joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11b60
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_KeQuerySystemTime]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
lea eax, [ebp - 8]
push eax
call fcn.00011942
movzx ecx, byte [ebp - 4]
movzx eax, byte [ebp - 3]
add eax, ecx
movzx ecx, byte [ebp - 5]
add eax, ecx
movzx ecx, byte [ebp - 6]
add ecx, dword [ebp - 0x10]
push 0x114
add ecx, eax
push 0
mov esi, 0x25220
push esi
mov dword [ebp - 0x10], ecx
call sub.ntoskrnl.exe_memset
add esp, 0xc
push esi
mov dword [0x25220], 0x114
call dword [sym.imp.ntoskrnl.exe_RtlGetVersion]
pop esi
test eax, eax
jne 0x11bec
cmp dword [0x25224], 6
jb 0x11bec
push dword [ebp - 0x10]
call dword [sym.imp.ntoskrnl.exe_srand]
pop ecx
call dword [sym.imp.ntoskrnl.exe_rand]
leave
ret
mov ecx, dword [ebp - 0x10]
mov eax, 0x3039
test ecx, ecx
jne 0x11c06
mov ecx, dword [0x223d8]
imul ecx, ecx, 0x41c64e6d
add ecx, eax
imul ecx, ecx, 0x3e39b193
sub eax, ecx
shr eax, 0x10
and eax, 0x7fff
leave
ret
Function at 0x13016
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x60]
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.000129d2
cmp al, 1
je 0x13061
movzx eax, byte [edx]
mov eax, dword [eax*4 + 0x22408]
test eax, eax
je 0x13046
push ecx
push esi
call eax
jmp 0x130e1
and dword [ecx + 0x1c], 0
mov esi, 0xc0000010
xor dl, dl
mov dword [ecx + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
jmp 0x130e1
cmp byte [0x223d0], 0
push edi
mov edi, dword [esi + 0x28]
jne 0x1309a
mov al, byte [edx]
test al, al
je 0x130d8
cmp al, 0xf
je 0x13086
cmp al, 0x12
jne 0x1309a
push edx
push ecx
push esi
call fcn.00012ac2
jmp 0x130e0
movzx eax, byte [edx + 1]
dec eax
je 0x130ce
dec eax
je 0x130c4
sub eax, 5
je 0x130ba
sub eax, 4
je 0x130b0
inc byte [ecx + 0x23]
add edx, 0x24
mov dword [ecx + 0x60], edx
mov edx, ecx
mov ecx, dword [edi + 0xc]
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
jmp 0x130e0
push edx
push ecx
push esi
call fcn.00012c18
jmp 0x130e0
push edx
push ecx
push esi
call fcn.00012d20
jmp 0x130e0
push edx
push ecx
push esi
call fcn.00012bca
jmp 0x130e0
push edx
push ecx
push esi
call fcn.00012b3a
jmp 0x130e0
push edx
push ecx
push esi
call fcn.000129f6
pop edi
pop esi
pop ebp
ret 8
Function at 0x1339e
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [0x1f190]
and dword [ebp - 4], 0
push esi
mov esi, dword [0x1f18c]
push edi
mov edi, dword [0x1f194]
add eax, edi
add eax, dword [0x1f188]
xor ecx, esi
xor edx, esi
add eax, esi
mov esi, dword [ebp + 0xc]
mov edi, dword [esi + 4]
mov dword [ebp - 0xc], edi
mov edi, dword [esi]
mov dword [ebp + 0xc], edi
mov edi, dword [esi + 0xc]
mov esi, dword [esi + 8]
mov dword [ebp - 8], 0x20
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
add dword [ebp - 4], eax
dec dword [ebp - 8]
mov esi, edx
shl esi, 4
add esi, dword [ebp + 0xc]
mov edi, edx
shr edi, 5
add edi, dword [ebp - 0xc]
xor esi, edi
mov edi, dword [ebp - 4]
add edi, edx
xor esi, edi
add ecx, esi
mov esi, ecx
shl esi, 4
add esi, dword [ebp - 0x10]
mov edi, ecx
shr edi, 5
add edi, dword [ebp - 0x14]
xor esi, edi
mov edi, dword [ebp - 4]
add edi, ecx
xor esi, edi
add edx, esi
cmp dword [ebp - 8], 0
ja 0x133f4
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
pop esi
leave
ret 8

Function at 0x1344a
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov ecx, dword [0x1f194]
push esi
mov esi, dword [eax + 4]
mov eax, dword [0x1f190]
add ecx, eax
mov eax, dword [ebp + 0xc]
add ecx, dword [0x1f18c]
push edi
mov edi, dword [eax + 0xc]
add ecx, dword [0x1f188]
mov dword [ebp - 0xc], edi
mov edi, dword [eax + 8]
mov dword [ebp + 0xc], edi
mov edi, dword [eax + 4]
mov eax, dword [eax]
mov edx, ecx
mov dword [ebp - 8], 0x20
shl edx, 5
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp + 0xc]
dec dword [ebp - 8]
shr edi, 5
add edi, dword [ebp - 0xc]
xor eax, edi
mov edi, dword [ebp - 4]
add edi, edx
xor eax, edi
sub esi, eax
mov eax, esi
shl eax, 4
add eax, dword [ebp - 0x10]
mov edi, esi
shr edi, 5
add edi, dword [ebp - 0x14]
xor eax, edi
lea edi, [edx + esi]
xor eax, edi
sub dword [ebp - 4], eax
sub edx, ecx
cmp dword [ebp - 8], 0
ja 0x1349e
mov eax, dword [0x1f18c]
xor eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [0x1f18c]
xor eax, esi
pop edi
mov dword [ecx + 4], eax
pop esi
leave
ret 8

Function at 0x135a6
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor ecx, ecx
or eax, 0xffffffff
cmp dword [ebp + 0xc], ecx
jbe 0x135d4
mov edx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x247c0]
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x135b5
not eax
pop ebp
ret 8
Function at 0x16dfe
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x2235c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x4000
push esi
call fcn.000153de
mov edi, eax
test edi, edi
jne 0x16e4f
mov eax, dword [0x22494]
test eax, eax
jne 0x16fde
mov eax, dword [0x22490]
and eax, 3
mov eax, dword [eax*4 + 0x1f19c]
mov byte [0x22498], 1
jmp 0x16fde
push 0x11
push 2
push 2
call fcn.000109a4
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x16ea0
push edi
call fcn.000153f8
mov eax, dword [0x22494]
test eax, eax
je 0x16e7b
mov esi, eax
jmp 0x16fdc
mov eax, dword [0x22490]
and eax, 3
mov esi, dword [eax*4 + 0x1f19c]
push 0x1de22
mov byte [0x22498], 1
call sub.ntoskrnl.exe_DbgPrint
jmp 0x16fdb
push esi
push 0
push edi
call sub.ntoskrnl.exe_memset
add esp, 0xc
push ebx
push edi
call fcn.00016c90
push 2
mov dword [ebp - 0x20], eax
pop eax
push 0x35
mov word [ebp - 0x14], ax
call fcn.000109fe
pop ecx
mov word [ebp - 0x12], ax
call fcn.00016ba6
push 0x10
pop ebx
push ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x20]
push edi
push dword [ebp - 0x18]
call fcn.00010904
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
jge 0x16f37
push edi
call fcn.000153f8
push dword [ebp - 0x18]
call fcn.00010542
cmp dword [ebp - 0x1c], 0xc0000022
mov eax, dword [0x22494]
pop ecx
jne 0x16e2c
test eax, eax
jne 0x16f2c
mov eax, dword [0x22490]
and eax, 3
mov eax, dword [eax*4 + 0x1f19c]
mov byte [0x22498], 1
inc dword [0x22490]
jmp 0x16fde
push esi
push 0
push edi
mov dword [ebp - 0x1c], ebx
call sub.ntoskrnl.exe_memset
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push edi
push dword [ebp - 0x18]
call fcn.0001082a
mov esi, eax
add esp, 0x24
test esi, esi
jge 0x16fa3
push edi
call fcn.000153f8
push dword [ebp - 0x18]
call fcn.00010542
mov eax, dword [0x22494]
pop ecx
test eax, eax
je 0x16f7c
mov edi, eax
jmp 0x16f9f
mov eax, dword [0x22490]
and eax, 3
mov edi, dword [eax*4 + 0x1f19c]
push esi
push 0x1de00
mov byte [0x22498], 1
call sub.ntoskrnl.exe_DbgPrint
pop ecx
pop ecx
mov eax, edi
jmp 0x16fde
push esi
push edi
call fcn.00016d66
mov esi, eax
test esi, esi
jne 0x16fd3
mov eax, dword [0x22494]
test eax, eax
je 0x16fbd
mov esi, eax
jmp 0x16fd3
mov eax, dword [0x22490]
and eax, 3
mov esi, dword [eax*4 + 0x1f19c]
mov byte [0x22498], 1
push dword [ebp - 0x18]
call fcn.00010542
pop ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0001c571
leave
ret 4
Function at 0x18b46
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
xor ebx, ebx
push edi
xor edi, edi
inc ebx
mov dword [ebp - 4], edi
cmp byte [0x224bc], bl
jne 0x18c93
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x1fd28
lea eax, [ebp - 0x20]
push eax
call esi
mov eax, dword [0x1f818]
push dword [eax*4 + 0x1f80c]
lea eax, [ebp - 0x28]
push eax
call esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
test eax, eax
jl 0x18c92
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x40]
push eax
push 0xf003f
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x40], 0x18
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], 0x200
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp dword [ebp - 4], edi
je 0x18c92
push 0x1e0b2
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 8], ebx
call esi
push 4
lea eax, [ebp - 8]
push eax
push 4
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call edi
push 0x1da7a
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 8], ebx
call esi
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call edi
push 0x1e0a8
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 8], ebx
call esi
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call edi
push 0x1e09c
lea eax, [ebp - 0x10]
push eax
call esi
mov ecx, 0x1e074
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x18c69
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push ebx
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop esi
pop edi
pop ebx
leave
ret
Function at 0x19666
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
mov edi, 0x40000
push edi
call fcn.000153de
xor esi, esi
mov dword [0x224a0], eax
cmp eax, esi
je 0x19772
push edi
push esi
push eax
call sub.ntoskrnl.exe_memset
mov eax, dword [0x224a8]
add esp, 0xc
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 0x24], 0x24558
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov edi, dword [eax + 0x28]
push eax
call dword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov dword [edi + 8], eax
cmp eax, esi
jne 0x196cf
mov eax, dword [edi + 4]
mov dword [edi + 8], eax
push dword [edi + 8]
lea eax, [ebp - 0x14]
push 0x800
push esi
push esi
push esi
push esi
push 0x60
push 1
push 1
push 0x80
push esi
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x80000000
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
test eax, eax
jge 0x19715
push dword [0x224a0]
call fcn.000153f8
mov dword [0x224a0], esi
jmp 0x19772
push 5
push 0x18
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jl 0x19702
mov edi, dword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
push esi
push 1
push dword [ebp - 4]
call edi
mov eax, dword [ebp - 0x3c]
push esi
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [0x224a0]
mov dword [0x224a4], eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
jl 0x19702
push esi
push 1
push dword [ebp - 4]
call edi
pop edi
pop esi
leave
ret
Function at 0x1977c
Capabilities:
Get file attributes
Set file attributes
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x224a8]
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp eax, esi
je 0x19895
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [eax + 0x28]
push eax
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], 0x40
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov dword [edi + 8], eax
cmp eax, esi
jne 0x197cc
mov eax, dword [edi + 4]
mov dword [edi + 8], eax
push dword [edi + 8]
lea eax, [ebp - 0xc]
push 0x800
push esi
push esi
push esi
push esi
push 0x60
push 5
push 3
push 6
push esi
push eax
lea eax, [ebp - 0x24]
push eax
push 0xc0000000
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
mov edi, eax
cmp edi, esi
jl 0x19890
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
push esi
push 1
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.0001880a
push 4
push 0x28
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp dword [ebp - 0xc], esi
jl 0x19887
mov eax, 0xfa2b0929
push 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], eax
push 0x28
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xc]
mov ecx, 0x1c95a06
push eax
push dword [ebp - 4]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x40], ecx
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
pop edi
jmp 0x1989a
mov eax, 0xc000000e
pop esi
leave
ret 0x10
Function at 0x198a4
Capabilities:
Get file attributes
Set file attributes
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x224a8]
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp eax, esi
je 0x199c0
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [eax + 0x28]
push eax
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], 0x40
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov dword [edi + 8], eax
cmp eax, esi
jne 0x198f4
mov eax, dword [edi + 4]
mov dword [edi + 8], eax
push dword [edi + 8]
lea eax, [ebp - 0xc]
push 0x800
push esi
push esi
push esi
push esi
push 0x60
push 5
push 3
push 0x80
push esi
push eax
lea eax, [ebp - 0x24]
push eax
push 0xc0000000
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
mov edi, eax
cmp edi, esi
jl 0x199bb
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
push esi
push 1
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.0001880a
push 4
push 0x28
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp dword [ebp - 0xc], esi
jl 0x199b2
mov eax, 0xfa2b0929
push 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], eax
push 0x28
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xc]
mov ecx, 0x1c95a06
push eax
push dword [ebp - 4]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x40], ecx
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
pop edi
jmp 0x199c5
mov eax, 0xc000000e
pop esi
leave
ret 0x10
Function at 0x1ab5c
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x224a8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp eax, edi
je 0x1ac32
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [eax + 0x28]
push 0x24580
push 0x200
lea eax, [ebp - 0xc]
push eax
push ebx
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call fcn.0001977c
push dword [0x224a8]
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov dword [esi + 8], eax
cmp eax, edi
jne 0x1abcc
mov eax, dword [esi + 4]
mov dword [esi + 8], eax
push dword [esi + 8]
lea eax, [ebp - 0x14]
push 0x800
push edi
push edi
push edi
push edi
push 0x1060
push 1
push 4
push 0x80
push edi
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x10000
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
pop esi
pop ebx
test eax, eax
jl 0x1ac26
push 0xd
push 1
lea eax, [ebp + 0xb]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
mov byte [ebp + 0xb], 1
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
jmp 0x1ac37
mov eax, 0xc000000e
pop edi
leave
ret 4
Function at 0x1b5a6
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 4
pop esi
push 0x1da7a
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push esi
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
mov edi, 0x24bc8
push edi
call fcn.00011648
push 0x24558
call fcn.0001ab5c
xor eax, eax
mov esi, 0x400
mov word [ebp - 0x10], ax
mov eax, esi
push esi
mov word [ebp - 0xe], ax
call fcn.000153de
xor ebx, ebx
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x1b709
movzx ecx, word [ebp - 0xe]
push ecx
push ebx
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push edi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
test eax, eax
jl 0x1b680
push str.Enum
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
test eax, eax
jl 0x1b680
lea eax, [ebp - 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
push 0xf003f
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0x240
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x1b680
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
push esi
mov word [ebp - 0x10], ax
push ebx
push dword [ebp - 0xc]
mov eax, esi
mov word [ebp - 0xe], ax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push edi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
test eax, eax
jl 0x1b701
push str.Security
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
test eax, eax
jl 0x1b701
lea eax, [ebp - 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
push 0xf003f
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0x240
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x1b701
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push dword [ebp - 0xc]
call fcn.000153f8
lea eax, [ebp - 0x30]
push eax
push 0xf003f
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0x240
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
pop edi
pop esi
pop ebx
test eax, eax
jl 0x1b758
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
leave
ret
Function at 0x1b760
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
call fcn.0001aaa0
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
call fcn.0001839e
push edi
call fcn.00018892
xor ebx, ebx
cmp dword [ebp - 4], ebx
je 0x1b916
push edi
call fcn.0001918a
test eax, eax
jl 0x1b916
cmp byte [0x224bc], bl
je 0x1b7ad
push 1
call fcn.00018a2c
push eax
call fcn.000193e8
push esi
call fcn.0001a79e
push 0x70
call fcn.000153de
mov esi, eax
cmp esi, ebx
je 0x1b86c
push 0x70
push ebx
push esi
call sub.ntoskrnl.exe_memset
mov dword [esi], 0x70
mov dword [esi + 4], 0x1acdc
mov dword [esi + 8], 0x1ad4e
mov dword [esi + 0xc], 0x1adc0
mov dword [esi + 0x10], 0x1ae32
mov dword [esi + 0x14], 0x1ae9c
mov dword [esi + 0x18], 0x1af06
mov dword [esi + 0x1c], 0x1af7c
mov dword [esi + 0x20], 0x1afec
mov dword [esi + 0x24], 0x1b056
mov dword [esi + 0x28], 0x1b0c0
mov dword [esi + 0x34], 0x1a6ec
mov dword [esi + 0x38], 0x1b162
mov dword [esi + 0x40], 0x1b1cc
mov dword [esi + 0x44], 0x1b23c
mov dword [esi + 0x48], 0x1b2a0
mov dword [esi + 0x4c], 0x1b310
mov dword [esi + 0x50], 0x1b376
mov dword [esi + 0x54], 0x1b3ee
mov dword [esi + 0x58], 0x1b466
mov dword [esi + 0x5c], 0x1b4ca
mov dword [esi + 0x60], 0x1b530
add esp, 0xc
mov dword [edi + 0x28], esi
mov eax, dword [ebp - 4]
push 0x224a8
push ebx
push ebx
push dword [eax + 0x2c]
push ebx
push 0xc
push edi
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jl 0x1b915
mov eax, dword [0x224a8]
mov esi, dword [eax + 0x28]
lea eax, [esi + 4]
push eax
push dword [ebp - 4]
mov dword [esi], edi
mov dword [esi + 8], ebx
mov dword [eax], ebx
push dword [0x224a8]
call dword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStackSafe]
push dword [0x224a8]
test eax, eax
jge 0x1b8c5
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov dword [0x224a8], ebx
jmp 0x1b915
call dword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov dword [esi + 8], eax
cmp eax, ebx
je 0x1b910
call fcn.00019666
cmp byte [0x224bc], bl
je 0x1b906
push 0x24780
push 0x24558
call fcn.00018c9c
test eax, eax
jl 0x1b8f9
call fcn.0001b5a6
jmp 0x1b906
push 4
call fcn.00018a2c
mov byte [0x224bc], bl
call fcn.00019ffe
call fcn.0001a518
call fcn.0001a79e
pop esi
pop edi
pop ebx
leave
ret 4