jne 0x8d46b
mov byte [esp + 0xf], 1
mov eax, dword [esp + 0x14]
push eax
call dword [esp + 0x28]
push ebx
call fcn.0008b8c0
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x907f0
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
xor esi, esi
push 0x61
mov dword [esp + 0x18], esi
call fcn.00049640
mov edi, eax
mov dword [esp + 0x10], edi
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp eax, edi
jne 0x90821
mov dword [esp + 0x10], esi
mov edi, esi
jmp 0x90831
cmp edi, esi
je 0x90831
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
push 0x20
call fcn.00049640
push 0x21
mov ecx, eax
call fcn.00049640
push 3
mov esi, eax
call fcn.00049640
push 0x42
mov ebx, eax
call fcn.00049640
push 0x235
mov edx, eax
call fcn.00049640
test ecx, ecx
je 0x908b0
test esi, esi
je 0x908b0
test ebx, ebx
je 0x908b0
test eax, eax
je 0x908b0
cmp eax, edx
jae 0x908b0
mov edi, eax
call fcn.0008b350
mov ecx, eax
test ecx, ecx
je 0x908ac
cmp ecx, esi
jae 0x908ac
push ecx
push 0x236
call fcn.00049620
add ecx, ebx
push ecx
push 0x237
mov dword [esp + 0x1c], ecx
call fcn.00049620
mov edi, ecx
mov eax, 0x52
call fcn.00088810
mov edi, dword [esp + 0x10]
test edi, edi
je 0x908bf
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x90900
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
push 0x61
call fcn.00049640
mov esi, eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp eax, esi
jne 0x90928
mov dword [ebp - 0xc], 0
jmp 0x90937
test esi, esi
je 0x90937
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
push 0x63
call fcn.00049640
push 0x20
mov ecx, eax
call fcn.00049640
mov edx, eax
push 0x21
mov dword [ebp - 0x10], edx
call fcn.00049640
mov ebx, eax
push 0x22
mov dword [ebp - 0x28], ebx
call fcn.00049640
mov edi, eax
push 3
mov dword [ebp - 4], edi
call fcn.00049640
mov esi, eax
push 2
mov dword [ebp - 0x2c], esi
call fcn.00049640
push 0x48af
mov dword [ebp - 8], eax
call fcn.00049640
mov dword [ebp - 0x14], eax
test ecx, ecx
je 0x90b02
test edx, edx
je 0x90b02
test ebx, ebx
je 0x90b02
test edi, edi
je 0x90b02
test esi, esi
je 0x90b02
cmp dword [ebp - 8], 0
je 0x90b02
test eax, eax
je 0x90b02
or edi, 0xffffffff
cmp ecx, esi
jbe 0x909cc
mov edi, ecx
sub edi, esi
cmp edi, ebx
jae 0x90b02
lea eax, [edi + esi]
cmp ecx, eax
jne 0x90b02
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x34]
add edi, edx
add ebx, edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], 0
push ebx
lea esi, [ebp - 0x68]
mov ecx, edi
call fcn.00032c70
test al, al
je 0x90b02
mov ecx, dword [ebp - 0x48]
add edi, dword [ebp - 0x50]
cmp dword [ecx], 0x105f
jne 0x90aa0
mov edx, dword [ebp - 0x58]
push ebx
mov ecx, edi
mov dword [ebp - 0x18], edx
call fcn.00032c70
cmp al, 1
jne 0x90aa0
mov eax, dword [ebp - 0x48]
add edi, dword [ebp - 0x50]
cmp dword [eax], 0x105f
jne 0x90aa0
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x20], ecx
push ebx
mov ecx, edi
call fcn.00032c70
cmp al, 1
jne 0x90aa0
mov edx, dword [ebp - 0x48]
add edi, dword [ebp - 0x50]
cmp dword [edx], 0x105f
jne 0x90aa0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x24], eax
xor ebx, ebx
mov ecx, dword [ebp - 4]
push ecx
lea esi, [ebp - 0x68]
mov ecx, edi
call fcn.00032c70
test al, al
je 0x90a80
add edi, dword [ebp - 0x50]
inc ebx
cmp ebx, 4
jb 0x90a63
jmp 0x90a85
cmp ebx, 4
jb 0x90a9d
mov edx, dword [ebp - 0x48]
cmp dword [edx], 0x10cd
jne 0x90a9d
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x10]
add eax, edi
cmp dword [ebp - 0x14], eax
je 0x90ab4
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, 0xc8
jb 0x909f6
jmp 0x90b02
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp esi, eax
jbe 0x90b02
mov edx, dword [ebp - 0x20]
cmp edx, eax
jbe 0x90b02
mov ecx, dword [ebp - 0x24]
cmp ecx, eax
jbe 0x90b02
sub esi, eax
sub edx, eax
sub ecx, eax
mov eax, dword [ebp - 0x28]
cmp esi, eax
jae 0x90b02
cmp edx, eax
jae 0x90b02
cmp ecx, eax
jae 0x90b02
mov edi, dword [ebp - 0x2c]
add esi, edi
push esi
push 0x67
call fcn.00049620
add edx, edi
push edx
push 0x66
call fcn.00049620
add ecx, edi
push ecx
push 0x65
call fcn.00049620
cmp dword [ebp - 0xc], 0
pop edi
pop esi
pop ebx
je 0x90b15
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov esp, ebp
pop ebp
ret
Function at 0x90d20
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
push ebx
push esi
push edi
push 0x26
call fcn.00049640
cmp eax, 1
je 0x90eb1
push 0x61
call fcn.00049640
mov esi, eax
mov dword [esp + 0x14], esi
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp eax, esi
jne 0x90d5d
mov dword [esp + 0x14], 0
jmp 0x90d6d
test esi, esi
je 0x90d6d
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
push 0x63
call fcn.00049640
push 0x20
mov ecx, eax
call fcn.00049640
mov edx, eax
push 0x21
mov dword [esp + 0x1c], edx
call fcn.00049640
mov ebx, eax
push 0x22
mov dword [esp + 0x20], ebx
call fcn.00049640
push 3
mov edi, eax
call fcn.00049640
mov esi, eax
push 2
mov dword [esp + 0x24], esi
call fcn.00049640
test ecx, ecx
je 0x90e9f
test edx, edx
je 0x90e9f
test ebx, ebx
je 0x90e9f
test edi, edi
je 0x90e9f
test esi, esi
je 0x90e9f
test eax, eax
je 0x90e9f
or eax, 0xffffffff
cmp ecx, esi
jbe 0x90de8
mov eax, ecx
sub eax, esi
cmp eax, ebx
jae 0x90e9f
add esi, eax
cmp ecx, esi
jne 0x90e9f
add ebx, edx
mov dword [esp + 0x10], ebx
lea edi, [eax + edx]
xor ebx, ebx
mov ecx, dword [esp + 0x10]
push ecx
lea esi, [esp + 0x40]
mov ecx, edi
call fcn.00032c70
test al, al
je 0x90e9f
mov edx, dword [esp + 0x5c]
cmp dword [edx], 0x1009
jne 0x90e30
cmp byte [esp + 0x40], 1
je 0x90e3c
add edi, dword [esp + 0x54]
inc ebx
cmp ebx, 0x64
jb 0x90e05
jmp 0x90e9f
add edi, dword [esp + 0x54]
mov ebx, dword [esp + 0x10]
push ebx
lea esi, [esp + 0x40]
mov ecx, edi
call fcn.00032c70
cmp al, 1
jne 0x90e9f
add edi, dword [esp + 0x54]
push ebx
mov ecx, edi
call fcn.00032c70
cmp al, 1
jne 0x90e9f
mov eax, dword [esp + 0x5c]
cmp dword [eax], 0x10cd
jne 0x90e9f
mov eax, dword [esp + 0x48]
sub eax, dword [esp + 0x18]
add eax, dword [esp + 0x54]
add eax, edi
je 0x90e9f
cmp eax, dword [esp + 0x1c]
jae 0x90e9f
mov ecx, dword [esp + 0x20]
lea edi, [eax + ecx]
push edi
push 0x64
call fcn.00049620
mov eax, 0x37
call fcn.00088810
cmp dword [esp + 0x14], 0
je 0x90eb1
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x90ec0
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
sub esp, 0x54
push ebx
mov eax, 0x3839
push esi
push edi
cmp ax, word [ecx]
je 0x9106b
push 0x61
call fcn.00049640
mov esi, eax
mov dword [esp + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp eax, esi
jne 0x90f01
mov dword [esp + 0x18], 0
jmp 0x90f11
test esi, esi
je 0x90f11
lea edx, [esp + 0x24]
push edx
push esi
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
push 0x48b2
call fcn.00049640
push 0x20
mov ecx, eax
call fcn.00049640
push 0x21
mov ebx, eax
call fcn.00049640
push 0x22
mov edx, eax
call fcn.00049640
push 3
mov esi, eax
call fcn.00049640
mov edi, eax
push 2
mov dword [esp + 0x24], edi
call fcn.00049640
mov dword [esp + 0x1c], eax
test ecx, ecx
je 0x91059
test ebx, ebx
je 0x91059
test edx, edx
je 0x91059
test esi, esi
je 0x91059
test edi, edi
je 0x91059
test eax, eax
je 0x91059
cmp ecx, eax
jae 0x91059
cmp ecx, edx
jae 0x91059
add edx, ebx
lea edi, [ebx + ecx]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x10]
push eax
lea esi, [esp + 0x40]
mov ecx, edi
call fcn.00032c70
test al, al
je 0x91059
mov ecx, dword [esp + 0x5c]
mov ecx, dword [ecx]
cmp ecx, 0x10b3
je 0x91059
mov edx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
movzx eax, word [edx]
add edi, dword [esp + 0x54]
mov edx, 0x2580
cmp dx, ax
je 0x90fef
cmp ecx, 0x107c
je 0x90ff7
cmp dx, ax
jne 0x91029
cmp ecx, 0x107e
jne 0x91029
mov eax, dword [esp + 0x10]
push eax
lea esi, [esp + 0x40]
mov ecx, edi
call fcn.00032c70
cmp al, 1
jne 0x91029
mov ecx, dword [esp + 0x5c]
cmp dword [ecx], 0x10cd
jne 0x91029
mov eax, dword [esp + 0x48]
sub eax, ebx
add eax, dword [esp + 0x54]
add eax, edi
cmp eax, dword [esp + 0x1c]
jb 0x9103d
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0x64
jb 0x90fa1
jmp 0x91059
mov edx, dword [esp + 0x20]
lea edi, [eax + edx]
push edi
push 0x23f
call fcn.00049620
mov eax, 0x61
call fcn.00088810
cmp dword [esp + 0x18], 0
je 0x9106b
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret