joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11787780
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.116e1db0
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
test ebx, ebx
push edi
jle 0x117878d4
cmp ebx, 0x80
jg 0x117878d4
mov edi, dword [esp + 0x44]
mov eax, edi
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x14], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x40]
push eax
push edi
push edi
mov dword [esp + 0x28], edx
call fcn.11788090
lea eax, [ebx + 7]
add esp, 0xc
cdq
and edx, 7
add eax, edx
mov ebp, eax
mov eax, dword [esp + 0x48]
sar ebp, 3
test eax, eax
je 0x11787817
test ebp, ebp
jle 0x11787865
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
lea esi, [esp + 0x20]
sub edx, edi
sub esi, edi
mov ecx, edi
sub ebx, edi
mov al, byte [edx + ecx]
xor al, byte [ecx]
inc ecx
dec ebp
mov byte [esi + ecx - 1], al
mov byte [ebx + ecx - 1], al
jne 0x11787804
jmp 0x11787861
xor esi, esi
test ebp, ebp
jle 0x11787865
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x20]
mov ebx, edi
lea edx, [esp + 0x20]
sub eax, ecx
mov ecx, dword [esp + 0x38]
sub ebx, edx
lea edx, [esp + 0x20]
sub ecx, edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
jmp 0x11787847
mov ebx, dword [esp + 0x34]
lea ecx, [esp + esi + 0x20]
mov dl, byte [eax + ecx]
mov bl, byte [ebx + ecx]
mov byte [ecx], dl
xor bl, dl
mov edx, dword [esp + 0x38]
inc esi
cmp esi, ebp
mov byte [edx + ecx], bl
jl 0x11787843
mov ebx, dword [esp + 0x3c]
mov ebp, ebx
and ebp, 0x80000007
jns 0x11787874
dec ebp
or ebp, 0xfffffff8
inc ebp
mov eax, ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
test ebp, ebp
jne 0x117878a5
lea eax, [esp + eax + 0x10]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ecx, dword [eax + 8]
mov dword [edi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ecx, 8
xor esi, esi
sub ecx, ebp
lea eax, [esp + eax + 0x10]
mov dword [esp + 0x3c], ecx
jmp 0x117878bc
mov ecx, dword [esp + 0x3c]
mov dl, byte [eax + esi + 1]
mov bl, byte [eax + esi]
shr dl, cl
mov ecx, ebp
shl bl, cl
or dl, bl
mov byte [esi + edi], dl
inc esi
cmp esi, 0x10
jl 0x117878b8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x10e24
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp byte [section..data], 0
mov dword [ebp - 4], esi
jne 0x10e42
xor eax, eax
jmp 0x10f91
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0xb
mov byte [section..data], 0
call edi
cmp eax, 0xc0000004
je 0x10e78
mov eax, 0xc00000e5
push 0x15b7c
push eax
mov edi, eax
call fcn.00011a58
jmp 0x10f8e
push ebx
push dword [ebp - 4]
push 1
call fcn.00011b7a
mov ebx, eax
cmp ebx, esi
je 0x10ebd
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push 0xb
call edi
test eax, eax
jge 0x10ea5
mov eax, 0xc00000e5
push 0x15b7c
jmp 0x10ec7
mov eax, dword [ebx]
imul eax, eax, 0x110
push eax
push esi
call fcn.00011b7a
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, esi
jne 0x10ee2
mov eax, 0xc0000017
push 0x15b46
push eax
mov edi, eax
call fcn.00011a58
cmp ebx, esi
je 0x10f8d
push ebx
call fcn.00011bbc
jmp 0x10f8d
mov dword [ebp - 8], esi
cmp dword [ebx], esi
jbe 0x10f3e
lea edx, [edi + 8]
lea eax, [ebx + 0x10]
mov ecx, dword [eax - 4]
mov dword [edx - 4], ecx
mov ecx, dword [eax]
mov dword [edx], ecx
movsx ecx, word [eax + 0xe]
lea ecx, [ecx + eax + 0x10]
mov dword [edx + 0x104], ecx
push 0x40
lea esi, [eax + 0x10]
lea edi, [edx + 4]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 8]
inc ecx
cmp ecx, dword [ebx]
jae 0x10f25
lea esi, [edx + 0x108]
mov dword [edx - 8], esi
jmp 0x10f29
and dword [edx - 8], 0
add eax, 0x11c
add edx, 0x110
mov dword [ebp - 8], ecx
cmp ecx, dword [ebx]
jb 0x10eef
mov edi, dword [ebp - 0xc]
mov esi, 0x2bae8
push esi
call fcn.00011a9e
mov eax, dword [0x2abdc]
test eax, eax
je 0x10f58
push eax
call fcn.00011bbc
mov eax, dword [0x2abd4]
test eax, eax
je 0x10f67
push eax
call fcn.00011bbc
mov eax, dword [ebx]
push esi
mov dword [0x2abdc], ebx
mov dword [0x2abd4], edi
mov dword [0x2abd8], eax
call fcn.00011abc
push 0x15924
xor edi, edi
push edi
call fcn.00011a58
pop ebx
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x1473f
Capabilities:
Hash data with md5

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret 4
Function at 0x30b66
Capabilities:
Start minifilter driver

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x2b264]
push esi
mov esi, dword [eax + 0x28]
sub esi, 0xffffff80
cmp byte [esi + 0x49], 0
je 0x30b81
xor eax, eax
jmp 0x30be7
cmp byte [ebp + 8], 0
je 0x30b92
push 0xffffffffffffffff
call fcn.00035b1a
test eax, eax
jl 0x30be7
push edi
push dword [esi]
call sub.FLTMGR.SYS_FltStartFiltering
mov edi, eax
test edi, edi
jge 0x30bc9
cmp edi, 0xc000000d
je 0x30bc9
push edi
push 0xc1
push 0x3bdd4
push 0x3c5b2
push 0
push 0x65
call dword [sym.imp.ntoskrnl.exe_DbgPrintEx]
add esp, 0x18
mov eax, edi
jmp 0x30be6
push 0x3bdd4
push 0x3c58a
push 3
push 0x65
mov byte [esi + 0x49], 1
call dword [sym.imp.ntoskrnl.exe_DbgPrintEx]
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
ret 4

Function at 0x35180
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
push edi
push esi
push 0x34ef4
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0x200
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov edi, eax
cmp edi, esi
jl 0x351e8
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0x3bdd4
push 0x3cf06
push 3
push 0x65
call dword [sym.imp.ntoskrnl.exe_DbgPrintEx]
add esp, 0x10
jmp 0x35201
push edi
push 0x23
push 0x3bdd4
push 0x3cec6
push esi
push 0x65
call dword [sym.imp.ntoskrnl.exe_DbgPrintEx]
add esp, 0x18
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x35c5c
Capabilities:
Find process by pid

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jl 0x35c9d
mov eax, dword [0x2b264]
mov eax, dword [eax + 0x28]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax]
jne 0x35c97
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push dword [ebp + 0x18]
push 1
push 4
jmp 0x35ce2
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, dword [ebp + 0x14]
and eax, 0xff
je 0x35cc6
test eax, eax
jle 0x35cb5
cmp eax, 2
jle 0x35cbc
cmp eax, 6
jle 0x35cc6
mov eax, 0xc00000f2
jmp 0x35cee
push dword [ebp + 0x18]
push 1
push dword [ebp + 0x14]
jmp 0x35ce2
lea eax, [ebp + 0x14]
push eax
push 0x1001
push dword [ebp + 0x10]
call fcn.00036fdc
push dword [ebp + 0x18]
push 1
test eax, eax
jge 0x35cc1
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00035b90
pop esi
leave
ret 0x14
Function at 0x3602e
Capabilities:
Find process by pid

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x2b264]
push esi
mov esi, dword [eax + 0x28]
push edi
mov edi, dword [ebp + 8]
push 0x5c
push dword [edi + 0x28]
add esi, 0xd0
call dword [sym.imp.ntoskrnl.exe_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x360f4
push ebx
mov ebx, dword [sym.imp.ntoskrnl.exe_wcsncmp]
inc eax
push 0xc
inc eax
push 0x161ca
push eax
mov dword [ebp + 8], eax
call ebx
add esp, 0xc
test eax, eax
je 0x3608c
push 0xd
push 0x161ae
push dword [ebp + 8]
call ebx
add esp, 0xc
test eax, eax
jne 0x360f3
add esi, 0x14
push esi
mov dword [ebp - 4], esi
call sub.FLTMGR.SYS_FltAcquirePushLockShared
movzx ebx, word [edi + 0xc]
test bx, bx
jbe 0x360eb
movzx esi, bx
shl esi, 2
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
mov eax, dword [edi + 0x1c]
sub esi, 4
push dword [esi + eax]
add ebx, 0xffff
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jl 0x360e6
mov eax, dword [0x1af10]
mov ecx, dword [ebp + 8]
add eax, ecx
cmp byte [eax], 0
jne 0x360dd
push 0x61
pop ecx
lock or dword [eax], ecx
mov ecx, dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test bx, bx
ja 0x360a7
push dword [ebp - 4]
call sub.FLTMGR.SYS_FltReleasePushLock
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x37bb2
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
xor dl, dl
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x1c], eax
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x38240
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, 0x64425349
push esi
mov edi, 0x19000
push edi
push 1
mov dword [ebp - 4], edi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
test ebx, ebx
je 0x382bf
push 0
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
jmp 0x38299
mov eax, dword [ebp - 4]
push esi
add eax, eax
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push esi
push dword [ebp - 4]
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
test ebx, ebx
je 0x382a9
push 0
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call edi
mov dword [ebp - 8], eax
cmp eax, 0xc0000004
je 0x38272
cmp dword [ebp - 8], 0
jge 0x382bd
test ebx, ebx
je 0x382bd
push esi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor ebx, ebx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x383c6
Capabilities:
Get file attributes
Read file on windows

Disassembly:
push 0x54
push 0x1ab20
call fcn.000124c0
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov ebx, dword [ebp + 0x10]
mov dword [ebx], esi
push esi
push 0x73534649
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
call fcn.0003982c
mov dword [ebp - 0x1c], eax
cmp eax, esi
jl 0x384ec
mov dword [ebp - 4], esi
push 0x18
pop edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x40], 0x240
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
push 0x100
push esi
push esi
push esi
push esi
push 0x60
push 1
push 1
push 0x80
push esi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0x80100000
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateFile]
mov dword [ebp - 0x1c], eax
cmp eax, esi
jl 0x384c4
push 5
push edi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov dword [ebp - 0x1c], eax
cmp eax, esi
jl 0x384c4
cmp dword [ebp - 0x5c], 0xa00000
jbe 0x3847b
mov dword [ebp - 0x1c], 0xc00000bb
jmp 0x384c4
push 0x64534649
push dword [ebp - 0x5c]
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, esi
jne 0x3849d
mov dword [ebp - 0x1c], 0xc000009a
jmp 0x384c4
push esi
push esi
push dword [ebp - 0x5c]
push edi
lea eax, [ebp - 0x34]
push eax
push esi
push esi
push esi
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [ebp - 0x1c], eax
cmp eax, esi
jl 0x384c4
mov eax, dword [ebp - 0x5c]
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov dword [ebp - 4], 0xfffffffe
call fcn.000384f6
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx + 4]
je 0x384e9
push 0x73534649
lea eax, [ebp - 0x2c]
push eax
call fcn.00037dbc
mov eax, dword [ebp - 0x1c]
call fcn.00012505
ret 0xc
Function at 0x388ec
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 8]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movzx eax, byte [esi]
push eax
movzx eax, word [ebp - 8]
neg eax
sbb eax, eax
lea ecx, [ebp - 8]
and eax, ecx
push eax
push 1
push 3
push 0x1005e
lea eax, [esi + 0x210]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push dword [esi + 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryDirectoryFile]
mov ebx, eax
test ebx, ebx
jl 0x38954
mov eax, dword [esi + 0x24c]
xor ecx, ecx
mov word [eax + esi + 0x26e], cx
jmp 0x38978
cmp ebx, 0x80000006
je 0x38978
push ebx
lea eax, [ebp - 8]
push eax
push 0x3bdd4
push 0x3dc48
push 3
push 0x65
call dword [sym.imp.ntoskrnl.exe_DbgPrintEx]
add esp, 0x18
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0x39da2
Capabilities:
Find process by pid

Disassembly:
push 0xc
push 0x1acc8
call fcn.000124c0
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x39dd1
push dword [ebp + 8]
call fcn.00039cf2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.00039e07
push dword [ebp - 0x1c]
push 0x2ed
push 0x3bdd4
push 0x3e1bc
push 0
push 0x65
call dword [sym.imp.ntoskrnl.exe_DbgPrintEx]
add esp, 0x18
mov eax, dword [ebp - 0x1c]
call fcn.00012505
ret 4

Function at 0x39eba
Capabilities:
Attach user process memory

Disassembly:
push 0x1c
push 0x1ad08
call fcn.000124c0
xor edi, edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], edi
cmp dword [ebp + 8], 0xc
jae 0x39ee4
push dword [ebp + 0xc]
call fcn.00039aa0
jmp 0x39fd0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call fcn.000390e4
cmp eax, edi
jl 0x39fd0
cmp dword [ebp - 0x1c], edi
je 0x39f11
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
mov esi, dword [ebp - 0x28]
push dword [esi + 0xc]
call fcn.0003926c
mov dword [ebp - 0x20], eax
cmp eax, edi
jge 0x39f71
push dword [ebp + 0xc]
push dword [esi + 0x10]
call fcn.00039c62
mov dword [ebp - 0x20], eax
jmp 0x39f71
mov dword [ebp - 4], 0xfffffffe
cmp dword [ebp - 0x1c], edi
je 0x39f9d
push dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
push 0x75505349
push dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [ebp - 0x24]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [ebp - 0x20], edi
jl 0x39fac
push dword [ebp + 0xc]
call fcn.0003942e
jmp 0x39fcd
push dword [ebp - 0x20]
push dword [ebp + 8]
push 0x46b
push 0x3bdd4
push 0x3e1f8
push edi
push 0x65
call dword [sym.imp.ntoskrnl.exe_DbgPrintEx]
add esp, 0x1c
mov eax, dword [ebp - 0x20]
call fcn.00012505
ret 8
Function at 0x39fde
Capabilities:
Find process by pid

Disassembly:
push 0x3c
push 0x1ad28
call fcn.000124c0
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x34], ebx
or dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x1c], ebx
cmp dword [ebp + 8], 0xc
jae 0x3a00f
push dword [ebp + 0xc]
call fcn.00039aa0
jmp 0x3a187
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp dword [ebp + 8], eax
je 0x3a067
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, ebx
jl 0x3a187
lea eax, [ebp - 0x28]
push eax
push ebx
mov eax, dword [sym.imp.ntoskrnl.exe_PsProcessType]
push dword [eax]
push 0x80000000
push ebx
push 0x200
push dword [ebp - 0x2c]
call dword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x2c]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [ebp - 0x1c], ebx
jl 0x3a184
mov dword [ebp - 4], ebx
mov eax, 0x400
mov dword [ebp + 8], eax
mov esi, 0x75505349
push esi
push eax
push 1
mov edi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
call edi
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x3a169
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 8]
push eax
push 0x1b
push dword [ebp - 0x28]
mov ebx, dword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
call ebx
mov dword [ebp - 0x1c], eax
cmp eax, 0xc0000004
jne 0x3a0d3
push esi
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push esi
push dword [ebp + 8]
push 1
call edi
mov dword [ebp - 0x20], eax
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 8]
push eax
push 0x1b
push 0xffffffffffffffff
call ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x3a167
mov dword [ebp - 0x4c], 0x18
xor edi, edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x40], 0x240
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
push 0x100
push edi
push edi
push edi
push edi
push 0x60
push 1
push 1
push 0x80
push edi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0x80000000
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateFile]
mov dword [ebp - 0x1c], eax
cmp eax, edi
jl 0x3a167
push edi
lea eax, [ebp - 0x34]
push eax
push edi
mov eax, dword [sym.imp.ntoskrnl.exe_IoFileObjectType]
push dword [eax]
push edi
push dword [ebp - 0x24]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [ebp - 0x1c], eax
cmp eax, edi
jl 0x3a167
push dword [ebp + 0xc]
push dword [ebp - 0x34]
call fcn.00039520
mov dword [ebp - 0x1c], eax
test eax, eax
jl 0x3a167
push dword [ebp + 0xc]
call fcn.0003942e
xor ebx, ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.0003a196
cmp dword [ebp - 0x28], 0xffffffff
je 0x3a184
push dword [ebp - 0x28]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp - 0x1c]
call fcn.00012505
ret 8
Function at 0x3a1c6
Capabilities:
Attach user process memory

Disassembly:
push 0x1c
push 0x1ad48
call fcn.000124c0
xor esi, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call fcn.000390e4
cmp eax, esi
jl 0x3a2ad
cmp dword [ebp - 0x1c], esi
je 0x3a213
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov ecx, dword [ebp - 0x24]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [ebp - 4], esi
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x28]
push dword [eax + 0x10]
call fcn.00039c84
mov dword [ebp - 0x20], eax
jmp 0x3a261
mov dword [ebp - 4], 0xfffffffe
cmp dword [ebp - 0x1c], esi
je 0x3a284
push dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
push 0x75505349
push dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [ebp - 0x20], esi
jge 0x3a2aa
push dword [ebp - 0x20]
push dword [ebp + 8]
push 0x515
push 0x3bdd4
push 0x3e1f8
push esi
push 0x65
call dword [sym.imp.ntoskrnl.exe_DbgPrintEx]
add esp, 0x1c
mov eax, dword [ebp - 0x20]
call fcn.00012505
ret 8

Function at 0x3a2ba
Capabilities:
Attach user process memory

Disassembly:
push 0x28
push 0x1ad68
call fcn.000124c0
xor edi, edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call fcn.000390e4
mov dword [ebp - 0x1c], eax
cmp eax, edi
jl 0x3a413
cmp dword [ebp - 0x20], edi
je 0x3a30a
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov ecx, dword [ebp - 0x24]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x24], edi
mov ebx, dword [ebp + 0xc]
mov dword [ebx + 4], edi
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x38]
push eax
push dword [esi + 0x10]
call fcn.00039c40
mov dword [ebp - 0x1c], eax
cmp eax, edi
jl 0x3a35a
lea eax, [ebp - 0x28]
push eax
push dword [esi + 0x10]
call fcn.00039c1e
mov dword [ebp - 0x1c], eax
cmp eax, edi
jl 0x3a35a
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00039ae8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
call fcn.0003a366
jmp 0x3a3c7
mov dword [ebp - 4], 0xfffffffe
cmp dword [ebp - 0x20], edi
je 0x3a3ea
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
push 0x75505349
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [ebp - 0x1c], edi
jge 0x3a410
push dword [ebp - 0x1c]
push dword [ebp + 8]
push 0x55d
push 0x3bdd4
push 0x3e30c
push edi
push 0x65
call dword [sym.imp.ntoskrnl.exe_DbgPrintEx]
add esp, 0x1c
mov eax, dword [ebp - 0x1c]
call fcn.00012505
ret 8
Function at 0x3a9d8
Capabilities:
Find process by pid

Disassembly:
push 0x14
push 0x1adb0
call fcn.000124c0
and dword [ebp - 0x1c], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [ebp - 0x20], eax
test eax, eax
jl 0x3aa14
push dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x3aa2b
mov dword [ebp - 0x20], 0xc000009a
mov dword [ebp - 4], 0xfffffffe
call fcn.0003aa81
mov eax, dword [ebp - 0x20]
call fcn.00012505
ret 0xc
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0xc0000225
add ebx, 0x190
je 0x3aa14
mov edi, dword [ebx]
mov dword [ebp - 0x24], edi
test edi, edi
je 0x3aa14
cmp edi, ebx
je 0x3aa14
lea esi, [edi - 0x22c]
test esi, esi
je 0x3aa7d
push esi
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x3aa7d
mov eax, dword [esi + 0x1f0]
cmp dword [ebp + 0xc], eax
jne 0x3aa7d
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_ObfReferenceObject]
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
and dword [ebp - 0x20], 0
jmp 0x3aa14
mov edi, dword [edi]
jmp 0x3aa3f

Function at 0x3ae76
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
lea eax, [ebp + 8]
push eax
xor esi, esi
push esi
push esi
push 0xf003f
push esi
push 0x200
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov edi, eax
cmp edi, esi
jge 0x3aeb1
push edi
push 0xf6
push 0x3bdd4
push 0x3e41e
jmp 0x3aed9
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp edi, esi
jge 0x3aee5
push edi
push 0xff
push 0x3bdd4
push 0x3e3e8
push esi
push 0x65
call dword [sym.imp.ntoskrnl.exe_DbgPrintEx]
add esp, 0x18
mov eax, edi
pop edi
pop esi
pop ebp
ret 4

Function at 0x3af4a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x3af61
mov dword [eax], ebx
mov esi, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov edi, eax
cmp edi, 0xc0000023
je 0x3afab
cmp edi, 0xc0000034
je 0x3aff8
cmp edi, ebx
jge 0x3aff8
push edi
push 0x16e
push 0x3bdd4
push 0x3e45e
push ebx
push 0x65
call dword [sym.imp.ntoskrnl.exe_DbgPrintEx]
add esp, 0x18
jmp 0x3aff8
cmp dword [ebp + 0x10], ebx
je 0x3aff8
push 0x73525349
push dword [ebp - 4]
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
test ebx, ebx
jne 0x3afcd
mov edi, 0xc000009a
jmp 0x3aff8
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov edi, eax
test edi, edi
jl 0x3afec
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
jmp 0x3aff8
push 0x73525349
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc