joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1473c
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
mov esi, ecx
lea eax, [esi + 4]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
push 5
push 0x18
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x24]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
cmp ebx, edi
jl 0x14844
cmp dword [ebp - 0x24], edi
mov ebx, 0xc0000001
jl 0x14844
jg 0x14797
cmp dword [ebp - 0x28], edi
jbe 0x14844
push 0x1000
lea eax, [ebp - 0x10]
push eax
call fcn.0001bcf6
mov ebx, eax
cmp ebx, edi
jl 0x14844
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 8]
mov ebx, eax
cmp ebx, edi
jl 0x14844
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
push 0x1fd78
lea eax, [ebp - 0x10]
push eax
call fcn.0001054c
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.000105e0
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
call fcn.0001447e
mov ebx, eax
cmp ebx, edi
jl 0x14844
mov eax, dword [esi]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
call dword [eax + 8]
mov ebx, eax
cmp ebx, edi
jl 0x14844
mov eax, dword [esi + 0x28]
cmp eax, edi
je 0x1482d
push dword [ebp + 0xc]
mov ecx, dword [0x13dec]
push edi
push eax
call fcn.0001df92
mov ebx, eax
cmp ebx, edi
jl 0x14844
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x1483b
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp - 4]
mov dword [esi + 0x24], eax
mov dword [ebp - 4], edi
push edi
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_KeReleaseMutex]
cmp dword [ebp - 4], edi
je 0x1485c
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x152f2
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x13dd8], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov esi, ecx
mov ebx, 0x1ff36
jne 0x15342
push ebx
lea eax, [ebp - 8]
push eax
call edi
push 0x13dd8
push 0
push 0
push 0x22
lea eax, [ebp - 8]
push eax
push 0xe8
push dword [0x13de0]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jl 0x153cb
push 0
push dword [0x13dd8]
call fcn.000141b0
test eax, eax
jl 0x153cb
mov eax, dword [0x13dd8]
mov eax, dword [eax + 0x28]
mov ecx, 0x15fea
mov dword [eax + 0x78], ecx
mov dword [eax + 0x80], ecx
mov dword [eax + 0xb0], 0x16074
push ebx
lea eax, [ebp - 8]
push eax
call edi
push 0x1ff0e
lea eax, [ebp - 0x10]
push eax
call edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
xor ecx, ecx
cmp eax, ecx
jl 0x153cb
mov eax, dword [0x13dd8]
or dword [eax + 0x1c], 4
mov eax, dword [0x13dd8]
and dword [eax + 0x1c], 0xffffff7f
lea eax, [esi + 0x64]
push ecx
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x58], ecx
mov dword [esi + 0x60], ecx
push 0x158ee
mov dword [eax + 4], eax
mov dword [eax], eax
call dword [sym.imp.ntoskrnl.exe_PsSetCreateProcessNotifyRoutine]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x15fbc
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jge 0x15fcc
xor eax, eax
jmp 0x15fcf
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], edx
xor dl, dl
mov dword [ecx + 0x1c], eax
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop ebp
ret 0xc

Function at 0x1b85c
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp ax, word [ecx]
je 0x1b873
or eax, 0xffffffff
jmp 0x1b8a5
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1b86e
movzx ecx, word [eax + 4]
cmp ecx, 0x14c
je 0x1b894
cmp ecx, 0x8664
jne 0x1b8a0
mov eax, dword [eax + 0x50]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
jmp 0x1b8a5
mov eax, 0xc0000001
pop ebp
ret 8
Function at 0x1b8ae
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
push ebx
xor ebx, ebx
mov eax, 0x5a4d
xor edx, edx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp ax, word [ecx]
je 0x1b8d5
or eax, 0xffffffff
jmp 0x1b97c
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1b8cd
push esi
movzx esi, word [eax + 4]
push edi
cmp esi, 0x14c
jne 0x1b8f5
mov dword [ebp - 4], eax
jmp 0x1b900
cmp esi, 0x8664
jne 0x1b975
mov dword [ebp - 8], eax
mov edi, dword [eax + 0x58]
mov dword [eax + 0x58], ebx
mov eax, dword [ebp + 0xc]
xor esi, esi
shr eax, 1
je 0x1b932
movzx ebx, word [ecx]
movzx esi, si
add esi, edx
lea edx, [esi + ebx]
mov esi, 0xffff
cmp esi, edx
sbb esi, esi
neg esi
inc ecx
inc ecx
dec eax
movzx esi, si
movzx edx, dx
jne 0x1b90f
xor ebx, ebx
movzx eax, si
add edx, eax
test byte [ebp + 0xc], 1
je 0x1b942
movzx eax, byte [ecx]
add edx, eax
add edx, dword [ebp + 0xc]
cmp byte [ebp + 0x10], bl
je 0x1b94e
xor eax, eax
jmp 0x1b95d
mov eax, edx
sub eax, edi
neg eax
sbb eax, eax
and eax, 0xc0000001
mov edx, edi
mov ecx, dword [ebp - 4]
cmp ecx, ebx
jne 0x1b967
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x58], edx
mov ecx, dword [ebp + 0x14]
cmp ecx, ebx
je 0x1b97a
mov dword [ecx], edx
jmp 0x1b97a
mov eax, 0xc0000001
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x1b986
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0x28
push 0x13980
call fcn.00010980
mov eax, dword [ebp + 0x10]
and dword [eax], 0
and dword [ebp - 0x20], 0
mov eax, 0x5a4d
mov ecx, dword [ebp + 8]
cmp ax, word [ecx]
je 0x1b9b1
or eax, 0xffffffff
jmp 0x1ba54
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1b9a9
mov edx, dword [eax + 0x50]
mov dword [ebp - 0x2c], edx
mov esi, dword [eax + 0x78]
add esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [esi + 0x1c]
add edi, ecx
mov dword [ebp - 0x34], edi
mov eax, dword [esi + 0x20]
add eax, ecx
mov dword [ebp - 0x28], eax
mov ebx, dword [esi + 0x24]
add ebx, ecx
mov dword [ebp - 0x38], ebx
and dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x1c]
cmp edx, dword [esi + 0x18]
jae 0x1ba37
and dword [ebp - 4], 0
mov edx, dword [eax + edx*4]
add edx, ecx
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 0x2c]
add edx, ecx
cmp dword [ebp - 0x24], edx
jb 0x1ba0f
mov dword [ebp - 4], 0xfffffffe
jmp 0x1ba7f
push dword [ebp + 0xc]
push dword [ebp - 0x24]
call sub.ntoskrnl.exe__stricmp
pop ecx
pop ecx
test eax, eax
jne 0x1ba5c
mov eax, dword [ebp - 0x1c]
movzx eax, word [ebx + eax*2]
mov eax, dword [edi + eax*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1ba43
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
and eax, 0x3fffffff
add eax, 0xc0000001
call fcn.000109c5
ret 0xc
mov dword [ebp - 4], 0xfffffffe
jmp 0x1ba7c
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
inc dword [ebp - 0x1c]
jmp 0x1b9e8
Function at 0x1ba8f
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, 0x5a4d
sub esp, 0xc
cmp ax, word [ecx]
je 0x1baac
or eax, 0xffffffff
jmp 0x1bb6d
push esi
mov esi, dword [ecx + 0x3c]
add esi, ecx
cmp dword [esi], 0x4550
jne 0x1bb69
movzx eax, word [esi + 4]
test eax, 0x14c
jne 0x1bad4
test eax, 0x8664
je 0x1bb69
mov eax, dword [esi + 0x54]
cmp eax, dword [ebp + 0xc]
ja 0x1bb69
push eax
push ecx
push dword [ebp + 8]
call sub.ntoskrnl.exe_memcpy
movzx ecx, word [esi + 6]
movzx eax, word [esi + 0x14]
and dword [ebp - 4], 0
add esp, 0xc
lea eax, [eax + esi + 0x18]
mov dword [ebp - 0xc], ecx
test ecx, ecx
jle 0x1bb5b
add eax, 0xc
push ebx
mov dword [ebp - 8], eax
push edi
mov edx, dword [eax + 4]
test edx, edx
je 0x1bb48
mov esi, dword [ebp + 8]
mov ecx, dword [eax]
mov ebx, dword [ebp + 0xc]
add ecx, esi
lea edi, [ecx + edx]
add esi, ebx
cmp edi, esi
ja 0x1bb59
mov esi, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov ebx, dword [ebp + 0x14]
add eax, esi
lea edi, [eax + edx]
add esi, ebx
cmp edi, esi
ja 0x1bb59
push edx
push eax
push ecx
call sub.ntoskrnl.exe_memcpy
mov eax, dword [ebp - 8]
add esp, 0xc
inc dword [ebp - 4]
mov ecx, dword [ebp - 4]
add eax, 0x28
cmp ecx, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jl 0x1bb0c
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
xor eax, eax
cmp dword [ebp - 4], ecx
sete al
dec eax
jmp 0x1bb6c
or eax, 0xffffffff
pop esi
leave
ret 0x10
Function at 0x1bfe2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x20]
push esi
push edi
xor edi, edi
mov dword [ebp - 8], edi
cmp eax, edi
je 0x1bffa
mov dword [eax], edi
cmp dword [ebp + 8], edi
jne 0x1c040
mov eax, 0x240
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
push 3
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x28], 0x18
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov esi, eax
cmp esi, edi
jl 0x1c109
mov eax, dword [ebp - 8]
mov dword [ebp + 8], eax
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ebx, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea eax, [ebp - 4]
push eax
push edi
push edi
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call ebx
mov esi, eax
cmp esi, 0x80000005
jne 0x1c071
xor esi, esi
mov eax, 0xc0000023
cmp esi, eax
jne 0x1c07c
xor esi, esi
cmp esi, edi
jl 0x1c108
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp - 4]
cmp ecx, edi
je 0x1c090
mov dword [ecx], edx
mov esi, eax
cmp dword [ebp + 0x18], edi
je 0x1c108
cmp dword [ebp + 0x1c], edi
je 0x1c108
push 0x4d434d4e
push edx
push edi
mov esi, 0xc0000001
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
test edi, edi
je 0x1c106
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push edi
push 2
push eax
push dword [ebp + 8]
call ebx
mov esi, eax
test esi, esi
jl 0x1c0fd
mov eax, dword [ebp + 0x14]
mov esi, 0xc0000001
cmp eax, 0xffffffff
je 0x1c0df
cmp eax, dword [edi + 4]
jne 0x1c0fd
mov eax, dword [edi + 8]
cmp dword [ebp + 0x1c], eax
jbe 0x1c0ea
mov dword [ebp + 0x1c], eax
mov esi, dword [ebp + 0x1c]
push esi
lea eax, [edi + 0xc]
push eax
push dword [ebp + 0x18]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edi, edi
pop ebx
cmp dword [ebp - 8], edi
je 0x1c117
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
mov eax, esi
pop esi
leave
ret 0x1c
Function at 0x1c124
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
cmp edi, esi
jne 0x1c177
mov eax, dword [ebp + 0xc]
push esi
push esi
push esi
mov dword [ebp - 0x1c], eax
push esi
lea eax, [ebp - 0x24]
push eax
push 0x2001f
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], 0x240
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov edi, eax
cmp edi, esi
jl 0x1c1aa
mov edi, dword [ebp - 4]
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0xc]
cmp dword [ebp + 0x18], esi
je 0x1c1a0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push eax
push edi
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
jmp 0x1c1a8
push eax
push edi
call dword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov edi, eax
cmp dword [ebp - 4], esi
je 0x1c1b8
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
pop edi
pop esi
leave
ret 0x18

Function at 0x1c2c7
Capabilities:
Read file on windows
Set file attributes
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
push 0x4d434d4e
push 0x1800
xor ebx, ebx
push ebx
mov edi, 0xc0000001
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x1c3a4
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
jmp 0x1c335
cmp edi, ebx
jl 0x1c399
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push dword [ebp - 4]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov edi, eax
cmp edi, ebx
jl 0x1c399
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], eax
adc dword [ebp - 8], ebx
xor eax, eax
push ebx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push 0x1000
push dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
call esi
mov edi, eax
cmp edi, 0xc0000011
jne 0x1c303
cmp byte [ebp + 0x10], bl
je 0x1c38b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
push 0x14
mov dword [ebp - 0x18], eax
push 8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov edi, eax
cmp edi, ebx
jl 0x1c399
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.00010d6b
mov edi, eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret 0xc
Function at 0x1c3b1
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
test eax, eax
jne 0x1c3ed
lea eax, [ebp - 4]
push eax
mov eax, dword [sym.imp.ntoskrnl.exe_IoFileObjectType]
push 0
push dword [eax]
push 0x10000000
push 0
push 0x200
push dword [ebp + 0xc]
call dword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
test eax, eax
jl 0x1c419
mov eax, dword [ebp - 4]
push esi
push 0xd
push 1
lea ecx, [ebp + 0xb]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
mov byte [ebp + 0xb], 1
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
cmp dword [ebp - 4], 0
mov esi, eax
je 0x1c416
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
pop esi
leave
ret 8

Function at 0x1c9de
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
push edi
push 5
mov dword [ebp - 4], edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov dword [ebp - 8], eax
cmp dword [ebp - 4], edi
je 0x1caa7
push esi
push 0x53595356
push dword [ebp - 4]
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
mov dword [ebp - 0xc], esi
cmp esi, edi
je 0x1caa6
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push esi
push 5
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x1ca98
push ebx
cmp dword [ebp + 0xc], edi
je 0x1ca4a
mov eax, dword [ebp + 0x10]
cmp eax, edi
je 0x1ca4a
mov ebx, dword [eax]
jmp 0x1ca4d
or ebx, 0xffffffff
mov dword [ebp - 8], 0xc0000001
test ebx, ebx
jbe 0x1ca97
push 1
push dword [ebp + 8]
lea eax, [esi + 0x38]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
jne 0x1ca7c
and dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1ca7b
mov ecx, dword [esi + 0x44]
mov dword [eax + edi*4], ecx
inc edi
mov eax, dword [esi]
test eax, eax
je 0x1ca88
add esi, eax
cmp edi, ebx
jb 0x1ca58
cmp dword [ebp - 8], 0
jl 0x1ca97
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1ca97
mov dword [eax], edi
pop ebx
push 0x53595356
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop esi
mov eax, dword [ebp - 8]
pop edi
leave
ret 0xc
Function at 0x1cab4
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
push esi
push 5
mov dword [ebp - 4], esi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov dword [ebp - 8], eax
cmp dword [ebp - 4], esi
je 0x1cb7f
push edi
push 0x53595356
push dword [ebp - 4]
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, esi
je 0x1cb7e
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push 5
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, esi
mov dword [ebp - 8], eax
jl 0x1cb72
mov ecx, dword [ebp + 8]
mov eax, edi
mov dword [ebp - 8], 0xc0000001
cmp dword [edi + 0x44], ecx
je 0x1cb2d
mov edx, dword [eax]
cmp edx, esi
je 0x1cb72
add eax, edx
cmp dword [eax + 0x44], ecx
jne 0x1cb20
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], esi
cmp ebx, esi
jne 0x1cb46
mov ecx, dword [ebp + 0x10]
cmp ecx, esi
je 0x1cb71
mov eax, dword [eax + 4]
mov dword [ecx], eax
jmp 0x1cb71
mov esi, dword [ebp + 0x10]
mov edx, dword [eax + 4]
mov ecx, dword [esi]
cmp edx, ecx
jbe 0x1cb54
mov edx, ecx
xor ecx, ecx
test edx, edx
jbe 0x1cb6f
add eax, 0xdc
mov edi, dword [eax]
mov dword [ebx + ecx*4], edi
inc ecx
add eax, 0x40
cmp ecx, edx
jb 0x1cb5f
mov edi, dword [ebp - 0xc]
mov dword [esi], ecx
pop ebx
push 0x53595356
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop edi
mov eax, dword [ebp - 8]
pop esi
leave
ret 0xc
Function at 0x1ced2
Capabilities:
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x28], eax
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
push 0x20
stosd dword es:[edi], eax
push 1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x30]
push eax
xor esi, esi
mov ecx, 0x100020
push ecx
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], 0x240
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp + 8], ecx
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov ebx, eax
cmp ebx, esi
jl 0x1cfc5
push dword [ebp - 0xc]
lea eax, [ebp - 0x30]
push 0x1000000
push 0x10
push esi
push eax
push 0xf001f
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x28], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateSection]
mov ebx, eax
cmp ebx, esi
jl 0x1cfc5
push 2
push 0x100000
push 1
lea eax, [ebp + 8]
push eax
push esi
push 0x10000
push esi
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
push dword [ebp - 8]
mov dword [ebp + 8], esi
call dword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov ebx, eax
cmp ebx, esi
jl 0x1cfc5
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.0001b986
mov ebx, eax
cmp ebx, esi
jl 0x1cfc5
mov edi, dword [ebp - 0x10]
cmp dword [ebp + 0x14], esi
je 0x1cfb9
cmp dword [ebp + 0x18], esi
je 0x1cfb9
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x14]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, esi
je 0x1cfc5
sub edi, dword [ebp - 4]
mov dword [eax], edi
cmp dword [ebp - 4], esi
je 0x1cfd5
push dword [ebp - 4]
push 0xffffffffffffffff
call dword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov edi, dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [ebp - 8], esi
je 0x1cfe5
push dword [ebp - 8]
call edi
cmp dword [ebp - 0xc], esi
je 0x1cfef
push dword [ebp - 0xc]
call edi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x14
Function at 0x1e511
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
mov esi, 0xc0000001
cmp eax, ebx
je 0x1e52c
mov dword [eax], ebx
cmp dword [ebp + 0xc], 0xe8
jb 0x1e5fe
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
cmp eax, 8
je 0x1e553
cmp eax, 3
je 0x1e553
cmp eax, 0x14
jne 0x1e5fd
lea ecx, [ebp - 4]
push ecx
push ebx
push ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [0x13de0]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov esi, eax
cmp esi, ebx
jl 0x1e5ef
test byte [edi + 0x1c], 4
je 0x1e57d
mov eax, dword [ebp - 4]
and dword [eax + 0x1c], 4
test byte [edi + 0x1c], 0x10
je 0x1e58a
mov eax, dword [ebp - 4]
and dword [eax + 0x1c], 0x10
mov eax, 0x100
test dword [edi + 0x20], eax
je 0x1e59a
mov ecx, dword [ebp - 4]
and dword [ecx + 0x20], eax
push ebx
push dword [ebp - 4]
call fcn.000141b0
mov esi, eax
cmp esi, ebx
jl 0x1e5ef
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
cmp esi, ebx
jbe 0x1e5cc
lea eax, [ebp + 0x14]
add eax, 4
mov edx, dword [eax]
add eax, 4
dec esi
mov ebx, dword [eax]
mov dword [ecx + edx*4 + 0x78], ebx
jne 0x1e5b9
xor ebx, ebx
add ecx, 4
push ecx
push edi
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStackSafe]
mov esi, eax
cmp esi, ebx
jl 0x1e5ef
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x1e5ec
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
je 0x1e5fd
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x1e925
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
jbe 0x1e93f
mov eax, dword [ebp + 8]
add eax, ecx
xor byte [eax], 0xa8
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x1e931
pop ebp
ret 8

Function at 0x1e948
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
and dword [ebp + 8], 0
cmp dword [edx], 0x77999977
mov eax, 0xc0000001
push ebx
mov ebx, dword [edx + 4]
mov dword [ebp - 4], eax
jne 0x1e9d2
mov ecx, dword [edx + 0x168]
and dword [edx + 4], 0
add ecx, 0x170
cmp ecx, dword [ebp + 0xc]
ja 0x1e9d2
push esi
mov esi, ecx
and esi, 3
and ecx, 0xfffffffc
push edi
mov edi, edx
jbe 0x1e99c
dec ecx
shr ecx, 2
inc ecx
mov eax, dword [edi]
xor dword [ebp + 8], eax
add edi, 4
dec ecx
jne 0x1e991
test esi, esi
jbe 0x1e9b0
lea ecx, [ebp + 8]
mov eax, ecx
sub edi, eax
mov al, byte [edi + ecx]
xor byte [ecx], al
inc ecx
dec esi
jne 0x1e9a7
cmp byte [ebp + 0x10], 0
mov ecx, dword [ebp + 8]
pop edi
pop esi
jne 0x1e9bd
mov ecx, ebx
cmp byte [ebp + 0x10], 0
mov dword [edx + 4], ecx
jne 0x1e9cb
cmp ebx, dword [ebp + 8]
jne 0x1e9cf
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
pop ebx
leave
ret 0xc
Function at 0x1f18f
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
xor esi, esi
push esi
push esi
push 0x60
push 3
xor eax, eax
push esi
push 0x80
mov dword [ebp - 0xc], esi
lea edi, [ebp - 8]
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x40000000
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], 0x240
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov edi, eax
cmp edi, esi
jl 0x1f208
push esi
push esi
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push dword [ebp + 0xc]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov edi, eax
cmp dword [ebp - 4], esi
je 0x1f216
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
pop edi
pop esi
leave
ret 0xc