joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439fb9
Capabilities:
Get process heap flags
Get process heap force flags
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0xc
mov ecx, esp
sub esp, 0x210
and esp, 0xfffffff0
sub esp, 0x8c
mov eax, esp
mov dword [eax + 0x6c], 0xb
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x64], 0
mov ebx, dword fs:[0x1c]
mov edx, dword [ebx + 4]
mov dword [ecx], edx
mov edi, dword [ebx + 0x124]
mov edx, dword [edi + 0x20]
mov dword [ecx + 4], edx
mov edx, dword fs:[0x18]
mov dword [ecx + 8], edx
mov edi, 0x43a0bb
mov dword [eax + 0x58], ecx
mov dword [eax + 0x68], edi
pushfd
pop edi
and edi, 0x60dd7
or edi, 0x200
mov dword [eax + 0x78], 0x23
mov dword [eax + 0x74], 0x11ffe
mov dword [eax + 0x70], edi
mov dword [eax + 0x4c], 0xffffffff
mov dword [eax + 0x48], 0xffffffff
add eax, 0x8c
cli
push ecx
mov esi, dword [ebx + 4]
mov ecx, 0x84
mov edi, eax
rep movsd dword es:[edi], dword [esi]
pop ecx
mov edi, dword [ebx + 0x124]
mov dword [ebx + 4], eax
mov esi, dword [ebx + 0x40]
sub eax, 0x10
mov dword [ebx], 0xffffffff
mov dword [esi + 4], eax
add eax, 0x220
mov dword [edi + 0x18], eax
mov eax, dword [ecx + 0x20]
mov dword fs:[0x18], eax
mov dword [edi + 0x20], eax
mov ebx, dword [0xffdff03c]
mov word [ebx + 0x3a], ax
shr eax, 0x10
mov byte [ebx + 0x3c], al
mov byte [ebx + 0x3f], ah
sti
push 0
push 0
call sym.ntoskrnl.exe_NtVdmControl
mov ebp, esp
jmp sym.ntoskrnl.exe_Kei386EoiHelper

Function at 0x43abac
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
movzx eax, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
movzx ecx, word [ecx + 6]
push esi
xor esi, esi
test ecx, ecx
push edi
jbe 0x43abea
mov edx, dword [eax + 0xc]
cmp dword [ebp + 0x10], edx
jb 0x43abda
mov edi, dword [eax + 0x10]
add edi, edx
cmp dword [ebp + 0x10], edi
jb 0x43abe4
add eax, 0x28
inc esi
cmp esi, ecx
jae 0x43abea
jmp 0x43abc8
pop edi
pop esi
pop ebp
ret 0xc
xor eax, eax
jmp 0x43abe4
Function at 0x4570f8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x47aa20]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
push 0x457228
lea eax, [ebp - 0x3c]
push eax
call sym.ntoskrnl.exe_RtlInitUnicodeString
mov edi, 0xf003f
push edi
lea eax, [ebp - 0x3c]
push eax
xor ebx, ebx
push ebx
lea eax, [ebp - 0x30]
push eax
call fcn.004c1053
cmp eax, ebx
jl 0x457218
push ebx
push ebx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], eax
push edi
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x34]
push eax
mov word [ebp - 0x24], 0x53
mov word [ebp - 0x22], 0x65
mov word [ebp - 0x20], 0x74
mov word [ebp - 0x1e], 0x75
mov word [ebp - 0x1c], 0x70
mov word [ebp - 0x1a], bx
mov word [ebp - 0x2a], 0xc
mov word [ebp - 0x2c], 0xa
call fcn.004bf697
push dword [ebp - 0x30]
mov edi, eax
call sym.ntoskrnl.exe_NtClose
cmp edi, ebx
jge 0x457196
mov eax, edi
jmp 0x457218
movzx eax, word [esi]
inc eax
inc eax
push eax
push dword [esi + 4]
lea eax, [ebp - 0x2c]
push 1
push ebx
push eax
push dword [ebp - 0x34]
mov word [ebp - 0x24], 0x53
mov word [ebp - 0x22], 0x79
mov word [ebp - 0x20], 0x73
mov word [ebp - 0x1e], 0x74
mov word [ebp - 0x1c], 0x65
mov word [ebp - 0x1a], 0x6d
mov word [ebp - 0x18], 0x50
mov word [ebp - 0x16], 0x61
mov word [ebp - 0x14], 0x72
mov word [ebp - 0x12], 0x74
mov word [ebp - 0x10], 0x69
mov word [ebp - 0xe], 0x74
mov word [ebp - 0xc], 0x69
mov word [ebp - 0xa], 0x6f
mov word [ebp - 8], 0x6e
mov word [ebp - 6], bx
mov word [ebp - 0x2a], 0x20
mov word [ebp - 0x2c], 0x1e
call sym.ntoskrnl.exe_ZwSetValueKey
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0040d8f1
leave
ret 4
Function at 0x465642
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
xor ecx, ecx
movzx edx, word [esi + ecx*2 + 2]
movzx edi, word [esi + ecx*2]
xor edx, edi
add eax, edx
inc ecx
inc ecx
cmp ecx, 0x20
jb 0x465651
mov edi, 0x399b
xor edx, edx
mov ecx, edi
div ecx
mov ebx, edx
mov dword [ebp + 8], ebx
jmp 0x465695
push 0x40
push esi
push eax
call sym.ntoskrnl.exe_RtlCompareMemory
cmp eax, 0x40
je 0x4656a7
lea eax, [ebx + 1]
xor edx, edx
mov ecx, edi
div ecx
mov ebx, edx
cmp ebx, dword [ebp + 8]
je 0x4656ce
mov ecx, dword [0x47c454]
mov eax, ebx
shl eax, 6
add eax, ecx
cmp dword [eax], 0
jne 0x465677
mov ecx, dword [0x47c454]
mov eax, ebx
shl eax, 6
lea edi, [ecx + eax]
cmp dword [edi], 0
jne 0x4656c5
push 0x10
pop ecx
rep movsd dword es:[edi], dword [esi]
inc dword [0x4892c8]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov eax, edi
jmp 0x4656c7

Function at 0x46ae63
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
movzx edx, word [eax + 0x18]
and word [eax + 0x16], 0xf1e2
xor ecx, ecx
push esi
push edi
xor edi, edi
cmp edx, 0x10b
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
je 0x46aebd
cmp edx, 0x20b
je 0x46aea0
xor al, al
jmp 0x46af71
mov esi, dword [eax + 0x84]
mov dword [eax + 0x30], ecx
mov dword [eax + 0x70], ecx
mov dword [eax + 0x74], ecx
mov dword [eax + 0x78], ecx
mov dword [eax + 0x7c], ecx
lea edx, [eax + 0x88]
jmp 0x46aec3
mov esi, dword [eax + 0x74]
lea edx, [eax + 0x78]
cmp esi, 2
mov dword [eax + 0x58], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x50], ecx
mov dword [eax + 0x54], ecx
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], ecx
jbe 0x46aef5
mov edi, dword [edx + 0x10]
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], ecx
cmp esi, 4
push ebx
jbe 0x46af07
mov ebx, dword [edx + 0x20]
mov dword [ebp - 4], ebx
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], ecx
cmp esi, 5
jbe 0x46af18
mov ebx, dword [edx + 0x28]
mov dword [ebp - 8], ebx
mov dword [edx + 0x28], ecx
mov dword [edx + 0x2c], ecx
cmp esi, 0xb
pop ebx
jbe 0x46af24
mov dword [edx + 0x58], ecx
mov dword [edx + 0x5c], ecx
cmp esi, 6
jbe 0x46af2c
mov dword [edx + 0x34], ecx
movzx esi, word [eax + 6]
cmp esi, ecx
movzx edx, word [eax + 0x14]
lea edx, [edx + eax + 0x18]
je 0x46af6f
lea eax, [edx + 0x14]
mov edx, dword [eax - 8]
cmp edx, edi
mov dword [eax - 4], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov word [eax + 0xc], cx
mov word [eax + 0xe], cx
je 0x46af63
cmp edx, dword [ebp - 4]
je 0x46af63
cmp edx, dword [ebp - 8]
jne 0x46af69
mov dword [eax - 8], ecx
mov dword [eax - 0xc], ecx
add eax, 0x28
dec esi
jne 0x46af3f
mov al, 1
pop edi
pop esi
leave
ret 4
Function at 0x46b076
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
shr eax, 2
push 0
pop esi
not ebx
not esi
je 0x46b0c1
mov dword [ebp + 8], eax
mov ecx, dword [edi]
xor ecx, 0x55555555
mov eax, ebx
mul ecx
mov dword [ebp - 8], eax
mov eax, ebx
mov ecx, ebx
shld ecx, esi, 0x17
xor ecx, dword [ebp - 8]
shld esi, eax, 0x17
add edi, 4
xor esi, edx
dec dword [ebp + 8]
mov ebx, ecx
jne 0x46b097
pop edi
mov edx, esi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x4a12ba
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
lea esi, [edx + ecx]
and ecx, 0xfffffffc
xor eax, eax
add ecx, edx
cmp edx, ecx
jae 0x4a12de
xor eax, dword [edx]
add edx, 4
rol eax, 3
jmp 0x4a12d0
cmp edx, esi
mov ecx, edx
jb 0x51e592
pop esi
pop ebp
ret 8
movzx edx, byte [ecx]
xor eax, edx
inc ecx
rol eax, 3
cmp ecx, esi
jb 0x51e592
jmp 0x4a12e8
Function at 0x4b1915
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x6274624f
push 0x44
push 1
call sym.ntoskrnl.exe_ExAllocatePoolWithTag
mov esi, eax
test esi, esi
je 0x4b19c6
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4b194b
push 0x44
push ebx
call sym.ntoskrnl.exe_PsChargeProcessPagedPoolQuota
test eax, eax
jl 0x52f3da
push edi
push 0x11
pop ecx
push 0x1000
xor eax, eax
mov edi, esi
push ebx
rep stosd dword es:[edi], eax
call fcn.004b18c0
test eax, eax
je 0x52f3e9
push 4
pop edx
lea ecx, [eax + 4]
mov dword [esi], eax
mov edi, edx
mov ebx, ecx
mov dword [ebx], edi
add edi, edx
add ebx, 8
cmp edi, 0x804
jb 0x4b1974
mov dword [ecx], 0xfffffffe
xor ecx, ecx
mov dword [eax + 0xffc], ecx
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edx
mov dword [esi + 0x38], 0x800
mov dword [esi + 4], eax
mov eax, dword fs:[0x124]
mov eax, dword [eax + 0x44]
mov eax, dword [eax + 0x84]
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x40], ecx
lea edi, [esi + 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esi + 0x24], ecx
mov eax, esi
pop edi
pop ebx
pop esi
pop ebp
ret 4
push 0
push esi
call sym.ntoskrnl.exe_ExFreePoolWithTag
xor eax, eax
jmp 0x4b19c5
push eax
push esi
call sym.ntoskrnl.exe_ExFreePoolWithTag
test ebx, ebx
je 0x52f3fc
push 0x44
push ebx
call sym.ntoskrnl.exe_PsReturnProcessPagedPoolQuota
xor eax, eax
jmp 0x4b19c4
