joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e33b
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0x1c02572c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x1401e3d5
test esi, esi
je 0x1401e3d5
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1401e3cc
mov dword [ebp - 0x2d0], 0x10001
xor ebx, ebx
jmp 0x1401e3b8
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x218], eax
jb 0x1401e3d5
add eax, dword [ebp + 0x10]
cmp dword [ebp - 0x218], eax
jae 0x1401e3d5
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp ebx, 3
jge 0x1401e3cc
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
inc ebx
lea eax, [ebp - 0x2d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x1401e386
jmp 0x1401e3d5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1401e6b7
mov esp, ebp
pop ebp
ret

Function at 0x1401e573
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1c02572c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [ebp - 0x48], eax
cmp dword [0x1c027aa0], 0x40
jae 0x1401e669
push esi
lea esi, [edx + ecx]
add ecx, dword [ebp + 0x14]
push edi
cmp ecx, 0x80000000
lea edi, [ebp - 0x44]
push 9
lea eax, [ecx + 0x7ff80000]
mov edx, 0xfff80000
cmovb edx, eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x48], edx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
lea edi, [esi - 0x7fff0000]
inc eax
cmp esi, 0x80000000
mov esi, dword [ebp - 0x48]
cmovb edi, eax
cmp edi, esi
jae 0x1401e667
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1401e642
cmp dword [ebp - 0x10], 0x10000
jne 0x1401e636
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
jb 0x1401e639
mov ecx, dword [ebp - 0x28]
cmp eax, ecx
jb 0x1401e639
lea eax, [ecx - 1]
xor edx, edx
add eax, edi
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x6c
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x1401e646
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
add edi, eax
cmp edi, esi
jb 0x1401e5eb
test ebx, ebx
je 0x1401e667
xor eax, eax
cmp dword [eax*4 + 0x1c0279a0], 0
je 0x1401e65a
inc eax
cmp eax, 0x40
jb 0x1401e648
jmp 0x1401e667
inc dword [0x1c027aa0]
mov dword [eax*4 + 0x1c0279a0], ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1401e6b7
mov esp, ebp
pop ebp
ret

Function at 0x1402b4e4
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1402b3e9
Function at 0x140355a2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x11f60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push edi
push eax
lea ecx, [ebp - 0x14]
push ecx
call esi
lea eax, [ebp - 0x2c]
push eax
xor edi, edi
push 0x20019
lea ecx, [ebp + 8]
lea edx, [ebp - 0x14]
push ecx
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0x240
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, edi
jl 0x120c2
mov edx, dword [ebp + 0xc]
push ebx
push edx
lea eax, [ebp - 0xc]
push eax
call esi
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea ecx, [ebp - 4]
push ecx
push edi
push edi
push 2
lea edx, [ebp - 0xc]
push edx
push eax
call ebx
cmp eax, 0xc0000034
je 0x120b2
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x120b2
push eax
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
call edi
mov esi, eax
test esi, esi
jne 0x12013
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop ebx
pop edi
mov eax, 0xc000009a
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebp - 4]
push edx
push 0
push esi
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
add esp, 0xc
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push ecx
push esi
push 2
lea edx, [ebp - 0xc]
push edx
push eax
call ebx
mov ebx, eax
test ebx, ebx
jge 0x12043
mov ecx, dword [ebp + 8]
push ecx
jmp 0x12098
cmp dword [esi + 4], 3
jne 0x1208f
mov eax, dword [esi + 8]
cmp eax, 2
jbe 0x1208f
push eax
push 1
call edi
mov edi, eax
test edi, edi
je 0x12088
mov edx, dword [esi + 8]
push edx
push 0
push edi
call sub.ntoskrnl.exe_memset
mov eax, dword [esi + 8]
push eax
lea ecx, [esi + 0xc]
push ecx
push edi
call sub.ntoskrnl.exe_memcpy
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [edx], edi
mov eax, dword [esi + 8]
add esp, 0x18
mov dword [ecx], eax
jmp 0x12094
mov ebx, 0xc000009a
jmp 0x12094
mov ebx, 0xc000003e
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc0000034
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x120d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push eax
lea ecx, [ebp - 0xc]
push ecx
call esi
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x2c]
lea edx, [ebp - 0xc]
push ecx
mov dword [ebp - 0x24], edx
push 0xf003f
lea edx, [ebp + 8]
push edx
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0x240
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
jl 0x1216c
mov eax, dword [ebp + 8]
push eax
call fcn.00011880
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x14]
push edx
call esi
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 8]
push ecx
push 3
push 0
lea edx, [ebp - 0x14]
push edx
push eax
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ecx, dword [ebp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x12490
Capabilities:
Get file attributes
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x38
test eax, eax
je 0x124a3
mov dword [eax], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x124b0
mov dword [eax], 0
mov eax, dword [ebp + 8]
push 0
push 0
push 0x20
push 1
push 1
push 0x80
push 0
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 0x18], eax
push 0x120089
lea eax, [ebp + 8]
push eax
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0x240
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jl 0x125dc
mov eax, dword [ebp + 8]
push esi
push edi
push 5
push 0x18
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 8]
push edx
push eax
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov edi, eax
test edi, edi
jl 0x125ce
mov eax, dword [ebp - 0x30]
test eax, eax
jbe 0x125c9
cmp dword [ebp - 0x2c], 0
jne 0x125c9
push eax
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov esi, eax
test esi, esi
je 0x125b0
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp + 8]
push 0
push 0
push ecx
push esi
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov edi, eax
test edi, edi
jge 0x1258f
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp + 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp + 8]
push ecx
mov dword [eax], edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 8]
push ecx
mov edi, 0xc000009a
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov edi, 0xc0000028
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x125f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.000181b0
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea ecx, [ebp - 8]
push ecx
call fcn.00018480
xor esi, esi
push esi
push esi
push 0x20
push 5
push 3
push 0x80
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x30]
lea edx, [ebp - 8]
push ecx
mov dword [ebp - 0x28], edx
push 0xc0000000
lea edx, [ebp + 8]
push edx
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], 0x240
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
cmp eax, esi
jl 0x1268e
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push esi
lea eax, [ebp - 0x10]
push eax
push ecx
mov ecx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
push ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov edx, dword [ebp + 8]
push edx
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x129b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x129d1
mov eax, 0xc0000001
pop esi
mov esp, ebp
pop ebp
ret 8
push ebx
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0xc]
push eax
mov dword [ebp - 0x1c], ecx
push 0xf003f
lea ecx, [ebp - 4]
xor ebx, ebx
push ecx
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x18], 0x240
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], edx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
jl 0x12b32
mov eax, dword [ebp - 4]
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_ZwQueryKey]
lea edx, [ebp + 0xc]
push edx
push ebx
push ebx
push 2
push eax
call edi
mov eax, dword [ebp + 0xc]
add eax, 2
push eax
push ebx
mov dword [ebp + 0xc], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov ecx, dword [ebp - 4]
mov esi, eax
mov dword [ebp + 8], esi
cmp esi, ebx
jne 0x12a61
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
pop ebx
mov eax, 0xc000009a
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 0xc]
push edx
push eax
push esi
push 2
push ecx
call edi
mov edi, eax
cmp edi, ebx
jge 0x12a92
push ebx
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
mov edi, dword [esi + 0x14]
cmp edi, ebx
je 0x12b10
dec edi
cmp edi, ebx
jl 0x12b10
mov ebx, dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov ecx, dword [ebp - 4]
lea eax, [ebp + 0xc]
push eax
push 0
push 0
push 0
push edi
push ecx
call ebx
mov eax, dword [ebp + 0xc]
add eax, 2
push eax
push 0
mov dword [ebp + 0xc], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov esi, eax
test esi, esi
je 0x12b08
mov edx, dword [ebp + 0xc]
push edx
push 0
push esi
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push ecx
push esi
push 0
push edi
push edx
call ebx
test eax, eax
jl 0x12aff
mov ecx, dword [ebp - 4]
lea eax, [esi + 0x10]
push eax
push ecx
call fcn.000129b0
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
sub edi, 1
jns 0x12aa4
mov esi, dword [ebp + 8]
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x12b40
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push ebx
lea ecx, [ebp - 0x20]
push ecx
xor ebx, ebx
push 0xf003f
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], 0x240
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
jl 0x12ca0
mov ecx, dword [ebp - 4]
push esi
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_ZwQueryKey]
lea eax, [ebp + 8]
push eax
push ebx
push ebx
push 2
push ecx
call edi
mov eax, dword [ebp + 8]
add eax, 2
push eax
push ebx
mov dword [ebp + 8], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov edx, dword [ebp - 4]
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, ebx
jne 0x12bc9
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
pop esi
mov eax, 0xc000009a
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push ecx
push esi
push 2
push edx
call edi
mov edi, eax
cmp edi, ebx
jge 0x12bfa
push ebx
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [esi + 0x14]
cmp edi, ebx
je 0x12c7e
dec edi
cmp edi, ebx
jl 0x12c7e
mov ebx, dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
lea esp, [esp]
mov edx, dword [ebp - 4]
lea ecx, [ebp + 8]
push ecx
push 0
push 0
push 0
push edi
push edx
call ebx
mov eax, dword [ebp + 8]
add eax, 2
push eax
push 0
mov dword [ebp + 8], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov esi, eax
test esi, esi
je 0x12c74
mov eax, dword [ebp + 8]
push eax
push 0
push esi
call sub.ntoskrnl.exe_memset
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp + 8]
push ecx
push edx
push esi
push 0
push edi
push eax
call ebx
test eax, eax
jl 0x12c6b
mov edx, dword [ebp - 4]
lea ecx, [esi + 0x10]
push ecx
push edx
call fcn.000129b0
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
sub edi, 1
jns 0x12c10
mov esi, dword [ebp - 8]
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov ecx, dword [ebp - 4]
push ecx
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x12f10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov word [0x22700], ax
mov ax, word [esi + 2]
add ax, 2
push edi
movzx ecx, ax
push ecx
xor edi, edi
push edi
mov word [0x22702], ax
call ebx
mov dword [0x22704], eax
cmp eax, edi
je 0x12ffd
movzx edx, word [0x22702]
push edx
push edi
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push esi
push 0x22700
call dword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea eax, [ebp - 0x2c]
push eax
push 0x20019
lea ecx, [ebp + 8]
push ecx
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0x240
mov dword [ebp - 0x24], 0x22700
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, edi
jl 0x13113
push str.ImagePath
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push edi
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
push 2
lea ecx, [ebp - 0xc]
push ecx
push edx
call edi
cmp eax, 0xc0000034
je 0x13104
mov eax, dword [ebp - 4]
test eax, eax
je 0x13104
add eax, 2
push eax
push 0
mov dword [ebp - 4], eax
call ebx
mov esi, eax
test esi, esi
jne 0x1300b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
pop esi
mov eax, 0xc000009a
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
push ecx
push 0
push esi
call sub.ntoskrnl.exe_memset
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 8]
push eax
push esi
push 2
lea ecx, [ebp - 0xc]
push ecx
push edx
call edi
mov edi, eax
test edi, edi
jge 0x13053
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 4], 2
jne 0x1309b
mov eax, dword [esi + 8]
cmp eax, 2
jbe 0x1309b
push eax
push 0
call ebx
mov dword [0x223b0], eax
test eax, eax
je 0x13094
mov ecx, dword [esi + 8]
push ecx
push 0
push eax
call sub.ntoskrnl.exe_memset
mov edx, dword [esi + 8]
mov ecx, dword [0x223b0]
push edx
lea eax, [esi + 0xc]
push eax
push ecx
call sub.ntoskrnl.exe_memcpy
add esp, 0x18
jmp 0x130a0
mov edi, 0xc000009a
jmp 0x130a0
mov edi, 0xc000003e
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test edi, edi
jl 0x130f9
mov eax, dword [0x223b0]
push eax
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x223c4
push 0x223c0
lea edx, [ebp - 0x14]
push edx
call fcn.00012490
mov edi, eax
test edi, edi
jl 0x130f9
mov eax, dword [0x223c4]
mov ecx, dword [0x223c0]
push eax
push ecx
push 0
call fcn.0001e970
mov dword [0x223c8], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc0000034
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x14c87
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x4c]
je 0x3178b
bswap cx
stc
mov ecx, dword [ebx + 8]
test dl, 0xdf
cmp ecx, edi
call fcn.00027fc7

Function at 0x154c0
Capabilities:
Encrypt data using speck

Disassembly:
lea esp, [esp + 0x28]
je fcn.00037845
pushal
jmp fcn.00049aa8

Function at 0x15577
Capabilities:
Encrypt data using speck

Disassembly:
pushfd
mov byte [esp], 0x1e
lea esp, [esp + 0x2c]
je 0x37c68
jmp fcn.000296a7

Function at 0x15803
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x20], edx
pop eax
mov ax, bp
not ah
setnp al
lea eax, [ebp - 0x24]
push 0xf2746335
pushal
jmp loc.0002f5fc

Function at 0x1628b
Capabilities:
Encrypt data using speck

Disassembly:
test eax, eax
push dword [esp]
pushal
mov byte [esp], dl
lea esp, [esp + 0x28]
jae 0x2aca2
je 0x32705
jmp fcn.0003c9ac
call fcn.0002858c
Function at 0x16790
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax + 0x28]
push edi
push 0x58
lea eax, [esi + 8]
push 0
lea ebx, [esi + 4]
push 0x226a0
mov dword [esi], 0
mov dword [ebx], 0
mov dword [ebp - 8], eax
mov dword [eax], 0
mov byte [esi + 0x3c], 0
call sub.ntoskrnl.exe_memset
mov edi, dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
add esp, 0xc
push 0
lea eax, [esi + 0xc]
push 1
push eax
call edi
push 0
lea eax, [esi + 0x1c]
push 1
push eax
mov dword [ebp - 0xc], eax
call edi
push 0
lea eax, [esi + 0x2c]
push 1
push eax
mov dword [ebp - 0x10], eax
call edi
mov ecx, dword [ebp + 8]
push ecx
push 0x15620
push 0
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
jl 0x16980
mov eax, dword [ebp - 4]
push 0
push esi
push 0
push 0
push 0x1fffff
push eax
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov ecx, dword [ebp - 4]
push ecx
mov edi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
test edi, edi
jl 0x168db
mov edx, dword [ebp + 8]
push edx
push 0x16110
push 0
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov edi, eax
test edi, edi
jl 0x168db
mov ecx, dword [ebp - 4]
push 0
push ebx
push 0
push 0
push 0x1fffff
push ecx
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov edx, dword [ebp - 4]
push edx
mov edi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
test edi, edi
jl 0x168db
mov eax, dword [ebp + 8]
push eax
push 0x16660
push 0
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov edi, eax
test edi, edi
jl 0x168db
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
push 0
push edx
push 0
push 0
push 0x1fffff
push eax
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov ecx, dword [ebp - 4]
push ecx
mov edi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
test edi, edi
jge 0x1697e
push 0
push 0
lea eax, [esi + 0xc]
push eax
mov byte [esi + 0x3c], 1
call dword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov eax, dword [esi]
test eax, eax
je 0x16910
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov ecx, dword [esi]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [esi], 0
mov edx, dword [ebp - 0xc]
mov esi, dword [sym.imp.ntoskrnl.exe_KeSetEvent]
push 0
push 0
push edx
call esi
mov eax, dword [ebx]
test eax, eax
je 0x16943
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov ecx, dword [ebx]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [ebx], 0
mov eax, dword [ebp - 0x10]
push 0
push 0
push eax
call esi
mov esi, dword [ebp - 8]
mov eax, dword [esi]
test eax, eax
je 0x16973
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov ecx, dword [esi]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [esi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4