joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
lea eax, [ebp - 0x30]
push eax
xor ebx, ebx
mov dword [ebp - 0x30], 0x44005c
mov dword [ebp - 0x2c], 0x690072
mov dword [ebp - 0x28], 0x650076
mov dword [ebp - 0x24], 0x5c0072
mov dword [ebp - 0x20], 0x610070
mov dword [ebp - 0x1c], 0x740072
mov dword [ebp - 0x18], 0x67006d
mov dword [ebp - 0x14], 0x72
call fcn.0008b990
cmp eax, ebx
je 0x611e2
mov ecx, dword [esi]
cmp ecx, 0x1b
ja 0x611e2
mov edx, dword [esi + 8]
lea eax, [eax + ecx*4 + 0x38]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], ebx
push eax
cli
mov eax, cr0
mov dword [ebp - 4], eax
and eax, 0xfffeffff
mov cr0, eax
push ebx
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
lock xchg dword [eax], ebx
mov dword [ebp - 8], ebx
pop ebx
mov eax, dword [ebp - 4]
mov cr0, eax
sti
pop eax
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x61310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, 0x730079
push ebx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
xor ebx, ebx
push ecx
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0x53005c
mov dword [ebp - 0x54], 0x650074
mov dword [ebp - 0x50], 0x52006d
mov dword [ebp - 0x4c], 0x6f006f
mov dword [ebp - 0x48], 0x5c0074
mov dword [ebp - 0x44], 0x790073
mov dword [ebp - 0x40], 0x740073
mov dword [ebp - 0x3c], 0x6d0065
mov dword [ebp - 0x38], 0x320033
mov dword [ebp - 0x34], 0x64005c
mov dword [ebp - 0x30], 0x690072
mov dword [ebp - 0x2c], 0x650076
mov dword [ebp - 0x28], 0x730072
mov dword [ebp - 0x24], 0x54005c
mov dword [ebp - 0x20], 0x700063
mov dword [ebp - 0x1c], 0x700069
mov dword [ebp - 0x18], 0x73002e
mov dword [ebp - 0x10], ebx
call fcn.0004d700
test eax, eax
jne 0x613e2
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push esi
mov esi, dword [ebp - 8]
push ebx
push edx
push eax
push ecx
push esi
call fcn.00014940
cmp al, 1
jne 0x613cf
mov bl, al
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x62630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
push edi
xor edi, edi
push 0x4904
mov dword [esp + 0x40], 0x53005c
mov dword [esp + 0x44], 0x730079
mov dword [esp + 0x48], 0x650074
mov dword [esp + 0x4c], 0x52006d
mov dword [esp + 0x50], 0x6f006f
mov dword [esp + 0x54], 0x5c0074
mov dword [esp + 0x58], edi
call fcn.00049640
push 0x492b
mov ecx, eax
call fcn.00049640
push 0x4a1b
mov esi, eax
call fcn.00049640
mov dword [esp + 0x10], eax
cmp ecx, edi
je 0x6276f
cmp esi, edi
je 0x6276f
cmp eax, edi
je 0x6276f
lea eax, [esp + 0x3c]
push eax
lea edx, [esp + 0x18]
push edx
call ecx
push edi
push edi
push 0x20
push 1
push 1
push 0x80
push edi
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x44]
lea eax, [esp + 0x34]
push edx
mov dword [esp + 0x50], eax
push 0x80000000
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x50], 0x18
mov dword [esp + 0x54], edi
mov dword [esp + 0x5c], 0x240
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
call esi
test eax, eax
js 0x6276f
call fcn.0008a110
mov ebx, eax
cmp ebx, edi
je 0x62766
mov esi, dword [ebx]
push 0x878
lea edx, [ebx + 4]
call fcn.00049640
xor ecx, ecx
cmp esi, edi
jbe 0x62754
mov edi, dword [esp + 0xc]
lea esp, [esp]
cmp word [edx + 6], di
jne 0x6273b
cmp word [edx], ax
je 0x62745
inc ecx
add edx, 0x10
cmp ecx, esi
jb 0x62730
jmp 0x62754
add ecx, ecx
movzx ecx, byte [ebx + ecx*8 + 8]
push ecx
push 0x60
call fcn.00049620
push 0x877
call fcn.00049640
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [esp + 0xc]
push edx
call dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x62780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
xor bl, bl
push 0x4907
mov byte [ebp - 1], bl
call fcn.00049640
mov dword [ebp - 0x18], eax
test eax, eax
je 0x62903
push 0x60
call fcn.00049640
mov dword [ebp - 8], eax
test eax, eax
jne 0x627c9
call fcn.00062630
push 0x60
call fcn.00049640
mov dword [ebp - 8], eax
test eax, eax
je 0x62903
cmp dword [ebp + 0xc], 0xc
jb 0x62903
mov ebx, dword [ebp + 8]
mov dword [ebx], 0
add ebx, 4
mov dword [ebp - 0x34], 0x44005c
mov dword [ebp - 0x30], 0x760065
mov dword [ebp - 0x2c], 0x630069
mov dword [ebp - 0x28], 0x5c0065
mov dword [ebp - 0x24], 0x610052
mov dword [ebp - 0x20], 0x490077
mov dword [ebp - 0x1c], 0x70
xor eax, eax
inc eax
xor ecx, ecx
cmp cx, word [ebp + eax*2 - 0x34]
jne 0x62812
push edi
lea edi, [eax + eax]
call fcn.0008a110
mov dword [ebp - 0x14], eax
test eax, eax
je 0x628f8
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
test ecx, ecx
je 0x628e3
push esi
lea esi, [eax + 0xc]
jmp 0x62850
movzx edx, byte [esi - 4]
cmp edx, dword [ebp - 8]
jne 0x628cf
mov eax, dword [esi]
test eax, eax
je 0x628cf
mov eax, dword [eax + 4]
test eax, eax
je 0x628cf
lea ecx, [ebp - 0x38]
push ecx
push 0x50
lea edx, [ebp - 0x88]
push edx
push eax
call dword [ebp - 0x18]
test eax, eax
jne 0x628cf
mov ecx, dword [ebp - 0x84]
lea eax, [ebp - 0x80]
cmp ecx, eax
jne 0x628cf
movzx edx, word [ebp - 0x88]
cmp edi, edx
jne 0x628cf
lea eax, [ebp - 0x34]
push eax
call fcn.0008f350
test eax, eax
jne 0x628cf
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, dword [esi]
mov dword [ebx + 4], edx
movzx edx, word [esi - 8]
mov dword [ebx], edx
inc dword [ecx]
mov ecx, 8
add ebx, ecx
test eax, eax
jne 0x628c3
sub dword [ebp + 0xc], 0xc
jmp 0x628c6
sub dword [ebp + 0xc], ecx
mov byte [ebp - 1], 1
cmp dword [ebp + 0xc], ecx
jb 0x628e2
mov eax, dword [ebp - 0xc]
inc eax
add esi, 0x10
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp - 0x10]
jb 0x62850
pop esi
push 0x877
call fcn.00049640
push eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, byte [ebp - 1]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x62a40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push 0x1a1
xor bl, bl
call fcn.00049640
mov dword [ebp - 0x10], eax
test eax, eax
je 0x62ba9
mov eax, 0x730079
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 0x53005c
mov dword [ebp - 0x5c], 0x650074
mov dword [ebp - 0x58], 0x52006d
mov dword [ebp - 0x54], 0x6f006f
mov dword [ebp - 0x50], 0x5c0074
mov dword [ebp - 0x4c], 0x790073
mov dword [ebp - 0x48], 0x740073
mov dword [ebp - 0x44], 0x6d0065
mov dword [ebp - 0x40], 0x320033
mov dword [ebp - 0x3c], 0x64005c
mov dword [ebp - 0x38], 0x690072
mov dword [ebp - 0x34], 0x650076
mov dword [ebp - 0x30], 0x730072
mov dword [ebp - 0x2c], 0x6e005c
mov dword [ebp - 0x28], 0x740065
mov dword [ebp - 0x24], 0x6f0069
mov dword [ebp - 0x20], 0x73002e
mov dword [ebp - 0x18], 0
call fcn.0004d700
test eax, eax
jne 0x62ba9
mov ecx, dword [ebp - 8]
push edi
push eax
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push ecx
push edx
call fcn.00014940
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp al, 1
jne 0x62b97
mov ecx, dword [ebp - 8]
push esi
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x64]
push eax
push ecx
xor edx, edx
mov eax, esi
mov bl, 1
mov dword [ebp - 0x64], 0x4569734e
mov dword [ebp - 0x60], 0x656d756e
mov dword [ebp - 0x5c], 0x65746172
mov dword [ebp - 0x58], 0x656a624f
mov dword [ebp - 0x54], 0x41737463
mov dword [ebp - 0x50], 0x61506c6c
mov dword [ebp - 0x4c], 0x656d6172
mov dword [ebp - 0x48], 0x73726574
mov dword [ebp - 0x44], 0x7845
call fcn.00015090
test eax, eax
je 0x62b88
add eax, dword [ebp - 0x10]
push eax
push 0x19a
call fcn.00049620
push 0x877
call fcn.00049640
push eax
push esi
call edi
pop esi
push 0x877
call fcn.00049640
push eax
mov eax, dword [ebp - 4]
push eax
call edi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x63700
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9cb00
push 0x9b56a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x1d], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
push 0x2b
call fcn.00049640
mov esi, eax
test esi, esi
je 0x638fc
lea ecx, [ebp - 0x28]
push ecx
push edx
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [ebp - 0x30], eax
mov edi, dword [ebp + 8]
test eax, eax
jne 0x63765
test edi, edi
jne 0x6376d
mov eax, dword [ebp - 0x28]
mov dword [ebp + 8], eax
mov edi, eax
test edi, edi
je 0x638ed
push 0
mov eax, edi
call fcn.00063350
cmp al, 1
jne 0x638ed
mov edx, edi
call fcn.0008a7b0
mov byte [ebp - 0x1e], al
push 0x19
call fcn.00088910
mov byte [ebp - 0x22], al
push 0xe
call fcn.00088910
mov byte [ebp - 0x2c], al
lea ecx, [ebp - 0x48]
push ecx
push edi
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov edx, dword [ebp - 0x2c]
push edx
push 0xe
call fcn.00088aa0
mov eax, dword [ebp - 0x22]
push eax
push 0x19
call fcn.00088aa0
mov dword [ebp - 4], 0
add esi, edi
push esi
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x63877
mov ecx, dword [esi]
mov edx, dword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
mov eax, dword [edx]
cmp ecx, eax
jae 0x63877
lea edx, [ecx + 0x30]
cmp edx, eax
jae 0x63877
mov ecx, dword [ecx + 0xc]
cmp ecx, eax
jae 0x63877
lea edx, [ecx + 0x28]
cmp edx, eax
jae 0x63877
mov ebx, dword [ecx + 0xc]
cmp ebx, eax
jae 0x63877
lea ecx, [ebx + 0x48]
cmp ecx, eax
jae 0x63877
movzx esi, word [ebx + 0x24]
cmp esi, 0x1000
jbe 0x63821
mov esi, 0x1000
jmp 0x63826
cmp esi, 2
jbe 0x63877
mov ecx, dword [ebx + 0x28]
cmp ecx, eax
jae 0x63877
test ecx, ecx
je 0x63877
lea edx, [esi + ecx]
cmp edx, eax
jae 0x63877
lea eax, [esi + 2]
push eax
mov ecx, 1
call fcn.0008b8a0
mov edi, eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edi
test edi, edi
je 0x63874
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x6385a
mov dword [eax], esi
push esi
mov edx, dword [ebx + 0x28]
push edx
push edi
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
shr esi, 1
xor eax, eax
mov word [edi + esi*2], ax
mov byte [ebp - 0x1d], 1
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
jmp 0x638ac
push 0x19
call fcn.00088910
mov byte [ebp - 0x22], al
push 0xf
call fcn.00088910
mov byte [ebp + 8], al
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov edx, dword [ebp + 8]
push edx
push 0xf
call fcn.00088aa0
mov eax, dword [ebp - 0x22]
push eax
push 0x19
call fcn.00088aa0
cmp byte [ebp - 0x1e], 1
jne 0x638ed
mov ecx, edi
call fcn.0008a870
cmp dword [ebp - 0x30], 0
jne 0x638fc
mov ecx, dword [ebp - 0x28]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x63920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push ebx
xor bl, bl
mov ecx, 0x5c
push esi
push edi
mov byte [ebp - 1], bl
cmp cx, word [eax]
jne 0x63ac1
mov edi, eax
lea ecx, [ebp - 0xc]
xor edx, edx
mov dword [ebp - 0xc], 0x3f005c
mov dword [ebp - 8], 0x5c003f
sub edi, ecx
jmp 0x63960
movzx esi, word [ebp + edx*2 - 0xc]
lea ecx, [edi + edx*2]
movzx ecx, word [ebp + ecx - 0xc]
cmp cx, si
ja 0x63981
jb 0x63981
test cx, cx
je 0x63989
inc edx
cmp edx, 4
jb 0x63960
jmp 0x63989
mov edx, esi
sub ecx, edx
test ecx, ecx
jne 0x639e1
movzx ecx, word [eax + 8]
lea esi, [eax + 8]
xor edx, edx
mov word [eax], cx
cmp dx, cx
je 0x639b2
mov ecx, eax
sub esi, eax
mov edi, edi
movzx edx, word [esi + ecx + 2]
add ecx, 2
xor edi, edi
mov word [ecx], dx
cmp di, dx
jne 0x639a0
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x639d6
xor esi, esi
xor ecx, ecx
cmp si, word [eax]
je 0x639d2
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, 2
xor esi, esi
inc ecx
cmp si, word [eax]
jne 0x639c7
add ecx, ecx
mov dword [edx], ecx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0xc
lea edx, [ebp - 0x28]
mov dword [ebp - 0x28], 0x53005c
mov dword [ebp - 0x24], 0x730079
mov dword [ebp - 0x20], 0x650074
mov dword [ebp - 0x1c], 0x52006d
mov dword [ebp - 0x18], 0x6f006f
mov dword [ebp - 0x14], 0x5c0074
mov dword [ebp - 0x10], 0
call fcn.0008efd0
test eax, eax
jne 0x63ac1
call fcn.00054d80
mov ebx, eax
test ebx, ebx
je 0x63ab5
mov ecx, ebx
call fcn.0008f1d0
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov edi, eax
call fcn.0008f1d0
lea ecx, [eax + edi]
cmp ecx, edi
jbe 0x63aa3
cmp ecx, eax
jbe 0x63aa3
lea eax, [ecx + ecx]
cmp eax, ecx
jbe 0x63aa3
push eax
mov ecx, 1
call fcn.0008b8a0
mov esi, eax
test esi, esi
je 0x63aa3
mov ecx, ebx
call fcn.0008f150
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
add ecx, 0x16
lea eax, [esi + edi*2]
call fcn.0008f150
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
push ecx
call fcn.0008b8c0
mov dword [edi], esi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x63a9f
mov ecx, esi
call fcn.0008f1d0
add eax, eax
mov dword [edi], eax
mov byte [ebp - 1], 1
push 0x877
call fcn.00049640
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x63ad0
Capabilities:
Find process by pid

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
xor cl, cl
push 0x29
mov byte [esp + 0x16], cl
call fcn.00049640
mov edi, eax
test edi, edi
je 0x63bc6
mov ecx, dword [ebp + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x1c], 0
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp dword [ebp + 8], 0
mov dword [esp + 0x1c], eax
jne 0x63b1b
mov edx, dword [esp + 0x14]
mov dword [ebp + 8], edx
push 0x4a
call fcn.00049640
lea esi, [eax - 1]
mov eax, dword [ebp + 8]
test eax, eax
je 0x63b86
mov ebx, dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
push eax
call ebx
cmp al, 1
jne 0x63b86
add esi, dword [ebp + 8]
push esi
call ebx
cmp al, 1
jne 0x63b86
push 0x26
call fcn.00049640
cmp eax, 1
je 0x63b6e
mov ecx, dword [ebp + 8]
mov eax, dword [edi + ecx]
test eax, eax
je 0x63b86
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov ecx, edi
mov edx, esi
call fcn.0008c410
mov byte [esp + 0x12], al
jmp 0x63b8c
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edi, dword [edi + esi]
push edx
push eax
push edi
call fcn.0008c440
mov byte [esp + 0x12], al
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
cmp dword [esp + 0x1c], 0
jl 0x63b9d
mov ecx, dword [esp + 0x14]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov cl, byte [esp + 0x12]
cmp byte [ebp + 0x18], 0
jne 0x63c86
mov byte [esp + 0x13], 0
test cl, cl
je 0x63c2b
cmp cl, 1
jne 0x63c86
test edi, edi
je 0x63bce
cmp dword [edi], 6
jmp 0x63bee
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
jmp 0x63ba1
mov edx, dword [esi]
xor eax, eax
xor ecx, ecx
cmp ax, word [edx]
je 0x63bf0
mov eax, edx
jmp 0x63be0
add eax, 2
xor edx, edx
inc ecx
cmp dx, word [eax]
jne 0x63be0
cmp ecx, 3
ja 0x63bf5
mov byte [esp + 0x13], 1
mov edx, dword [esi]
movzx ecx, word [edx]
mov ebx, 0x2e
xor eax, eax
cmp bx, cx
je 0x63c1d
xor ebx, ebx
cmp bx, cx
je 0x63c2b
movzx ecx, word [edx + eax*2 + 2]
inc eax
mov ebx, 0x2e
cmp bx, cx
jne 0x63c06
lea eax, [edx + eax*2]
test eax, eax
je 0x63c2b
cmp byte [esp + 0x13], 1
jne 0x63ca9
mov edx, dword [ebp + 8]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
mov edx, dword [ebp + 0xc]
call fcn.00063700
cmp al, 1
jne 0x63c82
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00063920
cmp byte [esp + 0x12], 1
jne 0x63c67
mov eax, dword [esi]
test eax, eax
je 0x63c67
push eax
call fcn.0008b8c0
mov edx, dword [esp + 0x18]
mov dword [esi], edx
test edi, edi
je 0x63c77
mov eax, dword [esp + 0x1c]
mov dword [edi], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov cl, byte [esp + 0x12]
test cl, cl
jne 0x63c9e
mov ecx, dword [ebp + 0xc]
push edi
push esi
push ecx
call fcn.0008c550
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov al, cl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov al, byte [esp + 0x12]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x65740
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9cce0
push 0x9b56a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov byte [ebp - 0x19], 0
cmp ebx, 0x1000
jbe 0x65941
mov eax, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
cmp ebx, dword [eax]
jae 0x65941
push 0x877
call fcn.00049640
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
mov dword [ebp - 0x2c], esi
test esi, esi
je 0x65941
mov ecx, dword [ebp + 0x10]
mov edi, dword [ecx]
test edi, edi
je 0x657cb
lea eax, [edi - 1]
imul eax, eax, 0x210
add eax, 0x214
push eax
push ecx
push esi
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov dword [ebp - 0x30], esi
mov dword [esi], edi
push 0
mov edi, dword [ebp + 8]
mov eax, edi
call fcn.00063350
cmp al, 1
jne 0x6590c
mov edx, edi
call fcn.0008a7b0
mov byte [ebp - 0x1a], al
push 0x19
call fcn.00088910
mov byte [ebp - 0x24], al
push 0xe
call fcn.00088910
mov byte [ebp - 0x28], al
lea edx, [ebp - 0x48]
push edx
push edi
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov eax, dword [ebp - 0x28]
push eax
push 0xe
call fcn.00088aa0
mov ecx, dword [ebp - 0x24]
push ecx
push 0x19
call fcn.00088aa0
mov dword [ebp - 4], 0
cmp byte [ebp + 0xc], 0