Function at 0x4b24d8
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call sym.ntoskrnl.exe_ObfReferenceObject
lea eax, [ebp - 0x10]
xor ebx, ebx
push edi
mov byte [ebp - 0x18], 1
mov byte [ebp - 0x16], 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
call sym.ntoskrnl.exe_IoGetRelatedDeviceObject
mov dword [ebp + 8], eax
movsx eax, byte [eax + 0x30]
push ebx
push eax
call sym.ntoskrnl.exe_IoAllocateIrp
mov esi, eax
cmp esi, ebx
je 0x50fd6f
mov dword [esi + 0x64], edi
mov eax, dword fs:[0x124]
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x50], eax
lea eax, [ebp - 0x18]
mov dword [esi + 0x2c], eax
lea eax, [ebp - 8]
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x60]
mov dword [esi + 8], 0x1004
sub eax, 0x24
mov byte [esi + 0x20], bl
mov dword [esi + 0x30], ebx
mov byte [eax], 5
mov dword [eax + 0x18], edi
or dword [esi + 8], 0x10
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 8], ecx
mov cl, 1
call dword [sym.imp.HAL.dll_KfRaiseIrql]
mov edx, dword [esi + 0x50]
add edx, 0x210
lea edi, [esi + 0x10]
mov cl, al
mov eax, dword [edx]
mov dword [edi], eax
mov dword [edi + 4], edx
mov dword [eax + 4], edi
mov dword [edx], edi
call dword [sym.imp.HAL.dll_KfLowerIrql]
mov ecx, dword [ebp + 8]
mov edx, esi
call sym.ntoskrnl.exe_IofCallDriver
cmp eax, 0x103
je 0x50fd80
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
pop edi
pop esi
pop ebx
leave
ret 0x14
mov ecx, edi
call sym.ntoskrnl.exe_ObfDereferenceObject
mov eax, 0xc000009a
jmp 0x4b25ad
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
call sym.ntoskrnl.exe_KeWaitForMutexObject
mov eax, dword [ebp - 8]
jmp 0x4b25a5
Function at 0x4c2a67
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ebp + 8]
mov eax, edi
shr eax, 0x14
and eax, 0xffc
mov eax, dword [eax - 0x3fd00000]
and ax, 0x81
cmp al, 0x81
je 0x4f25c6
and dword [ebp - 8], 0
push ebx
push esi
mov eax, dword fs:[0x124]
push 1
mov esi, eax
dec dword [esi + 0xd4]
push 0x483b40
call sym.ntoskrnl.exe_ExAcquireResourceSharedLite
push 1
push edi
call fcn.004c29c8
mov ebx, eax
mov eax, dword [ebx + 0x18]
push eax
sub edi, eax
call sym.ntoskrnl.exe_RtlImageNtHeader
movzx ecx, word [eax + 0x14]
and dword [ebp - 4], 0
lea ecx, [ecx + eax + 0x18]
movzx eax, word [eax + 6]
test eax, eax
mov dword [ebp - 0xc], eax
jbe 0x4c2b04
mov edx, dword [ecx + 0x10]
mov eax, dword [ecx + 8]
cmp edx, eax
jb 0x51820d
mov eax, dword [ecx + 0xc]
cmp edi, eax
jb 0x4c2af6
add eax, edx
cmp edi, eax
jb 0x4c2b33
add ecx, 0x28
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jb 0x4c2adb
mov ecx, 0x483b40
call sym.ntoskrnl.exe_ExReleaseResourceLite
inc dword [esi + 0xd4]
jne 0x4c2b21
lea eax, [esi + 0x34]
cmp dword [eax], eax
jne 0x518219
mov eax, dword [ebp - 8]
test eax, eax
pop esi
pop ebx
je 0x51822a
pop edi
leave
ret 4
mov eax, dword [ecx + 0xc]
