joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1027109f
Capabilities:
Terminate process

Disassembly:
movaps xmm0, xmmword [ebp - 0x1bb0]
shl dl, 0xba
movaps xmmword [ebp - 0x26d0], xmm0
adc al, ch
mov edx, dword [ebp - 0x20]
xor cl, ah
movups xmm0, xmmword [edx + 0x50]
btr cx, dx
movaps xmmword [ebp - 0x26c0], xmm0
bsf eax, edi
movaps xmm0, xmmword [ebp - 0x26c0]
rcr cl, cl
sbb eax, 0x4f98769a
xorps xmm0, xmmword [ebp - 0x26d0]
movaps xmmword [ebp - 0x26e0], xmm0
shr ah, cl
bts cx, sp
and eax, esp
movaps xmm0, xmmword [ebp - 0x26e0]
or ah, al
mov eax, dword [ebp - 0x20]
cmovle ecx, edx
ror ecx, 0x9a
bts ecx, eax
add eax, 0x50
bts cx, sp
movups xmmword [eax], xmm0
cmovae ecx, ebx
test bp, 0x9b92
adc cx, sp
mov ecx, 1
cmp eax, esp
test ecx, ebp
cmc
test ecx, ecx
jmp 0x10011ac4
je 0x10255f2d
jmp 0x10255fa5
push ecx
mov dword [esp + 0x10], 0xff344fa0
lea esp, [esp + 0x10]
call fcn.10268cd3
movaps xmm0, xmmword [ebp - 0x1bc0]
movaps xmmword [ebp - 0x26a0], xmm0
bts eax, ebx
mov edx, dword [ebp - 0x20]
cmp sp, 0xb2c
cmovge cx, dx
cbw
movups xmm0, xmmword [edx + 0x40]
movaps xmmword [ebp - 0x2690], xmm0
stc
sar cx, cl
rol cl, cl
movaps xmm0, xmmword [ebp - 0x2690]
adc eax, 0x8e3f1b10
clc
rol ecx, 0xa3
xorps xmm0, xmmword [ebp - 0x26a0]
setl ah
or ax, 0x2395
movaps xmmword [ebp - 0x26b0], xmm0
movaps xmm0, xmmword [ebp - 0x26b0]
mov eax, dword [ebp - 0x20]
rcl ecx, 0x9f
ror cx, 0x9d
shl cl, 0x8b
lea eax, [eax + 0x40]
adc cx, si
rcl cx, 0x97
sbb ecx, 0xfca1f89f
movups xmmword [eax], xmm0
btc cx, cx
mov ecx, 1
stc
clc
test ecx, ecx
jmp 0x1026baef

Function at 0x102716b8
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports
Terminate process

Disassembly:
add edx, ecx
push eax
push eax
mov dword [eax + edi - 0xbdc83de], edx
call fcn.102a3d7e
add byte [eax], al
mov dword [esp], 0x72284da0
call fcn.10268cd3
enter 0x75a7, 0xc
fstp xword [edx + 0x6191abbb]
fidivr dword [edx + 0x6191bbcb]
fidivr dword [edx]
cmpsd dword [esi], dword es:[edi]
xchg dword [ecx - 0x1af5259f], edx
jl 0x10271748
mov dh, 0x1a
jae 0x102716a6
into
or edi, dword [esi]
xchg esp, eax
cmp cl, byte [eax - 0x24f36a1b]
and dl, ch
sbb eax, 0x22a72446
adc byte [edx + ebx*2 + 0x1022a734], dl
mov esp, 0x22a73854
adc byte [ecx], dl
pushfd
pop ss
into
test byte [ecx - 0x977b], 0xff
adc al, 4
ror dl, 0xe3
mov edx, eax
mov eax, ecx
sal ecx, cl
dec cx
mov ecx, dword [edi + eax*8 - 0x20a65488]
lea eax, [eax*4 - 0x476a662]
jbe 0x1006daab
Function at 0x10297b44
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports
Terminate process

Disassembly:
xor dl, bl
xor dl, 0x9e
shr eax, 0x49
mov ecx, dword [esp + eax*4 - 0x1ffffe0]
adc cx, 0x5035
adc dl, 0x82
not dl
xadd cl, ch
add cx, 0xc3aa
shr word [esp + eax - 0x7ffff3], 0x62
neg dl
not dl
pop eax
dec byte [esp + 3]
xor bl, dl
movsx eax, cl
not cl
sal al, 6
mov word [edi + eax*2 - 6], dx
or byte [esp + eax], 0x8e
movzx edx, ax
or al, byte [eax + esi - 0xa]
lea esi, [edx + esi - 0xa]
ror dl, 0x61
inc word [esp + edx*8 + 2]
xor al, bl
xor al, 0x9e
xor edx, ecx
sbb edx, edx
jge 0x102aa5d2
je 0x10297bc0
mov edx, dword [ebp - 0x24]
cbw
add edx, 1
bsf ax, sp
mov dword [ebp - 0x24], edx
mov eax, dword [0x1013449c]
mov dword [ebp - 0x10], eax
cmc
jmp 0x1029b23a
mov dword [ebp - 0x20], 1
cmp dl, 0x26
adc al, 0x82
shl dword [esp + edx], 0xae
shl dword [esp + edx], 0x17
not al
neg al
rol byte [esp + edx + 1], 0xe6
ror byte [esp + edx], 2
not al
xor bl, al
xor cx, cx
mov word [edx + edi - 8], ax
bswap edx
jb 0x102653ba
setae dl
lea edi, [edi + edx*2 - 0xa]
rol ecx, 0x67
pop ecx
jp fcn.1024e768

Function at 0x102a3f2a
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov dword [esp + 8], 0x88d92da0
lea esp, [esp + 8]
call fcn.10268cd3

Function at 0x102aa60e
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov edi, dword [esp + edx*4 + 0x6d2a5cd8]
call fcn.1029df58
jle fcn.1029df58
neg edx
mov edx, dword [esp + 0xc]
jo 0x1023354e
call fcn.1009740c

Function at 0x102aef0e
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov dword [esp + 8], 0x11372aa0
lea esp, [esp + 8]
call fcn.10268cd3

Function at 0x102afed8
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov dword [esp + 4], 0x47da2ca0
lea esp, [esp + 4]
call fcn.10268cd3
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x6fbeef
Capabilities:
Encode data using xor

Disassembly:
cmp edi, ebx
pushfd
mov byte [esp + 4], ch
lea esp, [esp + 8]
ja 0x5c5434
test dl, ah
push 0xf8f111b0
sub ebx, edi
mov al, ch
add esp, 4
add ebx, esp
pushal
push ebx
jmp 0x590517
Function at 0x16fc0
Capabilities:
Access pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x289c0
push 0x28910
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 0x14]
mov esi, ecx
push esi
call dword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov edi, eax
test edi, edi
jne 0x17010
mov eax, 0xc000000d
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0xc]
push eax
push esi
call fcn.000183c0
test eax, eax
je 0x170c9
cmp eax, esi
jbe 0x170c9
mov ecx, dword [edi + 0x50]
lea edx, [ecx + esi]
cmp eax, edx
jae 0x170c9
cmp byte [eax], 0xb8
jne 0x170c9
mov ecx, dword [eax + 1]
cmp ecx, 0x10000000
ja 0x170c9
cmp ecx, 0xffffffff
je 0x170c9
test ebx, ebx
je 0x17057
mov dword [ebx], ecx
mov dword [ebp - 4], 0
mov eax, dword [0x2a608]
sub eax, dword [ebp + 8]
add eax, esi
cmp eax, esi
jbe 0x170aa
cmp eax, edx
jae 0x170aa
mov eax, dword [eax + ecx*4]
sub eax, dword [edi + 0x34]
add eax, esi
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
cmp eax, esi
jbe 0x170aa
cmp eax, edx
jae 0x170aa
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebp - 4], 0xffffffff
mov eax, 0xc000003e
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0xc0000034
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x179f0
Capabilities:
Access pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x28a90
push 0x28910
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor esi, esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], esi
push 0x33
push esi
lea eax, [ebp - 0x64]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov dword [ebp - 4], esi
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov ebx, eax
mov dword [ebp - 0x2c], ebx
cmp ebx, esi
je 0x17b74
mov edi, dword [ebx + 0x34]
mov dword [ebp - 0x28], edi
mov edx, dword [ebx + 0x50]
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
lea esi, [ebp - 0x64]
call fcn.000189c0
add esp, 4
mov esi, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
jmp 0x17a9f
test esi, esi
jne 0x17abb
mov eax, 0xc000003e
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 0x20]
add eax, esi
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp + 0x14]
jb 0x17ade
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor dl, dl
mov cl, byte [ebp - 0x4d]
test byte [ebp - 0x5e], 4
jne 0x17aee
cmp cl, 0xa1
jne 0x17b0e
mov eax, dword [ebp - 0x41]
cmp eax, edi
jbe 0x17b0e
mov esi, dword [ebp - 0x24]
add esi, edi
cmp eax, esi
mov esi, dword [ebp - 0x1c]
jae 0x17b0e
mov edx, dword [ebp + 8]
sub edx, dword [ebx + 0x34]
add eax, edx
mov dword [ebp - 0x41], eax
mov dl, 1
cmp cl, 0x3d
je 0x17b2c
cmp cl, 0x81
je 0x17b2c
cmp cl, 0xb8
jb 0x17b22
cmp cl, 0xbf
jbe 0x17b2c
cmp cl, 0xc7
je 0x17b2c
cmp cl, 0x68
jne 0x17b49
mov eax, dword [ebp - 0x39]
cmp eax, edi
jbe 0x17b49
mov ecx, dword [ebp - 0x24]
add ecx, edi
cmp eax, ecx
jae 0x17b49
mov edx, dword [ebp + 8]
sub edx, dword [ebx + 0x34]
add eax, edx
mov dword [ebp - 0x39], eax
jmp 0x17b4d
test dl, dl
je 0x17b63
lea ecx, [ebp - 0x64]
mov edi, dword [ebp + 0xc]
call fcn.00019490
cmp esi, eax
jne 0x17aa3
mov edi, dword [ebp - 0x28]
add dword [ebp + 0xc], esi
jmp 0x17a60
mov dword [ebp - 4], 0xffffffff
mov eax, 0xc000000d
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1c350
Capabilities:
Parse pe header

Disassembly:
cmp byte [0x2a688], 0
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
mov esi, eax
jne 0x1c371
mov edi, 0xc00000a3
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 8
cmp ebx, 0x138
jae 0x1c387
mov edi, 0xc000000d
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 8
test esi, esi
je 0x1c379
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1c379
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x1c379
mov ecx, 0x14c
cmp word [eax + 4], cx
jne 0x1c379
cmp word [eax + 0x5c], 1
jne 0x1c379
push ebx
push esi
call fcn.00026f40
test al, al
je 0x1c42b
push esi
mov eax, ebx
xor edi, edi
call fcn.00022ac0
mov ebx, eax
test ebx, ebx
je 0x1c4ca
push ebx
call fcn.00022be0
test al, al
je 0x1c4ca
push ebx
call fcn.00022f20
test al, al
je 0x1c4ca
mov edx, 0x5a4d
cmp word [ebx], dx
jne 0x1c4ca
mov ebp, dword [ebx + 0x3c]
add ebp, ebx
cmp dword [ebp], 0x4550
jne 0x1c4ca
push 0x64727665
push 0x34
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
test esi, esi
jne 0x1c439
mov edi, 0xc000009a
jmp 0x1c49e
mov edi, 0xc0000022
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0x34
push 0
push esi
call sub.ntoskrnl.exe_memset
mov edi, dword [esp + 0x24]
add esp, 0xc
call fcn.0001c140
mov edi, eax
test edi, edi
jl 0x1c49e
mov dword [esi + 0x28], ebx
mov eax, dword [ebp + 0x28]
add eax, ebx
mov dword [esi + 0x24], eax
mov ecx, dword [0x2a68c]
mov dword [esi + 0x30], ecx
mov eax, dword [0x29910]
mov dword [0x2a68c], esi
test eax, eax
jne 0x1c48d
call fcn.0001c0a0
mov eax, dword [0x29910]
test eax, eax
jne 0x1c48d
mov edi, 0xc0000001
jmp 0x1c49e
push 0x1c2d0
lea edx, [esi + 0xc]
push edx
call eax
mov edi, eax
test edi, edi
jge 0x1c4ca
test esi, esi
je 0x1c4be
cmp dword [0x2a68c], esi
jne 0x1c4b2
mov eax, dword [esi + 0x30]
mov dword [0x2a68c], eax
mov dword [esi + 0x28], 0
call fcn.0001c220
push 0x70656472
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x1f2c0
Capabilities:
Find process by pid

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x289a0
push 0x28910
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov edi, edx
mov dword [ebp - 4], 0
test edi, edi
jne 0x1f2fd
mov ebx, 0xc000000d
jmp 0x1f43f
lea eax, [ebp - 0x20]
push eax
push ecx
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jl 0x1f442
lea edx, [ebp - 0x24]
push edx
push 0
push 0
push 0x1fffff
push 0
push 0x200
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jl 0x1f41e
push 0x62746c70
push 0x1000
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
test esi, esi
jne 0x1f378
mov ebx, 0xc000009a
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1f442
lea edx, [ebp - 0x2c]
push edx
push 0x1000
push esi
push 0x1b
mov eax, dword [ebp - 0x24]
push eax
call sub.ntoskrnl.exe_ZwQueryInformationProcess
mov ebx, eax
mov dword [ebp - 0x1c], ebx
push 0x62746c70
test ebx, ebx
jge 0x1f3ba
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1f442
movzx edx, word [esi]
add edx, 2
mov word [edi + 2], dx
mov ax, word [esi]
mov word [edi], ax
movzx ecx, dx
push ecx
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [edi + 4], eax
test eax, eax
jne 0x1f3e7
mov ebx, 0xc000009a
mov dword [ebp - 0x1c], ebx
jmp 0x1f408
movzx edx, word [edi + 2]
push edx
push 0
push eax
call sub.ntoskrnl.exe_memset
movzx eax, word [edi]
push eax
mov ecx, dword [esi + 4]
push ecx
mov edx, dword [edi + 4]
push edx
call sub.ntoskrnl.exe_memcpy
add esp, 0x18
push 0x62746c70
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1f442
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x241a0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push esi
xor eax, eax
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov edi, 0x1000
lea esp, [esp]
push 0x73726973
push edi
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
test esi, esi
je 0x24214
push edi
push 0
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push edi
push esi
push 5
call dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov ebx, eax
test ebx, ebx
jge 0x24220
mov edi, dword [esp + 0x10]
push 0x73726973
push esi
add edi, 0x20
call ebp
cmp ebx, 0xc0000004
je 0x241c0
push 0x73726973
push esi
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
mov edx, dword [esp + 0x1c]
mov eax, esi
cmp dword [esi + 0x44], edx
je 0x2423d
jmp 0x24230
mov ecx, dword [eax]
test ecx, ecx
je 0x24257
add eax, ecx
cmp dword [eax + 0x44], edx
jne 0x24230
mov edi, dword [eax + 0xdc]
push 0x73726973
push esi
call ebp
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov edi, dword [esp + 0x14]
push 0x73726973
push esi
call ebp
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4

Function at 0x24270
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push esi
xor eax, eax
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov edi, 0x1000
lea esp, [esp]
push 0x73726973
push edi
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
test esi, esi
je 0x242d8
lea eax, [esp + 0x10]
push eax
push edi
push esi
push 5
call dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov ebx, eax
test ebx, ebx
jge 0x242e4
mov edi, dword [esp + 0x10]
push 0x73726973
push esi
add edi, 0x20
call ebp
cmp ebx, 0xc0000004
je 0x24290
push 0x73726973
push esi
call ebp
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov edx, dword [esp + 0x1c]
mov eax, esi
cmp dword [esi + 0x44], edx
je 0x242fd
nop
mov ecx, dword [eax]
test ecx, ecx
je 0x24314
add eax, ecx
cmp dword [eax + 0x44], edx
jne 0x242f0
mov edi, dword [eax + 0x48]
push 0x73726973
push esi
call ebp
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov edi, dword [esp + 0x14]
push 0x73726973
push esi
call ebp
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x24820
Capabilities:
Create thread

Disassembly:
sub esp, 0x24
push esi
push edi
push eax
xor esi, esi
push ecx
push esi
push esi
lea edx, [esp + 0x20]
push edx
push 0x1fffff
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x18
mov dword [esp + 0x30], esi
mov dword [esp + 0x38], 0x200
mov dword [esp + 0x34], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
cmp eax, esi
jl 0x248a7
mov edx, dword [sym.imp.ntoskrnl.exe_PsThreadType]
mov eax, dword [edx]
push esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push esi
push eax
push 0x1fffff
push ecx
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov edx, dword [esp + 8]
push edx
mov edi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp edi, esi
jl 0x248a7
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x24
ret
pop edi
xor eax, eax
pop esi
add esp, 0x24
ret
Function at 0x24c80
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x28c40
push 0x28910
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], 0x1000
mov dword [ebp - 0x44], esi
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x74], al
push 0x2f
push esi
lea eax, [ebp - 0x73]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
cmp dword [0x2aa64], esi
jne 0x24d05
call fcn.00024bd0
cmp dword [0x2aa64], esi
jne 0x24d05
mov eax, 0xc0000001
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov eax, dword [0x299e0]
cmp eax, esi
jne 0x24d36
call fcn.0001c0a0
mov eax, dword [0x299e0]
cmp eax, esi
jne 0x24d36
mov dword [ebp - 0x24], 0xc0000001
jmp 0x24e4c
push 0x40
push 0x3000
lea ecx, [ebp - 0x28]
push ecx
push esi
lea edx, [ebp - 0x20]
push edx
push 0xffffffffffffffff
call eax
mov dword [ebp - 0x24], eax
cmp eax, esi
jl 0x24e4c
mov dword [ebp - 0x24], 0xc0000001
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x20]
mov byte [eax + 0x14], 0
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp + 0x10]
mov dword [ecx], edx
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x10], esi
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp + 0x14]
mov dword [ecx + 8], edx
mov ebx, dword [ebp - 0x20]
add ebx, 0x15
mov ecx, 0xfa
mov esi, 0x24c60
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x2aa64]
mov edi, dword [ebp + 0xc]
mov byte [eax + edi + 0x16], 1
mov esi, dword [ebp - 0x20]
mov eax, dword [0x29944]
test eax, eax
jne 0x24db8
call fcn.0001c0a0
mov eax, dword [0x29944]
test eax, eax
je 0x24dcc
push esi
push 1
push ebx
push 0
push 0x24c50
push 0
push edi
lea ecx, [ebp - 0x74]
push ecx
call eax
mov eax, dword [0x29978]
test eax, eax
jne 0x24de3
call fcn.0001c0a0
mov eax, dword [0x29978]
test eax, eax
je 0x24e43
push 0
push 0
push 0
lea edx, [ebp - 0x74]
push edx
call eax
test al, al
je 0x24e43
mov eax, dword [ebp - 0x20]
cmp byte [eax + 0x14], 0
jne 0x24e08
mov eax, 0xc8
call fcn.0001b250
jmp 0x24df3
mov eax, 0x320
call fcn.0001b250
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x24e21
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x10]
mov dword [eax], edx
mov dword [ebp - 0x24], 0
jmp 0x24e43
mov dword [ebp - 4], 0xffffffff
xor esi, esi
cmp dword [ebp - 0x20], esi
je 0x24e7c
mov dword [ebp - 0x28], esi
mov eax, dword [0x29a14]
cmp eax, esi
jne 0x24e6b
call fcn.0001c0a0
mov eax, dword [0x29a14]
cmp eax, esi
je 0x24e7c
push 0x8000
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0xffffffffffffffff
call eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x265b0
Capabilities:
Create device object

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x12280
lea eax, [esp + 8]
push eax
call esi
mov edx, dword [esp + 0x18]
push 0x2ab14
push 0
push 0x100
push 0x9c40
lea ecx, [esp + 0x14]
push ecx
push 0
push edx
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jl 0x26627
push 0x122e0
lea eax, [esp + 0x10]
push eax
call esi
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov esi, eax
test esi, esi
jge 0x26625
mov eax, dword [0x2ab14]
push eax
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov dword [0x2ab14], 0
mov eax, esi
pop esi
add esp, 0x10
ret 4