joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5763e0
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x248], ecx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
mov edi, eax
xor eax, eax
push ebp
push 0x576602
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x23c]
mov eax, 0x576620
call fcn.00426014
lea eax, [ebp - 0x23c]
mov edx, 0x57663c
call fcn.00407c20
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 8]
call fcn.0041f1f8
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00407470
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00407a2c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [ebp - 0x30]
mov dword [edi], eax
mov eax, dword [ebp - 0x2c]
mov dword [edi + 4], eax
lea eax, [ebp - 0x238]
push eax
push 0x104
call sub.kernel32.dll_GetLogicalDriveStringsW
mov esi, eax
test esi, esi
jns 0x5764a3
add esi, 3
sar esi, 2
test esi, esi
jl 0x5765cc
inc esi
lea ebx, [ebp - 0x238]
lea eax, [ebp - 0x240]
movzx edx, word [ebx]
call fcn.00407a4c
push dword [ebp - 0x240]
lea eax, [ebp - 0x244]
movzx edx, word [ebx + 2]
call fcn.00407a4c
push dword [ebp - 0x244]
lea eax, [ebp - 0x248]
movzx edx, word [ebx + 4]
call fcn.00407a4c
push dword [ebp - 0x248]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00407d00
lea edx, [ebp - 0x24c]
mov eax, dword [ebp - 4]
call fcn.0041f1f8
mov eax, dword [ebp - 0x24c]
mov edx, dword [ebp - 8]
call fcn.0041dcf8
test al, al
jne 0x5765c2
mov eax, dword [ebp - 4]
call fcn.00407a2c
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 3
jne 0x5765c2
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0041f1f8
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00407a2c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00407db0
jne 0x576599
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp + 0xc]
jne 0x57657f
cmp eax, dword [ebp + 8]
jbe 0x5765c2
jmp 0x576581
jle 0x5765c2
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00407470
mov eax, dword [ebp - 0x30]
mov dword [edi], eax
mov eax, dword [ebp - 0x2c]
mov dword [edi + 4], eax
jmp 0x5765c2
mov eax, dword [edi]
mov edx, dword [edi + 4]
cmp edx, dword [ebp - 0x2c]
jne 0x5765aa
cmp eax, dword [ebp - 0x30]
jae 0x5765c2
jmp 0x5765ac
jge 0x5765c2
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00407470
mov eax, dword [ebp - 0x30]
mov dword [edi], eax
mov eax, dword [ebp - 0x2c]
mov dword [edi + 4], eax
add ebx, 8
dec esi
jne 0x5764b5
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.00407428
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x576609
lea eax, [ebp - 0x24c]
mov edx, 5
call fcn.004070a8
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004070a8
ret
Function at 0x576e70
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040712c
xor eax, eax
push ebp
push 0x576f10
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0041ec6c
test al, al
je 0x576efa
push 0x80
mov eax, dword [ebp - 4]
call fcn.00407a2c
mov esi, eax
push esi
call sub.kernel32.dll_SetFileAttributesW
push esi
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x576efa
call sub.kernel32.dll_GetLastError_1
mov edi, eax
push esi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x576ef4
test ah, 4
je 0x576ef4
test al, 0x10
je 0x576ef4
mov eax, dword [ebp - 4]
call fcn.00407a2c
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x576efa
push edi
call sub.kernel32.dll_SetLastError
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x576f17
lea eax, [ebp - 4]
call fcn.00407048
ret

Function at 0x576f20
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.0040714c
lea eax, [ebp - 8]
call fcn.0040714c
xor eax, eax
push ebp
push 0x576f85
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
call fcn.004078ec
push eax
mov eax, dword [ebp - 4]
call fcn.004078ec
push eax
call sub.kernel32.dll_CopyFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x576f8c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407108
ret
Function at 0x57a8a0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040712c
mov eax, dword [ebp - 8]
call fcn.0040712c
xor eax, eax
push ebp
push 0x57aa37
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0041ec6c
test al, al
je 0x57aa02
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00407b18
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00407b18
mov eax, dword [ebp - 0x14]
pop edx
call fcn.00576f20
test al, al
je 0x57aa02
mov eax, dword [ebp - 4]
call fcn.00407a2c
mov edi, eax
push edi
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x57a964
call sub.kernel32.dll_GetLastError_1
mov esi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x57a95e
test ah, 4
je 0x57a95e
test al, 0x10
je 0x57a95e
mov eax, dword [ebp - 4]
call fcn.00407a2c
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x57a964
push esi
call sub.kernel32.dll_SetLastError
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.004047c4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.0041f15c
push dword [ebp - 0x18]
push 0x57aa54
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.0056f548
push dword [ebp - 0x20]
push 0x57aa74
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00407d00
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.0041ec6c
test al, al
je 0x57aa00
mov eax, dword [ebp - 0xc]
call fcn.00407a2c
mov edi, eax
push edi
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x57aa00
call sub.kernel32.dll_GetLastError_1
mov esi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x57a9fa
test ah, 4
je 0x57a9fa
test al, 0x10
je 0x57a9fa
mov eax, dword [ebp - 0xc]
call fcn.00407a2c
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x57aa00
push esi
call sub.kernel32.dll_SetLastError
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57aa3e
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004070a8
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407108
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004070a8
ret
Function at 0x57aa80
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x57aa88
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040712c
mov eax, dword [ebp - 8]
call fcn.0040712c
xor eax, eax
push ebp
push 0x57abdf
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0041ec6c
test al, al
je 0x57abaa
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.0041ec6c
test al, al
jne 0x57aadb
mov bl, 1
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00407b18
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00407b18
mov eax, dword [ebp - 0x18]
pop edx
call fcn.00576f20
test al, al
je 0x57abaa
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.004047c4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041f15c
push dword [ebp - 0x1c]
push 0x57abfc
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.0056f548
push dword [ebp - 0x24]
push 0x57ac1c
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00407d00
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.0041ec6c
test al, al
je 0x57abaa
mov eax, dword [ebp - 0xc]
call fcn.00407a2c
mov edi, eax
push edi
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x57abaa
call sub.kernel32.dll_GetLastError_1
mov esi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x57aba4
test ah, 4
je 0x57aba4
test al, 0x10
je 0x57aba4
mov eax, dword [ebp - 0xc]
call fcn.00407a2c
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
jmp 0x57abaa
push esi
call sub.kernel32.dll_SetLastError
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57abe6
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004070a8
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00407108
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004070a8
ret
Function at 0x580e08
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040712c
xor eax, eax
push ebp
push 0x580ebb
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00407a2c
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
call fcn.004043dc
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00404cdc
push ebx
push 0x1000
push 0
push edi
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x580e9c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x580ecc
push ebx
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x580e9c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov esi, eax
and esi, 0xffff
mov eax, ebx
call fcn.004043f8
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x580ec2
lea eax, [ebp - 4]
call fcn.00407048
ret
Function at 0x110f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [0x14180]
mov ecx, dword [0x1408c]
push ebx
push esi
push edi
call fcn.000110a0
xor esi, esi
mov dword [ebp - 4], eax
test edx, edx
je 0x1114a
mov eax, 0xbb575653
mov ebx, 0xc1400c8d
mov edi, 0x6a02e1
cmp dword [ecx + esi + 5], 0xa10cec83
jne 0x11142
cmp dword [esi + ecx + 0xd], eax
jne 0x11142
cmp dword [esi + ecx + 0x1b], ebx
jne 0x11142
cmp dword [esi + ecx + 0x1f], edi
je 0x1126e
inc esi
cmp esi, edx
jb 0x11122
mov eax, dword [ebp - 4]
mov dword [ebp - 8], 0
xor esi, esi
mov ebx, 0xfe3b47c3
test edx, edx
je 0x11189
mov edi, 0xf685ff33
cmp dword [esi + ecx], 0xcb03328b
jne 0x11184
cmp dword [esi + ecx + 4], edi
jne 0x11184
cmp dword [esi + ecx + 0x1c], 0x3305e3c1
jne 0x11184
cmp dword [esi + ecx + 0x20], ebx
je 0x1127b
inc esi
cmp esi, edx
jb 0x11161
mov dword [ebp - 4], 0
xor esi, esi
test edx, edx
je 0x111be
mov edi, 0xff0cc283
jmp 0x111a0
cmp dword [esi + ecx], 0x3305e3c1
jne 0x111b9
cmp dword [esi + ecx + 4], ebx
jne 0x111b9
cmp dword [esi + ecx + 0x28], edi
je 0x11287
inc esi
cmp esi, edx
jb 0x111a0
mov dword [ebp - 0xc], 0
mov edi, dword [sym.imp.ntoskrnl.exe_memmove]
mov esi, dword [sym.imp.ntoskrnl.exe_DbgPrint]
mov bl, 0x90
test eax, eax
je 0x1120a
mov edx, 0x186a
cmp word [eax], dx
jne 0x1120a
push 7
lea ecx, [ebp - 0x18]
push ecx
push eax
mov word [ebp - 0x18], 0xcc2
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], bl
mov byte [ebp - 0x12], bl
call edi
push str.kissCRC1_n
call esi
add esp, 0x10
mov eax, dword [ebp - 8]
test eax, eax
je 0x11235
mov edx, 0xff8b
cmp word [eax], dx
jne 0x11235
push 2
lea ecx, [ebp - 0x18]
push ecx
push eax
mov byte [ebp - 0x18], 0xc3
mov byte [ebp - 0x17], bl
call edi
push str.kissCRC2_n
call esi
add esp, 0x10
mov eax, dword [ebp - 4]
test eax, eax
je 0x1124e
cmp byte [eax], 0x72
jne 0x1124e
push str.kissCRC2x1addr_n
mov byte [eax], 0x74
call esi
add esp, 4
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x11267
cmp byte [eax], 0x75
jne 0x11267
push str.kissCRC2x2addr_n
mov byte [eax], 0x74
call esi
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
add esi, ecx
mov dword [ebp - 8], esi
jmp 0x11151
lea esi, [esi + ecx + 0x27]
mov dword [ebp - 4], esi
jmp 0x11190
lea ecx, [esi + ecx + 0x2e]
mov dword [ebp - 0xc], ecx
jmp 0x111c5
Function at 0x112a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [0x1408c]
push ebx
xor eax, eax
push esi
lea esi, [ecx + 0x1ccd0]
push edi
mov dword [ebp - 0x10], 0xe99090
mov word [ebp - 0xc], ax
mov byte [ebp - 0xa], al
mov dword [ebp - 0x18], 0xe99090
mov word [ebp - 0x14], ax
mov byte [ebp - 0x12], al
movzx edi, word [esi]
xor ebx, ebx
mov edx, 0x32ff
cmp di, dx
setne bl
lea edx, [ebx - 1]
and edx, esi
mov dword [ebp - 8], edx
mov dword [0x140cc], edx
mov edx, 0x32ff
cmp di, dx
jne 0x11303
lea edx, [ecx + 0x1aab6]
jmp 0x11305
xor edx, edx
mov dword [0x14100], edx
movzx edi, word [ecx + 0x1e736]
lea esi, [ecx + 0x1e736]
mov dword [ebp - 4], edx
xor ebx, ebx
mov edx, 0x28f
cmp di, dx
setne bl
lea edx, [ebx - 1]
and edx, esi
mov esi, 0x28f
mov dword [0x14140], edx
cmp di, si
jne 0x11345
lea esi, [ecx + 0x1aab6]
jmp 0x11347
xor esi, esi
mov dword [0x140bc], esi
cmp dword [0x140dc], eax
je 0x113ce
cmp edx, eax
je 0x113ce
mov ecx, dword [ebp - 8]
cmp ecx, eax
je 0x113ce
cmp esi, eax
je 0x113ce
cmp dword [ebp - 4], eax
je 0x113ce
mov esi, dword [sym.imp.ntoskrnl.exe_memmove]
mov eax, 0x11030
sub eax, ecx
sub eax, 7
mov dword [ebp - 0xd], eax
mov eax, 0x11050
push 7
sub eax, edx
push ecx
sub eax, 7
push 0x14040
mov dword [ebp - 0x15], eax
call esi
mov ecx, dword [0x14140]
push 7
push ecx
push 0x14080
call esi
mov eax, dword [0x140cc]
push 7
lea edx, [ebp - 0x10]
push edx
push eax
call esi
mov edx, dword [0x14140]
push 7
lea ecx, [ebp - 0x18]
push ecx
push edx
call esi
push str.KissDebugPort___n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 0x34
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x11480
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x13138
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test eax, eax
jne 0x114b5
push str.NtOpenThread
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 4
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, 0xe8e075ff
push esi
lea ecx, [ecx]
cmp dword [ecx + eax], 0xcc75ff50
jne 0x114db
cmp dword [ecx + eax + 4], edx
jne 0x114db
mov esi, 0xf88b
cmp word [ecx + eax + 0xc], si
je 0x114e9
inc ecx
cmp ecx, 0x3e8
jb 0x114c0
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ecx + eax + 7]
push 6
push eax
push 0x14120
mov dword [0x140d4], eax
call dword [sym.imp.ntoskrnl.exe_memmove]
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x11510
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x13170
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test eax, eax
jne 0x11545
push str.NtKiAttachProcess
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 4
mov esp, ebp
pop ebp
ret
xor ecx, ecx
cmp byte [ecx + eax], 0xe8
je 0x1155a
inc ecx
cmp ecx, 0x3e8
jb 0x11547
mov esp, ebp
pop ebp
ret
mov edx, dword [ecx + eax + 1]
lea eax, [ecx + eax + 1]
lea eax, [eax + edx + 4]
push 7
push eax
push 0x14020
mov dword [0x1410c], eax
call dword [sym.imp.ntoskrnl.exe_memmove]
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x11740
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x14138]
xor ecx, ecx
mov dword [ebp - 8], 0xe9
mov dl, 0x90
mov word [ebp - 4], 0x9000
cmp eax, ecx
je 0x117bf
cmp byte [eax + 5], dl
je 0x117bf
mov ecx, 0x11070
sub ecx, eax
sub ecx, 5
push ebx
mov dword [ebp - 7], ecx
cli
mov eax, cr0
and eax, 0xfffeffff
mov cr0, eax
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
push 6
lea edx, [ebp - 8]
mov bl, al
mov eax, dword [0x14138]
push edx
push eax
call dword [sym.imp.ntoskrnl.exe_memmove]
add esp, 0xc
mov cl, bl
call dword [sym.imp.HAL.dll_KfLowerIrql]
mov eax, cr0
or eax, 0x10000
mov cr0, eax
sti
push str.KissTp_OpenProcess___n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x117d0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x140d4]
mov ecx, dword [eax]
cmp ecx, dword [0x14120]
je 0x1182e
push ebx
cli
mov eax, cr0
and eax, 0xfffeffff
mov cr0, eax
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
mov edx, dword [0x140d4]
push 6
push 0x14120
push edx
mov bl, al
call dword [sym.imp.ntoskrnl.exe_memmove]
add esp, 0xc
mov cl, bl
call dword [sym.imp.HAL.dll_KfLowerIrql]
mov eax, cr0
or eax, 0x10000
mov cr0, eax
sti
push str.KissTp_OpenThread___n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 4
pop ebx
ret

Function at 0x11830
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x1413c]
mov ecx, dword [eax]
cmp ecx, dword [0x140a0]
je 0x1188e
push ebx
cli
mov eax, cr0
and eax, 0xfffeffff
mov cr0, eax
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
mov edx, dword [0x1413c]
push 7
push 0x140a0
push edx
mov bl, al
call dword [sym.imp.ntoskrnl.exe_memmove]
add esp, 0xc
mov cl, bl
call dword [sym.imp.HAL.dll_KfLowerIrql]
mov eax, cr0
or eax, 0x10000
mov cr0, eax
sti
push str.KissTp_ReadVirtualMemory___n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 4
pop ebx
ret
Function at 0x11890
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x140d8]
mov ecx, dword [eax]
cmp ecx, dword [0x14060]
je 0x118ee
push ebx
cli
mov eax, cr0
and eax, 0xfffeffff
mov cr0, eax
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
mov edx, dword [0x140d8]
push 7
push 0x14060
push edx
mov bl, al
call dword [sym.imp.ntoskrnl.exe_memmove]
add esp, 0xc
mov cl, bl
call dword [sym.imp.HAL.dll_KfLowerIrql]
mov eax, cr0
or eax, 0x10000
mov cr0, eax
sti
push str.KissTp_WriteVirtualMemory___n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 4
pop ebx
ret

Function at 0x118f0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x1410c]
mov ecx, dword [eax]
cmp ecx, dword [0x14020]
je 0x1194e
push ebx
cli
mov eax, cr0
and eax, 0xfffeffff
mov cr0, eax
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
mov edx, dword [0x1410c]
push 7
push 0x14020
push edx
mov bl, al
call dword [sym.imp.ntoskrnl.exe_memmove]
add esp, 0xc
mov cl, bl
call dword [sym.imp.HAL.dll_KfLowerIrql]
mov eax, cr0
or eax, 0x10000
mov cr0, eax
sti
push str.KissTp_KiAttachProcess___n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 4
pop ebx
ret

Function at 0x11950
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x14050]
mov ecx, dword [eax]
cmp ecx, dword [section..data]
je 0x119ae
push ebx
cli
mov eax, cr0
and eax, 0xfffeffff
mov cr0, eax
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
mov edx, dword [0x14050]
push 7
push section..data
push edx
mov bl, al
call dword [sym.imp.ntoskrnl.exe_memmove]
add esp, 0xc
mov cl, bl
call dword [sym.imp.HAL.dll_KfLowerIrql]
mov eax, cr0
or eax, 0x10000
mov cr0, eax
sti
push str.DbgkpQueueMessage___n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 4
pop ebx
ret

Function at 0x119b0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x14108]
mov ecx, dword [eax]
cmp ecx, dword [0x14160]
je 0x11a0e
push ebx
cli
mov eax, cr0
and eax, 0xfffeffff
mov cr0, eax
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
mov edx, dword [0x14108]
push 7
push 0x14160
push edx
mov bl, al
call dword [sym.imp.ntoskrnl.exe_memmove]
add esp, 0xc
mov cl, bl
call dword [sym.imp.HAL.dll_KfLowerIrql]
mov eax, cr0
or eax, 0x10000
mov cr0, eax
sti
push str.DbgkpSetProcessDebugObject___n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 4
pop ebx
ret

Function at 0x11a10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x14138]
mov dword [ebp - 8], 0xffc875ff
mov word [ebp - 4], 0xdc75
test eax, eax
je 0x11a80
cmp byte [eax + 5], 0x90
jne 0x11a80
push ebx
cli
mov eax, cr0
and eax, 0xfffeffff
mov cr0, eax
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
mov ecx, dword [0x14138]
mov bl, al
push 6
lea eax, [ebp - 8]
push eax
push ecx
call dword [sym.imp.ntoskrnl.exe_memmove]
add esp, 0xc
mov cl, bl
call dword [sym.imp.HAL.dll_KfLowerIrql]
mov eax, cr0
or eax, 0x10000
mov cr0, eax
sti
push 0x13270
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 4
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x11f00
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0
push 0
push 5
call ebx
mov edi, dword [sym.imp.ntoskrnl.exe_DbgPrint]
mov ecx, dword [ebp - 4]
inc ecx
push ecx
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov esi, eax
test esi, esi
je 0x11f62
mov edx, dword [ebp - 4]
push 0
push edx
push esi
push 5
call ebx
cmp eax, 0xc0000004
jne 0x11f73
push 0x1332c
call edi
add dword [ebp - 4], 0x1000
add esp, 4
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x11f21
push 0x1331c
call edi
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.System
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
cmp dword [esi], 0
mov edi, esi
je 0x11fc9
mov ebx, dword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
nop
push 1
lea ecx, [ebp - 0xc]
push ecx
lea edx, [edi + 0x38]
push edx
call ebx
test eax, eax
je 0x11fb7
add edi, dword [edi]
cmp dword [edi], 0
jne 0x11f90
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 4], 0
je 0x11fc9
cmp dword [edi + 0x44], 0
je 0x11fc9
push edi
call fcn.00011e30
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret