joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f9be0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x526103
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00519f64
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0051f5fa
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00520b16
test eax, eax
je 0x4f9cfc
mov ecx, dword [esp + 0x3c]
call fcn.0051f627
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x4f9cc0
push edi
mov ecx, esi
call fcn.0051cc8b
mov ecx, esi
call fcn.004f9e60
cmp dword [esp + 0x38], 1
jne 0x4f9cf5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0051cdc6
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x4fc720
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4fc753
push esi
call fcn.004ff810
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4fc74c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4fc7d9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4fc7c2
mov eax, dword [esi + 8]
test eax, eax
je 0x4fc777
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4fc7be
cmp eax, 2
je 0x4fc7c2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4fc76a
cmp eax, 3
je 0x4fc79d
cmp eax, 1
jne 0x4fc76a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4fc76a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4fc76a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004fc800
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4fc7e8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004fc800
add esp, 4
pop esi
ret

Function at 0x51ad5a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x51ad92
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00518e0e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00518de6
jmp 0x51ad9e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x51c448
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x51c48a
call fcn.00521f01
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x51c48a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x51c481
xor eax, eax
jmp 0x51c492
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0051c498
pop edi
pop esi
pop ebx
ret 4

Function at 0x522431
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x52245f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x52247d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00522397
jmp 0x52247d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x52247d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00522397
test edi, edi
mov eax, edi
jne 0x522467
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1001e54
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x1004004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x2c
lea eax, [ebp - 0x238]
push esi
push eax
mov dword [ebp - 0x23c], esi
call fcn.0100242c
add esp, 0xc
push esi
push esi
push 1
push esi
call dword [fcn.01001028]
call dword [fcn.01001024]
push eax
push 0x10011f8
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.01001c16
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push esi
push 1
push esi
call dword [fcn.01001020]
mov dword [0x1004030], eax
cmp eax, esi
je 0x1001efd
call dword [int.0100101c]
cmp eax, 0xb7
je 0x1001efd
lea eax, [ebp - 0x23c]
push eax
call dword [fcn.0100102c]
push eax
call fcn.01001ab0
test eax, eax
jne 0x1001f10
push dword [0x1004030]
call dword [fcn.0100104c]
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01002443
leave
ret 0x10
cmp dword [ebp - 0x21c], 0xffffffff
jne 0x1001f28
lea eax, [ebp - 0x23c]
push eax
push edi
call fcn.01001a1d
jmp 0x1001f78
push ebx
push 1
push esi
call dword [fcn.01001040]
mov edi, dword [0x100110c]
push eax
call edi
mov ebx, eax
cmp ebx, esi
jne 0x1001f4b
push 0x7f05
push esi
call edi
mov ebx, eax
lea eax, [ebp - 0x23c]
push eax
push ebx
call fcn.01001cc6
test eax, eax
jne 0x1001f6c
cmp dword [section..data], 8
jne 0x1001f6c
push esi
push esi
call fcn.01002de7
cmp ebx, esi
je 0x1001f77
push ebx
call dword [fcn.01001108]
pop ebx
push dword [0x1004030]
call dword [fcn.0100104c]
xor eax, eax
jmp 0x1001f00

Function at 0x10029ad
Capabilities:
Query service status
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
xor esi, esi
push 1
push esi
push esi
mov dword [ebp - 4], esi
call dword [0x100100c]
mov dword [ebp - 8], eax
cmp eax, esi
jne 0x10029da
call dword [int.0100101c]
mov ebx, eax
jmp 0x1002a6e
push edi
push 0x14
push 0x10012a0
push eax
call dword [0x1001008]
mov edi, eax
cmp edi, esi
jne 0x10029f7
call dword [int.0100101c]
jmp 0x1002a50
push esi
push esi
push edi
call dword [0x1001004]
mov esi, dword [int.0100101c]
test eax, eax
jne 0x1002a16
call esi
mov ebx, eax
cmp ebx, 0x420
jne 0x1002a5b
mov ebx, 0x5b4
lea eax, [ebp - 0x24]
push eax
push edi
call dword [0x1001014]
test eax, eax
je 0x1002a4e
cmp dword [ebp - 0x20], 4
je 0x1002a54
cmp dword [ebp - 0x20], 1
je 0x1002a58
push 0x1f4
call dword [0x1001098]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jbe 0x1002a1b
jmp 0x1002a5b
call esi
mov ebx, eax
jmp 0x1002a5b
xor ebx, ebx
jmp 0x1002a5b
mov ebx, dword [ebp - 0x18]
mov esi, dword [entry0]
test edi, edi
je 0x1002a68
push edi
call esi
push dword [ebp - 8]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x1002de7
Capabilities:
Bypass uac via rpc

Disassembly:
push 0x68
push 0x10030b0
call fcn.010025d4
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x78], edi
push 0x40
push edi
lea eax, [ebp - 0x74]
push eax
call fcn.0100242c
add esp, 0xc
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x30], edi
xor esi, esi
mov dword [ebp - 0x2c], esi
cmp dword [0x1004390], edi
jne 0x1002e5c
lea eax, [ebp - 0x1c]
push eax
push edi
push 0x10012c0
call fcn.01002a7b
mov ebx, eax
cmp ebx, edi
jne 0x1002ef9
push edi
push dword [ebp - 0x1c]
push 0x1004390
call dword [0x1001038]
test eax, eax
je 0x1002e5c
lea eax, [ebp - 0x1c]
push eax
call dword [0x10010c8]
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x20]
push eax
push edi
call fcn.010028c4
mov ebx, eax
cmp ebx, edi
jne 0x1002ef9
or dword [ebp + 8], 0x10
cmp dword [ebp + 0xc], edi
je 0x1002e9d
push 2
push dword [ebp + 0xc]
call dword [0x10010d0]
mov dword [ebp - 0x30], eax
cmp eax, edi
je 0x1002e9d
push edi
push eax
call dword [0x10010d4]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov dword [ebp - 0x2c], esi
push 0x44
lea eax, [ebp - 0x78]
push eax
call fcn.01002b76
mov ebx, eax
cmp ebx, edi
jne 0x1002ef9
mov dword [ebp - 4], edi
push dword [ebp - 0x20]
push dword [ebp + 8]
push dword [0x1004390]
lea eax, [ebp - 0x78]
push eax
call fcn.01002f8b
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xfffffffe
jmp 0x1002ef9
cmp dword [ebp - 0x24], edi
je 0x1002f11
push ebx
push 0xffffffffffffffff
push 1
lea eax, [ebp - 0x78]
push eax
call fcn.01002d74
mov ebx, eax
mov dword [ebp - 0x24], edi
lea eax, [ebp - 0x78]
push eax
call fcn.01002bbd
cmp ebx, edi
je 0x1002f5f
cmp ebx, 0x6ba
je 0x1002f3e
cmp ebx, 0x6ac
je 0x1002f3e
cmp ebx, 0x6b5
je 0x1002f3e
cmp ebx, 0x6d9
jne 0x1002f5f
cmp dword [ebp - 0x28], 1
ja 0x1002f5a
inc dword [ebp - 0x28]
push 0xa
call fcn.010029ad
mov ebx, eax
cmp ebx, edi
je 0x1002e9d
jmp 0x1002ef9
mov ebx, 0x425
cmp esi, edi
je 0x1002f6e
push 1
push dword [ebp - 0x30]
call dword [0x10010d4]
cmp dword [ebp - 0x20], edi
je 0x1002f7c
push dword [ebp - 0x20]
call dword [0x100106c]
mov eax, ebx
call fcn.01002619
ret 8
Function at 0x11194
Capabilities:
Authenticate hmac

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x176d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, 0x16548
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp + 0x10]
push 6
pop ecx
mov esi, 0x1652e
lea edi, [ebp - 0x98]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x20]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xa8], eax
mov ax, word [ebx + 0x1c]
shr ax, 1
dec ax
movsw word es:[edi], word [esi]
movzx eax, ax
mov edx, 0xffff
movzx esi, ax
cmp word [ecx + esi*2], 0x5c
je 0x1120c
add eax, edx
jmp 0x111fe
cmp ax, dx
jne 0x1121b
mov eax, 0xc0000001
jmp 0x1136a
inc eax
movzx eax, ax
mov dword [ebp - 0x9c], eax
jmp 0x291d8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0001617d
leave
ret 0x10