jne 0x6586b
mov edx, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [edx]
cmp ebx, eax
jae 0x658a8
lea ecx, [ebx + 0x100]
cmp ecx, eax
jae 0x658a8
xor edi, edi
mov dword [ebp - 0x20], edi
cmp edi, 0x20
jae 0x658a5
lea eax, [ebx + edi*8]
push 1
mov edx, dword [ebp + 0x14]
push edx
push esi
push 0
push 0x3c
push eax
call fcn.00065190
mov byte [ebp - 0x19], 1
inc edi
jmp 0x65848
mov eax, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [eax]
cmp ebx, eax
jae 0x658a8
lea ecx, [ebx + 0x100]
cmp ecx, eax
jae 0x658a8
xor edi, edi
mov dword [ebp - 0x20], edi
cmp edi, 0x20
jae 0x658a5
lea eax, [ebx + edi*8]
push 1
mov edx, dword [ebp + 0x14]
push edx
push esi
push 1
push 0x3c
push eax
call fcn.00065190
mov byte [ebp - 0x19], 1
inc edi
jmp 0x65882
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
jmp 0x658cb
push 0x19
call fcn.00088910
mov byte [ebp - 0x24], al
push 0xf
call fcn.00088910
mov byte [ebp + 0xc], al
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov ecx, dword [ebp + 0xc]
push ecx
push 0xf
call fcn.00088aa0
mov edx, dword [ebp - 0x24]
push edx
push 0x19
call fcn.00088aa0
cmp byte [ebp - 0x1a], 1
jne 0x6590c
mov ecx, edi
call fcn.0008a870
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
test eax, eax
je 0x6592f
dec eax
imul eax, eax, 0x210
add eax, 0x214
push eax
push esi
mov ecx, dword [ebp + 0x10]
push ecx
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x67800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov ecx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov eax, 0x657865
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov eax, 0x1db0
push edi
xor edi, edi
cmp ax, word [ecx]
mov eax, 0x72616553
mov dword [ebp - 0xc], 0x68637673
mov dword [ebp - 8], 0x2e74736f
mov dword [ebp - 0x18], 0x65646973
mov dword [ebp - 0x14], 0x2e726162
mov dword [ebp - 0x58], 0x6c707865
mov dword [ebp - 0x54], 0x7265726f
mov dword [ebp - 0x50], 0x6578652e
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x24], 0x6e496863
mov dword [ebp - 0x20], 0x65786564
mov dword [ebp - 0x34], 0x72506863
mov dword [ebp - 0x30], 0x636f746f
mov dword [ebp - 0x44], 0x69466863
mov dword [ebp - 0x40], 0x7265746c
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], eax
jb 0x678a7
mov dword [ebp - 0x1c], 0x652e72
mov dword [ebp - 0x2c], 0x486c6f
mov dword [ebp - 0x3c], 0x736f48
jmp 0x678bc
mov dword [ebp - 0x1c], 0x2e72
mov dword [ebp - 0x2c], 0x6c6f
mov dword [ebp - 0x3c], 0x6f48
push 0x30
call fcn.00049640
cmp eax, edi
je 0x67957
push esi
lea esi, [eax + edx]
mov eax, esi
lea ecx, [ebp - 0xc]
call fcn.0008f280
test eax, eax
jne 0x678e8
pop esi
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
mov eax, esi
lea ecx, [ebp - 0x58]
call fcn.0008f280
test eax, eax
jne 0x67901
pop esi
mov eax, 4
pop edi
mov esp, ebp
pop ebp
ret
mov eax, esi
lea ecx, [ebp - 0x18]
call fcn.0008f280
test eax, eax
jne 0x6791a
pop esi
mov eax, 3
pop edi
mov esp, ebp
pop ebp
ret
mov eax, esi
lea ecx, [ebp - 0x28]
call fcn.0008f280
test eax, eax
je 0x67944
mov eax, esi
lea ecx, [ebp - 0x38]
call fcn.0008f280
test eax, eax
je 0x67944
mov eax, esi
lea ecx, [ebp - 0x48]
call fcn.0008f280
test eax, eax
jne 0x6794f
pop esi
mov eax, 2
pop edi
mov esp, ebp
pop ebp
ret
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret