joyce8/EMBER2024-capa huggingface dataset:
Function at 0x69190
Capabilities:
Find process by pid

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x9ccc0
push 0x9b56a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov byte [ebp - 0x19], 0
mov eax, dword [ebx + 4]
mov dword [edi], eax
mov ecx, dword [ebx + 8]
mov dword [edi + 4], ecx
xor esi, esi
mov dword [edi + 8], esi
mov dl, byte [ebx]
mov byte [ebp - 0x1a], dl
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebx + 4]
push ecx
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [ebp - 0x24], eax
cmp dword [ebx + 8], esi
jne 0x691f5
cmp eax, esi
jl 0x691f5
mov edx, dword [ebp - 0x20]
mov dword [ebx + 8], edx
push esi
mov eax, dword [ebx + 8]
call fcn.00063350
cmp al, 1
jne 0x6926c
mov edx, dword [ebx + 8]
call fcn.0008a7b0
mov byte [ebp - 0x1b], al
mov dword [ebp - 4], esi
mov eax, ebx
mov edx, 0x68b10
mov esi, dword [ebp + 0x10]
call fcn.00083ad0
push esi
push edi
mov eax, dword [ebx + 8]
push eax
call fcn.00068c60
cmp byte [ebp - 0x1a], 0
je 0x6923b
push esi
push edi
mov ecx, dword [ebx + 8]
push ecx
call fcn.00068ce0
mov dword [ebp - 4], 0xffffffff
jmp 0x6925e
cmp byte [ebp - 0x1b], 1
jne 0x6926c
mov ecx, dword [ebx + 8]
call fcn.0008a870
cmp dword [ebp - 0x24], 0
jl 0x6927b
mov ecx, dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [edi + 8], 0
je 0x69285
mov byte [ebp - 0x19], 1
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x69530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov edx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
mov eax, 0x790073
push ebx
mov ecx, 0x1770
xor bl, bl
mov dword [ebp - 0x60], 0x53005c
mov dword [ebp - 0x5c], 0x730079
mov dword [ebp - 0x58], 0x650074
mov dword [ebp - 0x54], 0x52006d
mov dword [ebp - 0x50], 0x6f006f
mov dword [ebp - 0x4c], 0x5c0074
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0x740073
mov dword [ebp - 0x40], 0x6d0065
mov dword [ebp - 0x3c], 0x320033
mov dword [ebp - 0x38], 0x64005c
mov dword [ebp - 0x34], 0x690072
mov dword [ebp - 0x30], 0x650076
mov dword [ebp - 0x2c], 0x730072
cmp word [edx], cx
push esi
mov dword [ebp - 0x28], 0x73005c
mov dword [ebp - 0x1c], 0x72006f
mov dword [ebp - 0x18], 0x2e0074
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x73
jae 0x695dc
mov dword [ebp - 0x24], 0x730063
mov dword [ebp - 0x20], 0x700069
jmp 0x695ea
mov dword [ebp - 0x24], 0x6f0074
mov dword [ebp - 0x20], 0x700072
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 0x60]
call fcn.0004d700
test eax, eax
jne 0x6962c
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push edx
push eax
push ecx
push esi
call fcn.00014940
cmp al, 1
jne 0x6961a
mov bl, al
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x699e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov ecx, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
push ebx
xor ebx, ebx
mov eax, 0x1770
push esi
push edi
mov byte [ebp - 1], bl
cmp word [ecx], ax
jae 0x69a05
push 0x307
jmp 0x69a0a
push 0x309
call fcn.00049640
mov edi, eax
cmp edi, ebx
je 0x69bca
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
call fcn.00069530
cmp al, 1
jne 0x69bca
mov esi, dword [ebp - 0xc]
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 8]
push esi
mov dword [ebp - 0x1c], 0x736f746e
mov dword [ebp - 0x18], 0x6c6e726b
mov dword [ebp - 0x14], 0x6578652e
mov dword [ebp - 0x30], 0x43666f49
mov dword [ebp - 0x2c], 0x6c706d6f
mov dword [ebp - 0x28], 0x52657465
mov dword [ebp - 0x24], 0x65757165
mov dword [ebp - 0x20], 0x7473
call fcn.00014e00
cmp al, 1
jne 0x69a95
mov ecx, dword [ebp - 0xc]
add ecx, edi
push ecx
push 0x30c
call fcn.00049620
push 0x1235
call fcn.00049650
mov edx, dword [ebp - 8]
mov ebx, eax
push ebx
push edx
push esi
mov dword [ebp - 0xc], ebx
call fcn.00069640
cmp al, 1
jne 0x69b1b
mov eax, dword [ebp - 8]
push eax
push esi
xor eax, eax
mov ecx, edi
call fcn.00014be0
cmp al, 1
jne 0x69b1b
lea ecx, [ebx + 4]
mov edx, 0x1d
lea ecx, [ecx]
mov eax, dword [ecx]
mov dword [ecx - 4], 0
test eax, eax
je 0x69b05
lea edi, [eax + 0x10]
cmp edi, dword [ebp - 8]
ja 0x69b05
add eax, esi
mov dword [ecx - 4], 1
mov edi, dword [eax]
mov dword [ecx + 8], edi
mov edi, dword [eax + 4]
mov dword [ecx + 0xc], edi
mov edi, dword [eax + 8]
mov dword [ecx + 0x10], edi
mov eax, dword [eax + 0xc]
mov dword [ecx + 0x14], eax
add ecx, 0x1c
dec edx
jne 0x69ad0
push 1
push 0x30b
mov bl, 1
call fcn.00049620
jmp 0x69b1e
mov bl, byte [ebp - 1]
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp bl, 1
jne 0x69bca
push 0x2a7
call fcn.00049640
mov edx, eax
test edx, edx
jne 0x69b5a
call fcn.0008b3d0
push 0x2a7
call fcn.00049640
mov edx, eax
push 0x4c
call fcn.00049640
push 0x21
mov esi, eax
call fcn.00049640
push 3
mov ecx, eax
call fcn.00049640
test edx, edx
je 0x69bca
test esi, esi
je 0x69bca
test ecx, ecx
je 0x69bca
test eax, eax
je 0x69bca
lea edi, [edx + 0x10]
cmp edi, ecx
ja 0x69bca
mov ecx, dword [ebp - 0xc]
add ecx, 4
mov edi, 0x1c
cmp dword [ecx], 0
jne 0x69bc4
mov dword [ecx - 4], 1
mov dword [ecx], edx
lea ebx, [eax + edx]
mov dword [ecx + 4], ebx
mov ebx, dword [esi + edx]
mov dword [ecx + 8], ebx
mov ebx, dword [esi + edx + 4]
mov dword [ecx + 0xc], ebx
mov ebx, dword [esi + edx + 8]
mov dword [ecx + 0x10], ebx
mov ebx, dword [esi + edx + 0xc]
mov dword [ecx + 0x14], ebx
add ecx, 0x1c
dec edi
jne 0x69b95
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6a160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
mov eax, 0x320033
mov ecx, 0x790073
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
push esi
lea eax, [ebp - 4]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x10], ecx
push eax
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 0x48]
xor bl, bl
mov dword [ebp - 0x48], 0x53005c
mov dword [ebp - 0x44], 0x730079
mov dword [ebp - 0x40], 0x650074
mov dword [ebp - 0x3c], 0x52006d
mov dword [ebp - 0x38], 0x6f006f
mov dword [ebp - 0x34], 0x5c0074
mov dword [ebp - 0x2c], 0x740073
mov dword [ebp - 0x28], 0x6d0065
mov dword [ebp - 0x20], 0x77005c
mov dword [ebp - 0x1c], 0x6e0069
mov dword [ebp - 0x14], 0x2e006b
mov dword [ebp - 0xc], 0x73
call fcn.0004d700
test eax, eax
jne 0x6a216
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push edx
push eax
push ecx
push esi
call fcn.00014940
cmp al, 1
jne 0x6a204
mov bl, al
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x6a220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, 0x320033
push ebx
mov ecx, 0x790073
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x10], ecx
push eax
lea ecx, [ebp - 4]
push ecx
lea eax, [ebp - 0x50]
xor bl, bl
mov dword [ebp - 0x50], 0x53005c
mov dword [ebp - 0x4c], 0x730079
mov dword [ebp - 0x48], 0x650074
mov dword [ebp - 0x44], 0x52006d
mov dword [ebp - 0x40], 0x6f006f
mov dword [ebp - 0x3c], 0x5c0074
mov dword [ebp - 0x34], 0x740073
mov dword [ebp - 0x30], 0x6d0065
mov dword [ebp - 0x28], 0x77005c
mov dword [ebp - 0x24], 0x6e0069
mov dword [ebp - 0x1c], 0x66006b
mov dword [ebp - 0x18], 0x6c0075
mov dword [ebp - 0x14], 0x2e006c
mov dword [ebp - 0xc], 0x73
call fcn.0004d700
test eax, eax
jne 0x6a2e9
mov edx, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push esi
push edi
push edx
push eax
call fcn.00014940
cmp al, 1
jne 0x6a2d4
mov edx, dword [esi]
mov eax, dword [edi]
call fcn.0006a0f0
mov bl, 1
push 0x877
call fcn.00049640
mov ecx, dword [ebp - 4]
push eax
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6b350
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
push 0x61
call fcn.00049640
mov esi, eax
mov dword [esp + 0xc], esi
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp eax, esi
jne 0x6b37d
mov dword [esp + 0xc], 0
jmp 0x6b38d
test esi, esi
je 0x6b38d
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
push 0x42
call fcn.00049640
mov ebx, eax
test ebx, ebx
je 0x6b3fb
lea esi, [ebx + ebx*4]
push 0x877
shl esi, 4
call fcn.00049640
push eax
push esi
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
test edi, edi
je 0x6b3fb
push esi
push 0
push edi
call sub.ntoskrnl.exe_memset
add esp, 0xc
push ebx
push edi
call fcn.0006ac80
cmp al, 1
jne 0x6b3e9
push ebx
push edi
call fcn.0006b010
cmp al, 1
jne 0x6b3e9
push edi
push 0x23c
call fcn.00049620
jmp 0x6b3fb
push 0x877
call fcn.00049640
push eax
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [esp + 0xc], 0
je 0x6b40d
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6bc60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
lea eax, [ebp - 0x1c]
push eax
xor bl, bl
mov dword [ebp - 0x1c], 0x44005c
mov dword [ebp - 0x18], 0x690072
mov dword [ebp - 0x14], 0x650076
mov dword [ebp - 0x10], 0x5c0072
mov dword [ebp - 0xc], 0x630054
mov dword [ebp - 8], 0x690070
mov dword [ebp - 4], 0x70
call fcn.0008b990
test eax, eax
je 0x6bcfe
lea edx, [eax + 0x3c]
mov eax, dword [ebp + 8]
mov ecx, 2
add eax, 0x24
push esi
lea esi, [ecx - 2]
mov dword [eax - 0x24], esi
mov esi, dword [edx - 4]
mov dword [eax - 0x18], esi
lea esi, [ecx - 1]
mov dword [eax], esi
mov esi, dword [edx]
mov dword [eax + 0xc], esi
mov dword [eax + 0x24], ecx
mov esi, dword [edx + 4]
mov dword [eax + 0x30], esi
lea esi, [ecx + 1]
mov dword [eax + 0x48], esi
mov esi, dword [edx + 8]
add ecx, 4
mov dword [eax + 0x54], esi
lea esi, [ecx - 2]
add edx, 0x10
add eax, 0x90
cmp esi, 0x1b
jbe 0x6bcb6
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x6c080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
lea eax, [ebp - 0x2c]
push eax
xor ebx, ebx
mov dword [ebp - 0x2c], 0x44005c
mov dword [ebp - 0x28], 0x690072
mov dword [ebp - 0x24], 0x650076
mov dword [ebp - 0x20], 0x5c0072
mov dword [ebp - 0x1c], 0x630054
mov dword [ebp - 0x18], 0x690070
mov dword [ebp - 0x14], 0x70
call fcn.0008b990
cmp eax, ebx
je 0x6c10b
mov ecx, dword [esi]
cmp ecx, 0x1b
ja 0x6c10b
mov edx, dword [esi + 8]
lea eax, [eax + ecx*4 + 0x38]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], ebx
push eax
cli
mov eax, cr0
mov dword [ebp - 4], eax
and eax, 0xfffeffff
mov cr0, eax
push ebx
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
lock xchg dword [eax], ebx
mov dword [ebp - 8], ebx
pop ebx
mov eax, dword [ebp - 4]
mov cr0, eax
sti
pop eax
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6c240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, 0x730079
push ebx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
xor ebx, ebx
push ecx
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0x53005c
mov dword [ebp - 0x4c], 0x650074
mov dword [ebp - 0x48], 0x52006d
mov dword [ebp - 0x44], 0x6f006f
mov dword [ebp - 0x40], 0x5c0074
mov dword [ebp - 0x3c], 0x790073
mov dword [ebp - 0x38], 0x740073
mov dword [ebp - 0x34], 0x6d0065
mov dword [ebp - 0x30], 0x320033
mov dword [ebp - 0x2c], 0x64005c
mov dword [ebp - 0x28], 0x690072
mov dword [ebp - 0x24], 0x650076
mov dword [ebp - 0x20], 0x730072
mov dword [ebp - 0x1c], 0x74005c
mov dword [ebp - 0x18], 0x780064
mov dword [ebp - 0x14], 0x73002e
mov dword [ebp - 0xc], ebx
call fcn.0004d700
test eax, eax
jne 0x6c30b
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push esi
mov esi, dword [ebp - 8]
push ebx
push edx
push eax
push ecx
push esi
call fcn.00014940
cmp al, 1
jne 0x6c2f8
mov bl, al
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x6c6e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
lea eax, [ebp - 0x18]
push eax
xor bl, bl
mov dword [ebp - 0x18], 0x44005c
mov dword [ebp - 0x14], 0x690072
mov dword [ebp - 0x10], 0x650076
mov dword [ebp - 0xc], 0x5c0072
mov dword [ebp - 8], 0x640074
mov dword [ebp - 4], 0x78
call fcn.0008b990
test eax, eax
je 0x6c778
lea edx, [eax + 0x3c]
mov eax, dword [ebp + 8]
mov ecx, 2
add eax, 0x24
push esi
nop
lea esi, [ecx - 2]
mov dword [eax - 0x24], esi
mov esi, dword [edx - 4]
mov dword [eax - 0x18], esi
lea esi, [ecx - 1]
mov dword [eax], esi
mov esi, dword [edx]
mov dword [eax + 0xc], esi
mov dword [eax + 0x24], ecx
mov esi, dword [edx + 4]
mov dword [eax + 0x30], esi
lea esi, [ecx + 1]
mov dword [eax + 0x48], esi
mov esi, dword [edx + 8]
add ecx, 4
mov dword [eax + 0x54], esi
lea esi, [ecx - 2]
add edx, 0x10
add eax, 0x90
cmp esi, 0x1b
jbe 0x6c730
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x6c9a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
lea eax, [ebp - 0x28]
push eax
xor ebx, ebx
mov dword [ebp - 0x28], 0x44005c
mov dword [ebp - 0x24], 0x690072
mov dword [ebp - 0x20], 0x650076
mov dword [ebp - 0x1c], 0x5c0072
mov dword [ebp - 0x18], 0x640074
mov dword [ebp - 0x14], 0x78
call fcn.0008b990
cmp eax, ebx
je 0x6ca24
mov ecx, dword [esi]
cmp ecx, 0x1b
ja 0x6ca24
mov edx, dword [esi + 8]
lea eax, [eax + ecx*4 + 0x38]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], ebx
push eax
cli
mov eax, cr0
mov dword [ebp - 4], eax
and eax, 0xfffeffff
mov cr0, eax
push ebx
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
lock xchg dword [eax], ebx
mov dword [ebp - 8], ebx
pop ebx
mov eax, dword [ebp - 4]
mov cr0, eax
sti
pop eax
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6cb60
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
push edi
push 0x61
call fcn.00049640
mov edi, eax
mov dword [ebp - 8], edi
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp eax, edi
jne 0x6cb8a
mov dword [ebp - 8], 0
mov edi, dword [ebp - 8]
jmp 0x6cb99
test edi, edi
je 0x6cb99
lea eax, [ebp - 0x38]
push eax
push edi
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
push 0x20
call fcn.00049640
push 0x21
mov ecx, eax
call fcn.00049640
mov edx, eax
push 3
mov dword [ebp - 0x1c], edx
call fcn.00049640
mov esi, eax
push 0x499f
mov dword [ebp - 0x20], esi
call fcn.00049640
test ecx, ecx
je 0x6cd65
test edx, edx
je 0x6cd65
test esi, esi
je 0x6cd65
test eax, eax
je 0x6cd65
cmp eax, edx
jae 0x6cd65
mov esi, dword [ecx + 0x3c]
mov esi, dword [esi + ecx + 0x34]
add edx, ecx
push ebx
mov dword [ebp - 0xc], esi
lea edi, [eax + ecx]
mov dword [ebp - 0x10], edx
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
push ecx
lea esi, [ebp - 0x5c]
mov ecx, edi
call fcn.00032c70
test al, al
je 0x6cd61
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx]
add edi, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x50]
cmp eax, 0x107c
jne 0x6cc2d
test ecx, ecx
js 0x6cc43
cmp eax, 0x1096
jne 0x6cc38
test ecx, ecx
js 0x6cc43
inc ebx
cmp ebx, 0x50
jb 0x6cc01
jmp 0x6cd61
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], 0
mov edi, edi
mov ebx, dword [ebp - 0x10]
push ebx
lea esi, [ebp - 0x5c]
mov ecx, edi
call fcn.00032c70
test al, al
je 0x6cd61
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
add edi, dword [ebp - 0x44]
cmp eax, 0x1024
je 0x6cc80
cmp eax, 0x1285
jne 0x6cd51
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x14], 0x100
cmp eax, 0x7f
jne 0x6ccd0
mov dword [ebp - 0x14], 0x80
cmp byte [ebp - 1], 0
jne 0x6ccdb
push ebx
lea esi, [ebp - 0x5c]
mov ecx, edi
call fcn.00032c70
cmp al, 1
jne 0x6cd51
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx], 0x1080
jne 0x6cd51
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0xc]
cmp eax, ecx
jbe 0x6cd51
sub eax, ecx
jmp 0x6cd1d
cmp eax, 0x1ff
jne 0x6cc96
mov byte [ebp - 1], 1
push ebx
lea esi, [ebp - 0x5c]
mov ecx, edi
call fcn.00032c70
cmp al, 1
jne 0x6cd51
mov edx, dword [ebp - 0x3c]
add edi, dword [ebp - 0x44]
cmp dword [edx], 0x1270
jne 0x6cd51
push ebx
mov ecx, edi
call fcn.00032c70
cmp al, 1
jne 0x6cd51
mov eax, dword [ebp - 0x3c]
cmp dword [eax], 0x1037
jne 0x6cd51
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0xc]
jbe 0x6cd51
sub eax, dword [ebp - 0xc]
sub eax, 0xc
test eax, eax
je 0x6cd51
cmp eax, dword [ebp - 0x1c]
jae 0x6cd51
add eax, dword [ebp - 0x20]
push eax
push 0x299
call fcn.00049620
mov edx, dword [ebp - 0x14]
push edx
push 0x29a
call fcn.00049620
movzx eax, byte [ebp - 1]
push eax
push 0x29b
call fcn.00049620
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0xa
jb 0x6cc50
mov edi, dword [ebp - 8]
pop ebx
test edi, edi
pop edi
pop esi
je 0x6cd75
lea ecx, [ebp - 0x38]
push ecx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov esp, ebp
pop ebp
ret
Function at 0x6cd80
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 0x61
call fcn.00049640
mov esi, eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp eax, esi
jne 0x6cda8
mov dword [ebp - 0xc], 0
jmp 0x6cdb7
test esi, esi
je 0x6cdb7
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
push 0x20
call fcn.00049640
push 0x21
mov esi, eax
call fcn.00049640
mov edi, eax
push 0x42
mov dword [ebp - 4], edi
call fcn.00049640
push 3
mov ebx, eax
call fcn.00049640
push 0x62
mov dword [ebp - 8], eax
call fcn.00049640
mov ecx, eax
test ecx, ecx
jne 0x6cdfa
call fcn.0006b7f0
push 0x62
call fcn.00049640
mov ecx, eax
test esi, esi
je 0x6ce71
test edi, edi
je 0x6ce71
cmp dword [ebp - 8], 0
je 0x6ce71
test ecx, ecx
je 0x6ce71
mov edx, dword [esi + 0x3c]
mov edx, dword [edx + esi + 0x34]
push 0x49a5
call fcn.00049640
inc eax
cmp eax, 1
jbe 0x6ce71
lea edi, [eax + 4]
cmp edi, dword [ebp - 4]
jae 0x6ce71
mov eax, dword [eax + esi]
test eax, eax
je 0x6ce71
cmp eax, ebx
jae 0x6ce71
mov eax, dword [ecx + eax*4]
cmp eax, edx
jbe 0x6ce71
mov ecx, eax
sub ecx, edx
cmp ecx, dword [ebp - 4]
jae 0x6ce71
add edx, ecx
cmp eax, edx
jne 0x6ce71
push ecx
push 0x29e
call fcn.00049620
add ecx, dword [ebp - 8]
push ecx
push 0x29f
call fcn.00049620
mov edi, ecx
mov eax, 0x67
call fcn.00088810
cmp dword [ebp - 0xc], 0
je 0x6ce81
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6ce90
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
push ebx
push esi
push edi
push 0x29e
call fcn.00049640
mov edi, eax
xor esi, esi
cmp edi, esi
jne 0x6cec7
call fcn.0006cd80
push 0x29e
call fcn.00049640
mov edi, eax
cmp edi, esi
je 0x6d028
push 0x61
call fcn.00049640
mov ebx, eax
mov dword [esp + 0x20], ebx
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp eax, ebx
jne 0x6cee4
mov dword [esp + 0x20], esi
jmp 0x6cef4
cmp ebx, esi
je 0x6cef4
lea eax, [esp + 0x34]
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
push 0x20
call fcn.00049640
push 0x21
mov ebx, eax
call fcn.00049640
mov ecx, eax
push 3
mov dword [esp + 0x30], ecx
call fcn.00049640
mov edx, eax
push 0x48ac
mov dword [esp + 0x34], edx
call fcn.00049640
mov dword [esp + 0x24], eax
cmp ebx, esi
je 0x6d017
cmp ecx, esi
je 0x6d017
cmp edx, esi
je 0x6d017
cmp eax, esi
je 0x6d017
cmp edi, ecx
jae 0x6d017
add edi, ebx
add ecx, ebx
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx + ebx + 0x34]
mov dword [esp + 0x28], edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x1c]
push eax
lea esi, [esp + 0x50]
mov ecx, edi
call fcn.00032c70
test al, al
je 0x6d015
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x14], edi
add edi, dword [esp + 0x64]
cmp dword [edx], 0x10cd
mov dword [esp + 0x10], eax
jne 0x6cfbe
mov eax, dword [esp + 0x58]
sub eax, ebx
add eax, edi
cmp eax, dword [esp + 0x24]
je 0x6cfd0
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x100
jb 0x6cf70
jmp 0x6d015
test ecx, ecx
je 0x6d015
mov edx, dword [esp + 0x1c]
push edx
lea esi, [esp + 0x50]
call fcn.00032c70
cmp al, 1
jne 0x6d015
mov eax, dword [esp + 0x6c]
cmp dword [eax], 0x11b6
jne 0x6d015
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x28]
cmp eax, ecx
jbe 0x6d015
sub eax, ecx
cmp eax, dword [esp + 0x2c]
jae 0x6d015
add eax, dword [esp + 0x30]
push eax
push 0x29c
call fcn.00049620
xor esi, esi
cmp dword [esp + 0x20], esi
je 0x6d028
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6da00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, 0x730079
push ebx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
xor ebx, ebx
push ecx
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0x53005c
mov dword [ebp - 0x54], 0x650074
mov dword [ebp - 0x50], 0x52006d
mov dword [ebp - 0x4c], 0x6f006f
mov dword [ebp - 0x48], 0x5c0074
mov dword [ebp - 0x44], 0x790073
mov dword [ebp - 0x40], 0x740073
mov dword [ebp - 0x3c], 0x6d0065
mov dword [ebp - 0x38], 0x320033
mov dword [ebp - 0x34], 0x64005c
mov dword [ebp - 0x30], 0x690072
mov dword [ebp - 0x2c], 0x650076
mov dword [ebp - 0x28], 0x730072
mov dword [ebp - 0x24], 0x75005c
mov dword [ebp - 0x20], 0x620073
mov dword [ebp - 0x1c], 0x6f0070
mov dword [ebp - 0x18], 0x740072
mov dword [ebp - 0x14], 0x73002e
mov dword [ebp - 0xc], ebx
call fcn.0004d700
test eax, eax
jne 0x6dad9
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push esi
mov esi, dword [ebp - 8]
push ebx
push edx
push eax
push ecx
push esi
call fcn.00014940
cmp al, 1
jne 0x6dac6
mov bl, al
push 0x877
call fcn.00049640
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8