Function at 0x11682
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push edi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
xor edi, edi
push 0xf003f
lea eax, [ebp + 8]
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, edi
jne 0x11724
push 0x74
push edi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x74
push esi
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, edi
jl 0x11724
push dword [esi + 8]
lea eax, [esi + 0xc]
push eax
push dword [ebp + 0x10]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
push edi
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x12008
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
xor eax, eax
push ebx
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
stosd dword es:[edi], eax
lea edi, [ebp - 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
cmp dword [ebp + 8], ebx
jne 0x12043
mov eax, 0xc0000001
jmp 0x12105
mov eax, dword [ebp + 0x14]
push ebx
push ebx
push 0x860
push 1
push 1
push 0x80
mov dword [ebp - 0x24], eax
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x80000000
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], 0x240
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
cmp eax, ebx
mov dword [ebp + 0x14], eax
jl 0x120f4
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi]
push esi
mov esi, dword [eax + 0x3c]
sub ecx, eax
add esi, eax
push ecx
push esi
call fcn.00011586
mov esi, dword [esi + 0x34]
cmp eax, ebx
je 0x120f3
push ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [edi + 8]
shl eax, 2
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, ebx
mov dword [ebp + 0x14], eax
jl 0x120f3
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [edi + 8], ebx
jbe 0x120f3
mov edx, dword [ebp + 0x10]
sub edx, esi
add dword [eax], edx
add eax, 4
inc ecx
cmp ecx, dword [edi + 8]
jb 0x120e3
pop esi
cmp dword [ebp - 4], ebx
je 0x12102
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp + 0x14]
pop edi
pop ebx
leave
ret 0x10
Function at 0x121b8
Capabilities:
Allocate or change rwx memory
Get file attributes
Map section object
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x18
pop ebx
mov dword [ebp - 0x48], eax
xor eax, eax
xor esi, esi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x44], 0x40
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
push 0x20
stosd dword es:[edi], eax
push 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x50]
push eax
push 0x100020
lea eax, [ebp - 8]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
push 5
push ebx
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
push dword [ebp - 8]
lea eax, [ebp - 0x50]
push 0x8000000
push 2
push esi
push eax
push 0xf001f
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x48], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateSection]
push 2
push 0x100000
push 2
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 0x60]
lea eax, [ebp - 4]
push esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ebx, dword [ebp - 4]
cmp ebx, esi
je 0x12334
mov edi, dword [ebx + 0x3c]
add edi, ebx
push dword [edi + 0x78]
mov dword [ebp - 0x10], ebx
push edi
call fcn.00011586
mov esi, eax
add esi, ebx
push dword [esi + 0x1c]
push edi
call fcn.00011586
push dword [esi + 0x20]
mov ebx, eax
add ebx, dword [ebp - 4]
push edi
call fcn.00011586
push dword [esi + 0x24]
add eax, dword [ebp - 4]
push edi
mov dword [ebp - 0x18], eax
call fcn.00011586
add eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitString]
and dword [ebp + 8], 0
cmp dword [esi + 0x14], 0
jbe 0x1232a
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
push dword [eax + ecx*4]
push edi
call fcn.00011586
add eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitString]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + ecx*2]
add eax, dword [ebp - 0x20]
push dword [ebx + eax*4 - 4]
push edi
call fcn.00011586
add eax, dword [ebp - 0x10]
push 1
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCompareString]
test eax, eax
je 0x1232e
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x14]
jb 0x122d1
xor esi, esi
jmp 0x12334
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + 1]
push dword [ebp - 4]
push 0xffffffffffffffff
call dword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
push dword [ebp - 0x14]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x12468
Capabilities:
Attach user process memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
cli
mov eax, cr0
and eax, 0xfffeffff
mov cr0, eax
mov eax, dword [0x178a8]
mov ecx, dword [eax]
cmp ecx, dword [0x17c58]
je 0x12497
mov ecx, 0x1238e
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
mov eax, dword [0x17b98]
mov ecx, dword [0x17c54]
cmp dword [ecx], eax
je 0x124a8
mov dword [ecx], eax
mov eax, dword [0x17b2c]
push ebx
push esi
push edi
push 4
mov edx, 0x17b50
pop ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
je 0x124ca
mov esi, edx
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [0x17da4]
push 4
mov edx, 0x178e4
pop ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
je 0x124e9
mov esi, edx
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [0x17c00]
push 4
mov edx, 0x17b10
pop ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
je 0x12508
mov esi, edx
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00012110
test eax, eax
je 0x12555
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov eax, dword [0x17da8]
mov ebx, dword [eax + 8]
mov eax, dword [eax]
mov edx, dword [0x17b74]
shl ebx, 2
mov esi, eax
mov dword [ebp - 4], eax
mov ecx, ebx
mov edi, edx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1254b
push ebx
push edx
push dword [ebp - 4]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, cr0
or eax, 0x10000
mov cr0, eax
sti
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret

Function at 0x125f0
Capabilities:
Attach user process memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
call fcn.00011fac
mov esi, eax
call fcn.00012110
test eax, eax
je 0x1265a
test esi, esi
je 0x1265a
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov ecx, dword [ebp + 8]
mov eax, dword [esi]
shl ecx, 2
mov eax, dword [ecx + eax]
cmp eax, dword [ebp + 0xc]
jne 0x12650
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
je 0x12650
cli
mov eax, cr0
and eax, 0xfffeffff
mov cr0, eax
mov eax, dword [edx]
mov edx, dword [esi]
add edx, ecx
xchg dword [edx], eax
mov eax, cr0
or eax, 0x10000
mov cr0, eax
sti
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
xor eax, eax
pop esi
leave
ret 0xc
Function at 0x13b58
Capabilities:
Attach user process memory

Disassembly:
push 0x5c
push 0x16d08
call fcn.00016214
push 5
call fcn.00011832
push 3
call fcn.00011832
mov dword [ebp - 0x30], eax
push 4
call fcn.00011832
mov dword [ebp - 0x40], eax
push 2
call fcn.00011832
mov dword [ebp - 0x34], eax
push 7
call fcn.00011832
mov dword [ebp - 0x2c], eax
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov esi, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 4], ebx
push 0x16730
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
cmp esi, ebx
je 0x13cc0
mov eax, dword [ebp - 0x2c]
mov edi, dword [esi + eax]
mov eax, dword [ebp - 0x30]
add eax, esi
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
cmp edi, 0xa
jbe 0x13caa
xor edi, edi
inc edi
push edi
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCompareString]
test eax, eax
jne 0x13caa
lea eax, [ebp - 0x6c]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x34]
mov eax, dword [esi + eax]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x1c], ebx
xor edi, edi
mov dword [ebp - 0x38], edi
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x3c], edx
movzx ebx, word [eax + 0x40]
cmp edx, ebx
jge 0x13c4b
mov ebx, dword [eax + 0x44]
cmp word [ebx + edx*2], 0x3f
jne 0x13c81
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jne 0x13c43
lea edi, [edx + 1]
mov dword [ebp - 0x38], edi
cmp dword [ebp - 0x1c], 4
jne 0x13c81
mov ecx, edx
xor ebx, ebx
cmp edi, ebx
je 0x13c7c
cmp ecx, ebx
je 0x13c7c
cmp edi, ecx
je 0x13c7c
sub ecx, edi
push ecx
push 0x17c70
mov eax, dword [eax + 0x44]
lea eax, [eax + edi*2]
push eax
call dword [sym.imp.ntoskrnl.exe_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x13c7c
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], ebx
jmp 0x13c96
inc edx
jmp 0x13c1f
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
cmp dword [ebp - 0x20], ebx
je 0x13caa
mov dword [ebp - 0x28], esi
jmp 0x13cc0
mov ecx, dword [ebp - 0x40]
lea eax, [esi + ecx]
mov esi, dword [eax]
sub esi, ecx
mov dword [ebp - 0x24], esi
cmp esi, dword [ebp - 0x44]
jne 0x13bbb
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x28]
jmp 0x13cdc
call fcn.00016259
ret
Function at 0x13ce8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
xor eax, eax
push esi
push edi
xor esi, esi
mov dword [ebp - 0x2c], esi
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], esi
stosd dword es:[edi], eax
lea edi, [ebp - 8]
mov dword [ebp - 0xc], esi
stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], esi
cmp edi, esi
jne 0x13d25
mov eax, 0xc0000001
jmp 0x13db9
mov eax, dword [ebp + 0x14]
push ebx
push esi
push esi
push 0x860
push 1
push 1
push 0x80
mov dword [ebp - 0x24], eax
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x80000000
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], 0x240
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
cmp ebx, esi
jl 0x13da8
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x3c]
sub edi, eax
push edi
add ecx, eax
push ecx
call fcn.00011586
cmp eax, esi
je 0x13da8
push esi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x10
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
mov dword [ebp - 8], esi
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
cmp dword [ebp - 4], esi
je 0x13db6
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0x10