joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a0ac
Capabilities:
Enumerate files on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffec0
push esp
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov edi, eax
cmp edi, 0xffffffff
je 0x47a160
mov edx, dword [0x479ffc]
mov eax, 4
call fcn.00405d60
mov esi, eax
push 0xffff
mov eax, esi
mov ecx, 1
mov edx, dword [0x479ffc]
call fcn.00406200
add esp, 4
xor ebx, ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
mov edx, dword [esi]
push esi
push edi
lea edi, [edx + eax*8]
lea esi, [esp + 8]
mov ecx, 0x50
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
jmp 0x47a136
inc ebx
mov eax, ebx
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax + eax*4]
mov edx, dword [esi]
push esi
push edi
lea edi, [edx + eax*8]
lea esi, [esp + 8]
mov ecx, 0x50
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esp
push edi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x47a116
inc ebx
push ebx
mov eax, esi
mov ecx, 1
mov edx, dword [0x479ffc]
call fcn.00406200
add esp, 4
push edi
call sub.kernel32.dll_FindClose_1
jmp 0x47a162
xor esi, esi
mov eax, esi
add esp, 0x140
pop edi
pop esi
pop ebx
ret
Function at 0x4114ab
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x368]
sub esp, 0x3e8
mov eax, dword [0x42ab20]
xor eax, ebp
mov dword [ebp + 0x364], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4114e7
cmp dword [ebp - 0x7c], 6
jne 0x4114e7
cmp dword [ebp - 0x78], 0
je 0x411511
push str.SetDefaultDllDirectories
push 0x4229b4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x411511
push 0xc00
call eax
test eax, eax
jne 0x4115a5
push 0x106
lea eax, [ebp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4115a5
cmp eax, 0x104
ja 0x4115a5
lea eax, [ebp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 + 0x92], 0x5c
je 0x411552
push 0x5c
pop ecx
mov word [ebp + eax*2 + 0x94], cx
inc eax
cmp byte [0x422e68], 0
push esi
mov esi, 0x422e68
je 0x4115a4
push edi
lea edi, [ebp + eax*2 + 0x94]
mov ecx, edi
mov al, byte [esi]
movzx dx, al
inc esi
mov word [ecx], dx
inc ecx
inc ecx
test al, al
jne 0x41156b
push str..dll
lea eax, [ebp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 8
push 0
lea eax, [ebp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x411569
pop edi
pop esi
mov ecx, dword [ebp + 0x364]
xor ecx, ebp
call fcn.00417bcb
add ebp, 0x368
leave
ret
Function at 0x41576d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
xor ebx, ebx
push ebp
xor eax, eax
push edi
mov edi, dword [esp + 0x10]
or dword [edi + 0x90], 0xffffffff
or dword [edi + 0x94], 0xffffffff
inc eax
push 0x20
mov dword [edi + 0x30], eax
mov dword [edi + 0x44], eax
mov eax, dword [edi + 4]
pop ebp
mov dword [edi + 0x78], ebx
mov dword [edi + 0x7c], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x70], ebx
mov dword [edi + 0x88], ebx
mov dword [edi + 0x68], ebx
mov dword [edi + 0x6c], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x60], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x80], ebx
mov dword [edi + 0x84], ebx
cmp eax, ebp
jbe 0x4157d5
mov eax, ebp
mov dword [edi + 0x54], eax
mov eax, dword [edi]
push esi
mov dword [edi + 0x58], ebx
cmp eax, dword [edi + 0x20]
je 0x415811
lea esi, [edi + 0xc8]
cmp dword [esi + 8], ebx
je 0x4157f4
push esi
call fcn.00414b0a
add esi, 0x28
dec ebp
jne 0x4157e9
mov ecx, dword [edi + 0x5c]
cmp ecx, ebx
je 0x41580c
mov eax, dword [edi + 0x14]
push ecx
push eax
call dword [eax + 4]
mov dword [edi + 0x5c], ebx
mov eax, dword [edi]
mov dword [edi + 0x20], eax
push dword [edi + 0x10]
lea eax, [edi + 0x98]
push eax
call fcn.00414a00
mov eax, dword [edi + 0x58]
lea esi, [eax + 5]
imul esi, esi, 0x28
add esi, edi
inc eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x58], eax
call fcn.00414abb
mov ebp, eax
cmp ebp, ebx
jne 0x415876
lea eax, [esi + 0x20]
push eax
call fcn.0041594d
mov ebp, eax
cmp ebp, ebx
jne 0x415876
lea eax, [esi + 0x1c]
push eax
call fcn.0041594d
mov ebp, eax
cmp ebp, ebx
jne 0x415876
push esi
call fcn.00415516
mov ebp, eax
cmp ebp, ebx
je 0x415876
mov eax, edi
mov dword [edi + 0x44], ebx
call fcn.00414b72
cmp ebp, ebx
pop esi
jle 0x415882
movzx ebp, bp
or ebp, 0x80070000
cmp ebp, ebx
je 0x415889
mov dword [edi + 0x40], ebp
cmp dword [edi + 0x38], ebx
jne 0x41589b
cmp dword [edi + 0x40], ebx
jne 0x41589b
cmp dword [edi + 0x3c], ebx
jne 0x41589b
mov dword [edi + 0x44], ebx
mov eax, dword [edi + 0x44]
neg eax
sbb eax, eax
not eax
pop edi
and eax, ebp
pop ebp
pop ebx
ret 4

Function at 0x4158fd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0x10]
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call fcn.0041a13d
mov ecx, dword [ebp + 8]
add esp, 0x18
push eax
mov dword [ecx], eax
call fcn.004158b8
pop ebp
ret 0xc

Function at 0x4160d2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
lea ecx, [esi + 0x68]
call fcn.00416057
push 0xce4
lea eax, [ebp - 0xc]
push eax
call fcn.0040d891
push dword [eax]
add esi, 0x6c
mov ecx, esi
call fcn.004102a0
push dword [ebp - 0xc]
call fcn.0040978c
pop ecx
push 1
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
leave
ret 8
Function at 0x45d7e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x45d805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x45d878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x45d83a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x45d86d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x45d86b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x45d831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x45d7fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x475004]
jne 0x401010
repz ret
jmp fcn.004017e1

Function at 0x406b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040250a
and dword [ebp - 4], 0
cmp dword [0x476ffc], 0
mov ebx, eax
jne 0x406c2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406ce0
push eax
call fcn.00402498
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x476ffc], eax
call esi
push eax
call fcn.00402498
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x477000], eax
call esi
push eax
call fcn.00402498
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x477004], eax
call esi
push eax
call fcn.00402498
pop ecx
mov dword [0x47700c], eax
test eax, eax
je 0x406c2f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402498
pop ecx
mov dword [0x477008], eax
mov eax, dword [0x477008]
cmp eax, ebx
je 0x406c87
cmp dword [0x47700c], ebx
je 0x406c87
push eax
call fcn.00402513
push dword [0x47700c]
mov esi, eax
call fcn.00402513
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406c87
test edi, edi
je 0x406c87
call esi
test eax, eax
je 0x406c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406c7e
test byte [ebp - 0xc], 1
jne 0x406c87
or dword [ebp + 0x10], 0x200000
jmp 0x406cc0
mov eax, dword [0x477000]
cmp eax, ebx
je 0x406cc0
push eax
call fcn.00402513
pop ecx
test eax, eax
je 0x406cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406cc0
mov eax, dword [0x477004]
cmp eax, ebx
je 0x406cc0
push eax
call fcn.00402513
pop ecx
test eax, eax
je 0x406cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x476ffc]
call fcn.00402513
pop ecx
test eax, eax
je 0x406ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46e7d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push edi
cmp ebp, 0x19f
jne 0x46e7f1
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edi, edi
test ebp, ebp
jle 0x46e846
push esi
jmp 0x46e800
lea esi, [esp + 0x10]
mov dword [esp + 0xc], 5
mov dword [esp + 0x10], 0
call fcn.0046e7c0
mov eax, dword [esp + 0x10]
add eax, 0x46
mov dword [esp + 0xc], eax
sub dword [esp + 0xc], 0x46
movsx eax, byte [edi + ebx]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
xor dword [esp + 0x18], eax
mov cl, byte [esp + 0x18]
mov byte [edi + ebx], cl
inc edi
cmp edi, ebp
jl 0x46e800
pop esi
pop edi
cmp ebp, 0x2d
pop ebp
jne 0x46e861
mov dword [0x2b75218], 0xa62e7790
mov dword [0x2b7521c], 0xffffffff
add esp, 8
ret
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x59]
xor cl, byte [sym.imp.MSVCRT.dll__iob]
sub byte [ebx + 0x746880c1], al
rol byte [eax], cl
push ecx
call dword [sym.imp.MSVCRT.dll_fprintf]
mov eax, dword [0x64102ac]
add ah, 0xc
test dword [edx], eax
je 0x401795
push eax
push 0x1dbb96
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 0x3d
add eax, dword [ecx]
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
arpl sp, bp
cmp dword [edx + 0xb8], 0x4102782a
mov eax, 0x2a000000
js 0x40179e
inc ecx
mov esi, 0x4ca16585
test dword [ebp - 0x5f], esp
dec esp
inc eax
inc ecx
pcmpeqb mm2, qword [ebx + edx*2]
pop esi
adc al, byte [ecx + 0x6f]
cli
cmp bl, byte [esi - 0xd74ffc0]
mov ecx, dword [0xd80274]
jmp 0x4017cf
jne 0x4017d9
sbb byte [ecx + 0x54], al
mov eax, dword [0x37410288]
push ebx
push esi
push esp
xor eax, 0x1dc164
mov word [0x410bb4], cx
test dword [edi - 0x19eb8aa9], esi
adc eax, 0x411800
push edx
push 0x401398
call esi
outsd dx, dword [esi]
js 0x401800
inc ecx
add byte [ebx - 0x3f7a4c3c], al
add esp, 0xffffffb3
test eax, eax
je 0x40181c
xor byte [edx + eax + 0x41], 0
push eax
push 0x3e3c24
push 0xf8d484
insb byte es:[edi], dx
xchg byte [ebx + 0x14a15b01], al
rol byte [eax], 1
mov eax, dword [0x40d014]
test eax, eax
mov eax, 0xee51d480
jne 0x4017ac
mov eax, 0x6f40d47c
mov ah, 0x68
jae 0x401807
inc eax
add bh, bh
pop esi
mov bl, 0xd
enter 0x40c0, 0
add ecx, 0x20
push ecx
sbb byte [0x8540c154], dl
add esp, 0xffffffaa
mov edx, dword [0xed31be43]
mov esi, dword [0x405858]
push 0xea19
push edx
call esi
mov dword [0x410b65], eax
mov eax, dword [0x51400bb9]
push 0x20
fcos
salc
push ecx
or eax, 0x41404c
test al, 0x15
sbb al, dl
inc eax
add byte [ebx - 0x379def3c], al
or eax, dword [ecx]
push 0
push ecx
xchg edx, eax
push 0x41c4f8
call fcn.00406010
test eax, eax
je 0x4018a1
push eax
push 0x40d431
call 0xe7401e40
add esp, 0xfffffff2
cmp edi, dword [edx + eax + 0x41]
add byte [ebp - 0x5e0e8a0c], al
lodsb al, byte [esi]
or eax, dword [ecx]
mov ebx, dword [ebx + 0x1c410b9c]
mov edx, dword [0x43c5b548]
adc eax, 0x43c5b548
mov al, byte [0x849c6894]
inc eax
add byte [eax - 0x5f], dl
dec esp
inc eax
inc ecx
add byte [ebp + 0x1ed44808], bl
pop es
mov byte [0x3fbbe850], al
add byte [eax], al
add esp, 0x1c
mov dword [0xdf4048], eax
jmp 0x4018b6
Function at 0x1054a
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
push edi
xor eax, eax
push 0xd
lea edi, [ebp - 8]
stosd dword es:[edi], eax
push 1
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov byte [ebp - 1], 1
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
pop edi
leave
ret 4

Function at 0x10882
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x14]
push ebx
add eax, eax
push esi
mov word [ebp - 8], ax
mov word [ebp - 6], ax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp + 0x14]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov esi, eax
cmp esi, ebx
jge 0x108c6
push 0x1b2d4
call sub.ntoskrnl.exe_DbgPrint
pop ecx
mov eax, esi
jmp 0x108ef
push edi
push 0x42756f44
push 0x230
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
cmp esi, ebx
jne 0x108f5
mov ebx, 0xc0000001
mov ecx, dword [ebp + 0x14]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x10
lea eax, [ebp + 0xc]
push eax
mov edi, 0x220
push edi
push esi
push dword [ebp + 0x14]
call sub.ntoskrnl.exe_ObQueryNameString
cmp eax, ebx
mov dword [ebp + 0x10], eax
jge 0x10925
mov ecx, dword [ebp + 0x14]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push ebx
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp + 0x10]
jmp 0x108ee
movzx eax, word [esi]
mov ecx, dword [esi + 4]
shr eax, 1
lea eax, [ecx + eax*2]
mov word [esi + 2], di
cmp word [eax - 2], 0x5c
je 0x1094b
push 0x5c
pop ecx
mov word [eax], cx
xor ecx, ecx
mov word [eax + 2], cx
add word [esi], 2
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
test eax, eax
jge 0x10962
push ebx
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp + 8]
mov dword [eax], esi
jmp 0x108e3

Function at 0x109ae
Capabilities:
Attach user process memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 4], bl
mov byte [ebp - 3], bl
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp eax, dword [ebp + 8]
je 0x109de
mov eax, 0xc0000001
jmp 0x10a24
push esi
push ebx
push 2
lea eax, [ebp - 4]
push eax
push 4
push dword [ebp + 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwQueryObject]
mov esi, eax
cmp esi, ebx
jl 0x10a17
cmp dword [ebp + 0x10], ebx
je 0x10a29
cmp byte [ebp - 3], bl
je 0x10a17
push 2
lea eax, [ebp - 4]
push eax
push 4
push dword [ebp + 0xc]
mov byte [ebp - 3], bl
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationObject]
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
cmp byte [ebp - 3], bl
je 0x10a32
xor esi, esi
jmp 0x10a17
mov esi, 0x1234
jmp 0x10a17
Function at 0x10a3e
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push 2
push 0x100100
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.00010486
test eax, eax
jl 0x10a9e
push 4
push 0x28
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jl 0x10a9e
and dword [ebp - 0x10], 0xfffffffe
push esi
push 4
push 0x28
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
pop esi
leave
ret 4
Function at 0x11d4a
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ax, word [0x1c7ec]
sub esp, 0x24
push ebx
push esi
test ax, ax
je 0x11e81
cmp word [0x1c688], 0
je 0x11e81
movzx esi, ax
inc esi
push 0x35343332
inc esi
push esi
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
test ebx, ebx
jne 0x11d94
mov eax, 0xc000009a
jmp 0x11e86
mov ax, word [0x1c7ec]
mov word [ebx], ax
push edi
lea eax, [esi - 2]
push eax
push dword [0x1c7f0]
lea ecx, [ebx + 2]
push ecx
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
push 2
push ebx
push 5
mov edi, 0x1ba1c
push edi
call fcn.0001b134
lea eax, [esi - 2]
push eax
lea eax, [ebx + 2]
push eax
push 5
push edi
call fcn.0001b134
xor eax, eax
and dword [ebp - 4], 0
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0xa]
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x1b3c6
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x18], 0x240
mov dword [ebp - 0x1c], 0x1c688
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x24]
push eax
push 0xf003f
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov edi, eax
test edi, edi
jl 0x11e61
push esi
push ebx
push 3
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov edi, eax
test edi, edi
jge 0x11e61
push esi
push ebx
push 3
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.00015d8a
mov edi, eax
cmp dword [ebp - 4], 0
je 0x11e70
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0x35343332
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
pop edi
jmp 0x11e86
mov eax, 0xc0000001
pop esi
pop ebx
leave
ret
Function at 0x11e90
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
xor ebx, ebx
cmp word [0x1c688], bx
jne 0x11eae
mov eax, 0xc0000001
jmp 0x12018
push esi
push edi
xor eax, eax
mov word [ebp - 0x14], ax
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x1b3c6
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
push 0xf003f
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], 0x240
mov dword [ebp - 0x24], 0x1c688
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
xor esi, esi
mov dword [ebp - 8], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov edi, eax
cmp edi, ebx
jl 0x11ff5
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x14]
push esi
push 2
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov edi, eax
cmp edi, 0x80000005
je 0x11f41
cmp edi, 0xc0000023
jne 0x11f6c
cmp esi, ebx
je 0x11f51
push 0x35343332
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0x35343332
push dword [ebp - 8]
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
cmp esi, ebx
jne 0x11f18
mov edi, 0xc000009a
cmp edi, ebx
jl 0x11ff5
cmp dword [esi + 4], 3
jne 0x11ff0
cmp dword [esi + 8], 2
jbe 0x11ff0
push 2
lea edi, [esi + 0xc]
push edi
push 5
mov ebx, 0x1ba1c
push ebx
call fcn.0001b134
movzx eax, word [edi]
movzx edi, ax
mov dword [ebp - 0xc], eax
lea eax, [edi + 2]
cmp eax, dword [esi + 8]
ja 0x11ff0
push edi
lea eax, [esi + 0xe]
push eax
push 5
push ebx
call fcn.0001b134
push 0x35343332
push edi
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [0x1c7f0], eax
test eax, eax
jne 0x11fcf
mov edi, 0xc000009a
jmp 0x11ff5
push edi
lea ecx, [esi + 0xe]
push ecx
push eax
call sub.ntoskrnl.exe_memcpy
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov word [0x1c7ee], ax
mov word [0x1c7ec], ax
xor edi, edi
jmp 0x11ff5
mov edi, 0xc0000001
cmp dword [ebp - 4], 0
je 0x12004
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
test esi, esi
je 0x12014
push 0x35343332
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x12e66
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 0xc]
push 1
push 8
push esi
call fcn.00013e02
test al, al
jne 0x12e87
mov eax, 0xc0000005
jmp 0x12ec2
and dword [ebp - 8], 0
push edi
xor eax, eax
and dword [ebp - 0x20], eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 5
stosd dword es:[edi], eax
push 0x18
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
pop edi
test eax, eax
jl 0x12ec2
mov ecx, dword [ebp - 0x18]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x14]
mov dword [esi + 4], ecx
pop esi
leave
ret 8

Function at 0x12ecc
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0x10], 0
push edi
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
lea edi, [ebp - 4]
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push 0x14
mov dword [ebp - 8], eax
push 8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
pop edi
leave
ret 8

Function at 0x12f08
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
sub esp, 0x10
test ecx, ecx
je 0x12f1e
mov eax, 0xc000000d
jmp 0x12f48
and dword [ebp - 0x10], 0
push edi
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push 0xe
mov dword [ebp - 8], eax
push 8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ecx
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
pop edi
leave
ret 0xc

Function at 0x130f0
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1313c
push 1
push 0x18
push esi
call fcn.00013e02
test al, al
je 0x1313c
mov ecx, dword [esi]
test ecx, ecx
je 0x1313c
and dword [ebp - 8], 0
push edi
xor eax, eax
push 0xd
lea edi, [ebp - 4]
stosd dword es:[edi], eax
push 1
lea eax, [ebp + 0xb]
push eax
lea eax, [ebp - 8]
push eax
push ecx
mov byte [ebp + 0xb], 1
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
push esi
call fcn.000130ae
pop edi
pop esi
leave
ret 4