mov edx, dword [ebx + 0x18]
add eax, edx
cmp dword [ecx + 0x18], eax
mov dword [ebp - 8], ecx
jne 0x5087c3
push ecx
call sym.ntoskrnl.exe_MmLockPagableSectionByHandle
jmp 0x4c2b04
mov eax, edi
jmp 0x4c2b2e
mov dword [ecx + 0x18], eax
and dword [ecx + 0x20], 0
jmp 0x4c2b47
mov edx, eax
jmp 0x4c2ae9
mov cl, 1
mov byte [esi + 0x49], 1
call dword [sym.imp.HAL.dll_HalRequestSoftwareInterrupt]
jmp 0x4c2b21
push eax
push eax
push dword [ebp + 8]
push 0x1234
push 0x1a
call sym.ntoskrnl.exe_KeBugCheckEx
int3

Function at 0x4c2c4f
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor eax, eax
xor ecx, ecx
mov edx, dword [ebp + 8]
xor eax, dword [edx + ecx*4]
inc ecx
cmp ecx, 0x7f
jb 0x4c2c58
cmp eax, 0xffffffff
je 0x53834d
test eax, eax
je 0x538355
pop ebp
ret 4
push 0xfffffffffffffffe
pop eax
jmp 0x4c2c6d
inc eax
jmp 0x4c2c75
Function at 0x4d0ddd
Capabilities:
Enumerate pe sections

Disassembly:
push 0
push esi
push eax
call fcn.004342bd
xor eax, eax
jmp 0x4d0e2d
mov edi, edi
push ebp
mov ebp, esp
push ecx
test byte [0x487fa8], 1
jne 0x4d0e40
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x18]
push ebx
push esi
push edi
push eax
mov dword [ebp + 8], eax
call sym.ntoskrnl.exe_RtlImageNtHeader
mov ebx, eax
movzx eax, word [ebx + 0x14]
movzx ecx, word [ebx + 6]
lea edi, [eax + ebx + 0x18]
xor eax, eax
xor esi, esi
test ecx, ecx
jbe 0x4d0e3d
mov dword [ebp - 4], ecx
mov ecx, dword [edi]
cmp ecx, 0x45474150
je 0x4d0e44
cmp ecx, 0x6164652e
je 0x4d0e44
test eax, eax
jne 0x4d0dcb
add edi, 0x28
dec dword [ebp - 4]
jne 0x4d0e17
test eax, eax
jne 0x519a99
pop edi
pop esi
pop ebx
leave
ret 4
test eax, eax
jne 0x4d0e62
mov eax, dword [edi + 0xc]
mov ecx, dword [ebp + 8]
lea eax, [eax + ecx + 0xfff]
shr eax, 0xa
and eax, 0x3ffffc
sub eax, 0x40000000
mov ecx, dword [edi + 0x10]
mov edx, dword [edi + 8]
cmp ecx, edx
jb 0x519a92
mov edx, dword [ebx + 0x38]
add edx, dword [edi + 0xc]
add edx, ecx
mov ecx, dword [ebp + 8]
lea esi, [edx + ecx - 0x1001]
shr esi, 0xa
and esi, 0x3ffffc
sub esi, 0x40000000
jmp 0x4d0e2d
mov ecx, edx
jmp 0x4d0e70
push 0
push esi
push eax
call fcn.004342bd
jmp 0x4d0e3d

Function at 0x4d228a
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x18]
mov eax, dword [eax + 0x20]
mov ecx, edi
shr ecx, 0xa
shr eax, 0xc
and ecx, 0x3ffffc
push edi
lea esi, [ecx + eax*4 - 0x40000000]
call sym.ntoskrnl.exe_RtlImageNtHeader
movzx ecx, word [eax + 6]
movzx edx, word [eax + 0x14]
add edx, eax
lea ebx, [ecx + ecx*4]
lea edx, [edx + ebx*8 + 0x18]
xor eax, eax
xor ebx, ebx
test ecx, ecx
jbe 0x4d233a
sub edx, 0x28
test byte [edx + 0x27], 2
je 0x4d22df
inc ebx
cmp ebx, ecx
mov eax, edx
jb 0x4d22cf
test eax, eax
je 0x4d233a
mov eax, dword [eax + 0xc]
lea eax, [edi + eax + 0xfff]
shr eax, 0xa
push 0
and eax, 0x3ffffc
sub eax, 0x40000000
push 0
push dword [0x40d8c4]
sub esi, eax
sar esi, 2
push esi
push eax
call fcn.0041568a
mov esi, eax
push 0x12
push esi
call fcn.00434a14
mov edx, esi
neg edx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 8]
mov ecx, 0x488028
xadd dword [ecx], eax
mov dword [ebp + 8], edx
mov eax, dword [ebp + 8]
mov ecx, 0x483ba0
xadd dword [ecx], eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4d504b
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
test byte [0x487fa8], 1
jne 0x4d511a
mov eax, dword [ebp + 8]
shr eax, 0x14
and eax, 0xffc
mov eax, dword [eax - 0x3fd00000]
and ax, 0x81
cmp al, 0x81
je 0x4d511a
push 0
push dword [ebp + 8]
call fcn.004c29c8
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x4d5094
cmp ecx, 0xffffffff
jne 0x4d511a
push esi
push edi
mov edi, dword [eax + 0x18]
push edi
call sym.ntoskrnl.exe_RtlImageNtHeader
movzx ecx, word [eax + 0x14]
lea esi, [ecx + eax + 0x18]
movzx eax, word [eax + 6]
test eax, eax
jbe 0x4d5118
push ebx
mov ebx, eax
test byte [esi + 0x27], 2
jne 0x4d5111
mov eax, dword [esi]
cmp eax, 0x45474150
je 0x4d5111
cmp eax, 0x6164652e
je 0x4d5111
cmp eax, 0x54494e49
je 0x4d5111
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
lea eax, [edi + ecx]
shr eax, 0xa
and eax, 0x3ffffc
mov dword [ebp + 8], edx
mov edx, dword [esi + 8]
sub eax, 0x40000000
cmp dword [ebp + 8], edx
jb 0x4d50f3
mov edx, dword [ebp + 8]
add ecx, edx
lea ecx, [edi + ecx - 1]
shr ecx, 0xa
and ecx, 0x3ffffc
push 1
sub ecx, 0x40000000
push ecx
push eax
call fcn.004294bb
add esi, 0x28
dec ebx
jne 0x4d50b2
pop ebx
pop edi
pop esi
pop ebp
ret 4
Function at 0x4df401
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call sym.ntoskrnl.exe_ObfReferenceObject
lea eax, [ebp - 0x10]
xor ebx, ebx
push edi
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x16], 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
call sym.ntoskrnl.exe_IoGetRelatedDeviceObject
mov dword [ebp + 8], eax
movsx eax, byte [eax + 0x30]
push ebx
push eax
call sym.ntoskrnl.exe_IoAllocateIrp
mov esi, eax
cmp esi, ebx
je 0x5392dd
mov dword [esi + 0x64], edi
mov eax, dword fs:[0x124]
mov cl, byte [ebp + 0xc]
mov dword [esi + 0x50], eax
lea eax, [ebp - 0x18]
mov dword [esi + 0x2c], eax
lea eax, [ebp - 8]
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x60]
sub eax, 0x24
mov byte [esi + 0x20], bl
mov dword [esi + 8], 4
mov dword [esi + 0x30], ebx
mov dword [eax + 0x18], edi
mov byte [eax], 0x1b
mov byte [eax + 1], 0x16
xor edi, edi
mov dword [esi + 0x18], 0xc00000bb
mov dword [esi + 0xc], ebx
inc edi
push esi
mov byte [eax + 4], cl
mov dword [eax + 8], edi
call sym.ntoskrnl.exe_IoQueueThreadIrp
push edi
call fcn.004cc7d9
mov ecx, dword [ebp + 8]
mov edx, esi
call sym.ntoskrnl.exe_IofCallDriver
mov esi, eax
cmp esi, 0x103
jne 0x4df4c4
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
call sym.ntoskrnl.exe_KeWaitForMutexObject
mov esi, dword [ebp - 8]
push edi
call fcn.004cc80f
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0xc0000017
jmp 0x4df4cc
Function at 0x4f69a8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
not eax
jbe 0x4f69d8
mov edx, dword [ebp + 0xc]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4f69e0]
inc ecx
cmp ecx, dword [ebp + 0x10]
jb 0x4f69b9
not eax
pop ebp
ret 0xc
Function at 0x509318
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0xffdff124]
mov eax, dword [eax + 0x44]
cmp dword [eax + 0x158], 0
jne 0x50932c
xor eax, eax
ret
push ebp
mov ebp, esp
sub esp, 0x38
pushal
lea esi, [0x714]
push esi
call fcn.005639bb
test eax, 8
je 0x50936e
mov ebx, 0x10
cmp word [ebp + 8], 0xc
je 0x50935e
mov ebx, 7
cmp word [ebp + 8], 0xd
jne 0x50936e
test eax, 0x4000
jne 0x5094ed
jmp 0x5094cf
test eax, 0x10
je 0x5093ad
mov ebx, 5
cmp word [ebp + 8], 1
jne 0x509391
test eax, 0x4000
jne 0x5094ed
jmp 0x509489
mov ebx, 6
cmp word [ebp + 8], 3
jne 0x5093ad
test eax, 0x4000
jne 0x5094ed
jmp 0x5094ae
mov esi, dword [ebp]
cmp word [esi + 0x6c], 0x1b
je 0x509478
cmp word [ebp + 8], 0xb
jne 0x5093c9
inc dword ss:[0x5b5e28]
mov dword [ebp - 0x24], esi
mov eax, dword [esi + 0x78]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0x74]
mov dword [ebp - 0x34], eax
mov eax, dword [esi + 0x70]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0x6c]
mov dword [ebp - 0x2c], eax
lea esi, [ebp - 0x38]
call fcn.0050986a
test al, 0xff
je 0x509484
mov eax, dword [esi]
call fcn.005098f8
test al, 0xff
je 0x509484
mov ecx, dword [ebp + 8]
call fcn.00509abb
test al, 0xff
je 0x509484
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov dword [esi + 0x74], eax
xor bl, bl
test dword [esi + 0x70], 0x20000
jne 0x509427
mov bl, 7
mov eax, dword [ebp - 0x38]
or al, bl
mov dword [esi + 0x78], eax
mov eax, dword [ebp - 0x30]
push dword [esi + 0x70]
mov dword [esi + 0x70], eax
xor eax, dword [esp]
test eax, 0x20000
pop eax
je 0x509449
push esi
call fcn.004051f5
mov eax, dword [ebp - 0x2c]
or al, bl
cmp eax, 8
jae 0x509461
test dword [esi + 0x70], 0x20000
jne 0x509461
mov eax, 0x1b
mov dword [esi + 0x6c], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x68], eax
cmp word [ebp + 8], 1
jne 0x509478
and dword [esi + 0x70], 0xfffffeff
popal
mov eax, 1
mov esp, ebp
pop ebp
ret 4
popal
xor eax, eax
jmp 0x50947e
mov eax, dword [ebp]
and dword [eax + 0x70], 0xfffffeff
mov eax, dword [ebp + 0x68]
push 0
push 0
push 0
push 0
push eax
push 0x80000004
push dword [ebp]
call fcn.005096cb
jmp 0x509478
mov eax, 0
mov ebx, dword [ebp]
mov ebx, dword [ebx + 0x68]
dec ebx
push edx
push ecx
push eax
push 3
push ebx
push 0x80000003
push dword [ebp]
call fcn.005096cb
jmp 0x509478
mov eax, dword [ebp]
mov eax, dword [eax + 0x68]
push 0
push 0xffffffffffffffff
push 0
push 2
push eax
push 0xc0000005
push dword [ebp]
call fcn.005096cb
jmp 0x509478
mov eax, dword [ebp]
cmp ebx, 5
jne 0x5094fc
and dword [eax + 0x70], 0xfffffeff
mov eax, dword [eax + 0x68]
push 0
push 0
push ebx
push 1
push eax
push 0x40000005
push dword [ebp]
call fcn.005096cb
jmp 0x509478
Function at 0x509521
Capabilities:
Packed with generic packer

Disassembly:
mov edi, dword [0xffdff018]
mov ecx, 0xb0
push ebp
push 0x5096bd
push dword [0xffdff000]
mov dword [0xffdff000], esp
mov edi, dword [edi + 0xf18]
xor ebx, ebx
cmp edi, dword [sym.ntoskrnl.exe_MmUserProbeAddress]
jae 0x509568
lea esi, [edi + 0x634]
mov edi, dword [edi + 8]
lea edi, [ecx + edi]
cmp edi, dword [sym.ntoskrnl.exe_MmUserProbeAddress]
jae 0x509568
cmp word [esi], 0
je 0x509580
pop dword [0xffdff000]
add esp, 4
pop ebp
pop eax
push 0xb
push eax
jmp fcn.00509318
add esp, 0x3c
jmp 0x509568
inc dword ss:[0x5b5e28]
inc word [esi]
mov eax, dword [ebp + 0x68]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x74]
mov dword [esi + 8], eax
mov ax, word [ebp + 0x78]
mov word [esi + 6], ax
movzx eax, word [esi + 4]
sub esp, 0x38
push esi
mov esi, esp
add esi, 4
mov ecx, dword [ebp + 0x70]
mov dword [esi + 8], ecx
call fcn.005098f8
test al, 0xff
je 0x50957b
mov ebx, dword [esi + 0x28]
pop esi
add esp, 0x38
cmp ebx, dword [sym.ntoskrnl.exe_MmUserProbeAddress]
jae 0x509568
mov eax, dword [ebp + 0x70]
call fcn.0050919b
push esi
mov edx, 0xfe0
test word [esi + 2], 1
je 0x50961b
sub edx, 0x20
add edx, ebx
mov esi, dword [ebp + 0x74]
mov ecx, dword [ebp + 0x78]
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], esi
mov dword [edx + 0x1c], ecx
mov ecx, dword [ebp + 0x6c]
mov eax, dword [ebp + 0x68]
mov esi, dword [ebp + 0x64]
mov dword [edx + 0x10], ecx
mov dword [edx + 0xc], eax
mov dword [edx + 8], esi
pop esi
mov ecx, dword [esi + 0x1c]
mov eax, ecx
shr eax, 0x10
and ecx, 0xffff
mov dword [edx + 4], eax
mov dword [edx], ecx
jmp 0x509657
sub edx, 0x10
add edx, ebx
mov esi, dword [ebp + 0x74]
mov ecx, dword [ebp + 0x78]
mov word [edx + 0xa], ax
mov word [edx + 0xc], si
mov word [edx + 0xe], cx
mov ecx, dword [ebp + 0x6c]
mov eax, dword [ebp + 0x68]
mov esi, dword [ebp + 0x64]
mov word [edx + 8], cx
mov word [edx + 6], ax
mov word [edx + 4], si
pop esi
mov ecx, dword [esi + 0x18]
mov eax, ecx
shr eax, 0x10
mov word [edx + 2], ax
mov word [edx], cx
mov eax, dword [edi + 4]
sub edx, ebx
mov cx, word [edi]
mov bx, word [esi + 4]
test dword [edi + 0xc], 1
je 0x50967f
lea esi, [0x714]
and dword [esi], 0xfffffdff
and dword [ebp + 0x70], 0xfff7ffff
or cx, 7
or bx, 7
test dword [ebp + 0x70], 0x20000
jne 0x50969a
cmp cx, 8
jge 0x50969a
mov cx, 0x1b
mov word [ebp + 0x6c], cx
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x74], edx
mov word [ebp + 0x78], bx
pop dword [0xffdff000]
add esp, 4
pop ebp
mov eax, 1
ret