joyce8/EMBER2024-capa huggingface dataset:
Function at 0x17506
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x248d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x4000
push esi
call fcn.00015ae6
mov edi, eax
test edi, edi
jne 0x17557
mov eax, dword [0x24a0c]
test eax, eax
jne 0x176e6
mov eax, dword [0x24a08]
and eax, 3
mov eax, dword [eax*4 + 0x2055c]
mov byte [0x24a10], 1
jmp 0x176e6
push 0x11
push 2
push 2
call fcn.000109a4
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x175a8
push edi
call fcn.00015b00
mov eax, dword [0x24a0c]
test eax, eax
je 0x17583
mov esi, eax
jmp 0x176e4
mov eax, dword [0x24a08]
and eax, 3
mov esi, dword [eax*4 + 0x2055c]
push 0x1f19a
mov byte [0x24a10], 1
call sub.ntoskrnl.exe_DbgPrint
jmp 0x176e3
push esi
push 0
push edi
call sub.ntoskrnl.exe_memset
add esp, 0xc
push ebx
push edi
call fcn.00017398
push 2
mov dword [ebp - 0x20], eax
pop eax
push 0x35
mov word [ebp - 0x14], ax
call fcn.000109fe
pop ecx
mov word [ebp - 0x12], ax
call fcn.000172ae
push 0x10
pop ebx
push ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x20]
push edi
push dword [ebp - 0x18]
call fcn.00010904
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
jge 0x1763f
push edi
call fcn.00015b00
push dword [ebp - 0x18]
call fcn.00010542
cmp dword [ebp - 0x1c], 0xc0000022
mov eax, dword [0x24a0c]
pop ecx
jne 0x17534
test eax, eax
jne 0x17634
mov eax, dword [0x24a08]
and eax, 3
mov eax, dword [eax*4 + 0x2055c]
mov byte [0x24a10], 1
inc dword [0x24a08]
jmp 0x176e6
push esi
push 0
push edi
mov dword [ebp - 0x1c], ebx
call sub.ntoskrnl.exe_memset
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push edi
push dword [ebp - 0x18]
call fcn.0001082a
mov esi, eax
add esp, 0x24
test esi, esi
jge 0x176ab
push edi
call fcn.00015b00
push dword [ebp - 0x18]
call fcn.00010542
mov eax, dword [0x24a0c]
pop ecx
test eax, eax
je 0x17684
mov edi, eax
jmp 0x176a7
mov eax, dword [0x24a08]
and eax, 3
mov edi, dword [eax*4 + 0x2055c]
push esi
push 0x1f178
mov byte [0x24a10], 1
call sub.ntoskrnl.exe_DbgPrint
pop ecx
pop ecx
mov eax, edi
jmp 0x176e6
push esi
push edi
call fcn.0001746e
mov esi, eax
test esi, esi
jne 0x176db
mov eax, dword [0x24a0c]
test eax, eax
je 0x176c5
mov esi, eax
jmp 0x176db
mov eax, dword [0x24a08]
and eax, 3
mov esi, dword [eax*4 + 0x2055c]
mov byte [0x24a10], 1
push dword [ebp - 0x18]
call fcn.00010542
pop ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0001d7e6
leave
ret 4
Function at 0x19ae0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
and dword [ebp - 4], 0
push ebx
xor ebx, ebx
inc ebx
cmp byte [0x24e34], bl
je 0x19aff
xor eax, eax
jmp 0x19c84
call fcn.00019a06
test eax, eax
je 0x19b0d
call fcn.000197d6
push esi
mov esi, 0x400
push esi
call fcn.00015ae6
xor ecx, ecx
mov word [ebp - 0x1c], cx
mov ecx, esi
mov dword [ebp - 0x18], eax
mov word [ebp - 0x1a], cx
test eax, eax
je 0x19c83
push edi
push esi
push 0
push eax
call sub.ntoskrnl.exe_memset
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add esp, 0xc
push 0x21100
lea eax, [ebp - 0x24]
push eax
call esi
mov eax, dword [0x20bf0]
push dword [eax*4 + 0x20be4]
lea eax, [ebp - 0x2c]
push eax
call esi
mov edi, dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
call edi
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x19c77
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
xor edi, edi
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x44]
push eax
push 0xf003f
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x44], 0x18
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x38], 0x200
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], edi
je 0x19c77
push 0x1f442
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 8], ebx
call esi
push 4
lea eax, [ebp - 8]
push eax
push 4
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call edi
push 0x1ecfa
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 8], ebx
call esi
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call edi
mov dword [ebp - 0xc], eax
push 0x1f438
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 8], ebx
call esi
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call edi
push 0x1f42c
lea eax, [ebp - 0x14]
push eax
call esi
mov ecx, 0x1f404
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x19c4a
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push ebx
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
and dword [ebp - 4], 0
push dword [ebp - 0x18]
call fcn.00015b00
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1a65c
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
mov edi, 0x40000
push edi
call fcn.00015ae6
xor esi, esi
mov dword [0x24a18], eax
cmp eax, esi
je 0x1a768
push edi
push esi
push eax
call sub.ntoskrnl.exe_memset
mov eax, dword [0x24a20]
add esp, 0xc
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 0x24], 0x26ed8
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov edi, dword [eax + 0x28]
push eax
call dword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov dword [edi + 8], eax
cmp eax, esi
jne 0x1a6c5
mov eax, dword [edi + 4]
mov dword [edi + 8], eax
push dword [edi + 8]
lea eax, [ebp - 0x14]
push 0x800
push esi
push esi
push esi
push esi
push 0x60
push 1
push 1
push 0x80
push esi
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x80000000
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
test eax, eax
jge 0x1a70b
push dword [0x24a18]
call fcn.00015b00
mov dword [0x24a18], esi
jmp 0x1a768
push 5
push 0x18
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jl 0x1a6f8
mov edi, dword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
push esi
push 1
push dword [ebp - 4]
call edi
mov eax, dword [ebp - 0x3c]
push esi
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [0x24a18]
mov dword [0x24a1c], eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
jl 0x1a6f8
push esi
push 1
push dword [ebp - 4]
call edi
pop edi
pop esi
leave
ret
Function at 0x1a772
Capabilities:
Get file attributes
Set file attributes
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x24a20]
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp eax, esi
je 0x1a88b
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [eax + 0x28]
push eax
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], 0x240
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov dword [edi + 8], eax
cmp eax, esi
jne 0x1a7c2
mov eax, dword [edi + 4]
mov dword [edi + 8], eax
push dword [edi + 8]
lea eax, [ebp - 0xc]
push 0x800
push esi
push esi
push esi
push esi
push 0x60
push 5
push 3
push 6
push esi
push eax
lea eax, [ebp - 0x24]
push eax
push 0xc0000000
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
mov edi, eax
cmp edi, esi
jl 0x1a886
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
push esi
push 1
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.0001949a
push 4
push 0x28
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp dword [ebp - 0xc], esi
jl 0x1a87d
mov eax, 0xfa2b0929
push 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], eax
push 0x28
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xc]
mov ecx, 0x1c95a06
push eax
push dword [ebp - 4]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x40], ecx
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
pop edi
jmp 0x1a890
mov eax, 0xc000000e
pop esi
leave
ret 0x10
Function at 0x1a89a
Capabilities:
Get file attributes
Set file attributes
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x24a20]
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp eax, esi
je 0x1a9b6
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [eax + 0x28]
push eax
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], 0x240
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov dword [edi + 8], eax
cmp eax, esi
jne 0x1a8ea
mov eax, dword [edi + 4]
mov dword [edi + 8], eax
push dword [edi + 8]
lea eax, [ebp - 0xc]
push 0x800
push esi
push esi
push esi
push esi
push 0x62
push 5
push 3
push 0x80
push esi
push eax
lea eax, [ebp - 0x24]
push eax
push 0xc0000000
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
mov edi, eax
cmp edi, esi
jl 0x1a9b1
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
push esi
push 1
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.0001949a
push 4
push 0x28
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp dword [ebp - 0xc], esi
jl 0x1a9a8
mov eax, 0xfa2b0929
push 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], eax
push 0x28
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xc]
mov ecx, 0x1c95a06
push eax
push dword [ebp - 4]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x40], ecx
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
pop edi
jmp 0x1a9bb
mov eax, 0xc000000e
pop esi
leave
ret 0x10
Function at 0x1bbba
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x2c]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov eax, dword [0x24a20]
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x1bc99
mov edi, dword [ebp + 8]
push esi
mov esi, dword [eax + 0x28]
push 0x26f00
push 0x200
lea eax, [ebp - 0xc]
push eax
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.0001a89a
push dword [0x24a20]
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], 0x240
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov dword [esi + 8], eax
cmp eax, ebx
jne 0x1bc3b
mov eax, dword [esi + 4]
mov dword [esi + 8], eax
push dword [esi + 8]
lea eax, [ebp - 0x14]
push 0x800
push ebx
push ebx
push ebx
push ebx
push 0x62
push 1
push 7
push 0x80
push ebx
push eax
lea eax, [ebp - 0x2c]
push eax
push 0xc0010000
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
mov esi, eax
cmp esi, ebx
jl 0x1bc94
push 0xd
push 1
lea eax, [ebp + 0xb]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
mov byte [ebp + 0xb], 1
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
pop esi
jmp 0x1bc9e
mov eax, 0xc000000e
pop edi
pop ebx
leave
ret 4
Function at 0x1c84c
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
call fcn.0001bafe
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
call fcn.00018d84
push edi
call fcn.00019522
xor ebx, ebx
cmp dword [ebp - 4], ebx
je 0x1ca02
push edi
call fcn.0001a180
test eax, eax
jl 0x1ca02
cmp byte [0x24e34], bl
je 0x1c899
push 1
call fcn.000196bc
push eax
call fcn.0001a3de
push esi
call fcn.0001b7fc
push 0x70
call fcn.00015ae6
mov esi, eax
cmp esi, ebx
je 0x1c958
push 0x70
push ebx
push esi
call sub.ntoskrnl.exe_memset
mov dword [esi], 0x70
mov dword [esi + 4], 0x1bd44
mov dword [esi + 8], 0x1bdb6
mov dword [esi + 0xc], 0x1be28
mov dword [esi + 0x10], 0x1be9a
mov dword [esi + 0x14], 0x1bf04
mov dword [esi + 0x18], 0x1bf6e
mov dword [esi + 0x1c], 0x1bfe4
mov dword [esi + 0x20], 0x1c054
mov dword [esi + 0x24], 0x1c0be
mov dword [esi + 0x28], 0x1c128
mov dword [esi + 0x34], 0x1b74a
mov dword [esi + 0x38], 0x1c1ca
mov dword [esi + 0x40], 0x1c234
mov dword [esi + 0x44], 0x1c2a4
mov dword [esi + 0x48], 0x1c308
mov dword [esi + 0x4c], 0x1c378
mov dword [esi + 0x50], 0x1c3de
mov dword [esi + 0x54], 0x1c456
mov dword [esi + 0x58], 0x1c4ce
mov dword [esi + 0x5c], 0x1c532
mov dword [esi + 0x60], 0x1c598
add esp, 0xc
mov dword [edi + 0x28], esi
mov eax, dword [ebp - 4]
push 0x24a20
push ebx
push ebx
push dword [eax + 0x2c]
push ebx
push 0xc
push edi
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jl 0x1ca01
mov eax, dword [0x24a20]
mov esi, dword [eax + 0x28]
lea eax, [esi + 4]
push eax
push dword [ebp - 4]
mov dword [esi], edi
mov dword [esi + 8], ebx
mov dword [eax], ebx
push dword [0x24a20]
call dword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStackSafe]
push dword [0x24a20]
test eax, eax
jge 0x1c9b1
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov dword [0x24a20], ebx
jmp 0x1ca01
call dword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov dword [esi + 8], eax
cmp eax, ebx
je 0x1c9fc
call fcn.0001a65c
cmp byte [0x24e34], bl
je 0x1c9f2
push 0x27100
push 0x26ed8
call fcn.00019c8c
test eax, eax
jl 0x1c9e5
call fcn.0001c60e
jmp 0x1c9f2
push 4
call fcn.000196bc
mov byte [0x24e34], bl
call fcn.0001b05c
call fcn.0001b576
call fcn.0001b7fc
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x1cb72
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push edi
xor edi, edi
cmp byte [0x24e34], 0
mov dword [ebp - 8], edi
jne 0x1cc84
lea eax, [ebp - 4]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x28]
push eax
push 0xf003f
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x28], 0x18
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], 0x200
mov dword [ebp - 0x20], 0x27548
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp dword [ebp - 8], edi
je 0x1cc84
push ebx
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor ebx, ebx
push 0x1f442
lea eax, [ebp - 0x10]
inc ebx
push eax
mov dword [ebp - 4], ebx
call esi
push 4
lea eax, [ebp - 4]
push eax
push 4
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call edi
push 0x1ecfa
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], ebx
call esi
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call edi
push 0x1f438
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], ebx
call esi
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call edi
push 0x1f42c
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], ebx
call esi
mov ecx, 0x1f404
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1cc59
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push ebx
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
call edi
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop esi
pop ebx
pop edi
leave
ret

Function at 0x1ce0a
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
call fcn.0001cb12
mov eax, dword [ebp + 0xc]
mov dword [0x20c54], eax
mov eax, dword [ebp + 0x10]
push 1
mov esi, 0x26e80
push esi
mov dword [0x20c58], eax
mov dword [0x24e38], ebx
mov byte [0x24e3c], bl
call dword [sym.imp.ntoskrnl.exe_KeInitializeTimerEx]
push ebx
push 0x15f90
or ecx, 0xffffffff
push ecx
mov eax, 0xca5b1700
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_KeSetTimerEx]
push ebx
push 0x1ca0e
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
mov esi, 0x1f03ff
push esi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0x200
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
cmp eax, ebx
jl 0x1ceb8
push ebx
push 0x24e38
push ebx
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1d13a
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
xor esi, esi
push esi
push 1
mov dword [ebp - 4], esi
push 0x26e6c
mov dword [0x26e60], 1
mov dword [0x26e64], esi
mov dword [0x26e68], esi
call edi
push esi
push 1
push 0x26eb0
call edi
push esi
push 0x1cec4
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
mov edi, 0x1f03ff
push edi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0x200
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
cmp eax, esi
jl 0x1d1d2
push esi
push 0x26ec0
push esi
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x27d3e
Capabilities:
Check os version
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.00027d05
pop ebp
jmp fcn.000125bc
Function at 0x5ad100
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
push ebx
xor eax, 0xafc7df5d
mov dword [ebp - 0x1c], 0xaa7575b3
mov dword [ebp - 0x18], 0xf0a59521
mov dword [ebp - 0x14], 0x315b1289
mov dword [ebp - 0x10], 0x5985ddca
push esi
push edi
cmp eax, 0xafc7df5c
jne 0x5ad31f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
mov eax, dword [eax + edx + 0xc0]
mov ecx, eax
xor ecx, 0xda1a4fff
lea esi, [eax + edx]
xor eax, eax
cmp ecx, 0xda1a4fff
cmove esi, eax
mov eax, esi
xor eax, 0x8353730
cmp eax, 0x8353730
je 0x5ad31f
mov ebx, dword [esi + 0xc]
lea eax, [ebp - 0x1c]
push 0
push 0xf67b7b8d
push eax
lea edx, [esi + 0x340]
mov dword [ebp - 0xc], ebx
lea ecx, [esi + 0xd8]
call section..gcode
mov eax, dword [ebx + 4]
add esp, 0xc
xor eax, 0x28ceb54b
cmp eax, 0x28ceb54b
je 0x5ad31f
mov eax, dword fs:[0x18]
xor edx, edx
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 8]
mov eax, dword fs:[0x18]
lea edi, [ebx + 0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x3c]
movzx eax, word [ecx + ebx + 0x14]
add eax, ecx
add edi, eax
movzx eax, word [ecx + ebx + 6]
xor ecx, ecx
mov dword [ebp - 8], edi
mov dword [ebp + 0xc], eax
cmp cx, ax
jae 0x5ad31f
nop dword [eax]
movzx eax, dx
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0xc]
lea edi, [edi + eax*8]
lea eax, [ecx + ebx]
cmp eax, entry1
ja 0x5ad215
mov eax, dword [edi + 0x10]
add eax, ecx
add eax, ebx
cmp eax, entry1
ja 0x5ad225
inc edx
cmp dx, word [ebp + 0xc]
jae 0x5ad31f
mov edi, dword [ebp - 8]
jmp 0x5ad1f0
mov eax, edi
xor eax, 0xacf25e9f
cmp eax, 0xacf25e9f
je 0x5ad31f
mov eax, dword fs:[0x18]
mov ecx, dword [edi + 0xc]
mov edi, dword [edi + 0x10]
add edi, ecx
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
add edi, edx
lea eax, [ecx + edx]
cmp eax, edi
jae 0x5ad31f
mov ebx, dword [esi + 0x318]
nop
mov edx, dword [eax + 4]
mov ecx, ebx
xor ecx, dword [eax]
xor edx, dword [esi + 0x31c]
xor ecx, 0x45ecc763
xor edx, 0
cmp ecx, 0x45ecc763
jne 0x5ad2f7
test edx, edx
jne 0x5ad2f7
mov ecx, dword [esi + 0x320]
xor ecx, dword [eax + 8]
mov edx, dword [esi + 0x324]
xor ecx, 0xc3464624
xor edx, dword [eax + 0xc]
xor edx, 0
cmp ecx, 0xc3464624
jne 0x5ad2f7
test edx, edx
jne 0x5ad2f7
mov ecx, dword [esi + 0x328]
xor ecx, dword [eax + 0x10]
mov edx, dword [esi + 0x32c]
xor ecx, 0x5ce40551
xor edx, dword [eax + 0x14]
xor edx, 0
cmp ecx, 0x5ce40551
jne 0x5ad2f7
test edx, edx
jne 0x5ad2f7
mov ecx, dword [esi + 0x330]
xor ecx, dword [eax + 0x18]
mov edx, dword [esi + 0x334]
xor ecx, 0x15070819
xor edx, dword [eax + 0x1c]
xor edx, 0
cmp ecx, 0x15070819
jne 0x5ad2f7
test edx, edx
je 0x5ad309
inc eax
cmp eax, edi
jb 0x5ad260
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, eax
xor ecx, 0x1da49e93
cmp ecx, 0x1da49e93
je 0x5ad31f
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x4dca07b4
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x37132137
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x100040b0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
stosb byte es:[edi], al
imul esi, dword [0xcef64cfd], 0xef03708b
out dx, eax
mov esi, dword [eax + 3]
out dx, eax
xor dword [edi - 0x32], ebx
sal dword [edx], 0xa
jl 0x100040a4
mov edx, 0x366b6fb2
mov dword [0xf5e9b8d5], eax
mov dl, 0x88
dec ebp
sub eax, 0xc20c9cb6
mov byte [ebp + 0x2d], cl
mov dh, 0x9c
or al, 0xc2
push ebp
jne 0x10004113
mov ebx, 0x6a6fb915
popal
outsd dx, dword [esi]
push 0x61
mov ecx, 0x1871bd82
dec ebx
mov byte [0x3f95ab12], al
pop edx
and dword [ecx - 0x42], 0x2e8bdf01
sub eax, 0x882d7c6c
mov dword [ecx + 0x7d42e215], esp
lodsb al, byte [esi]
js 0x1000412c
imul edx, dword [ebp + 0x64], 0xfffffffb
xchg esi, eax
invalid
invalid