joyce8/EMBER2024-capa huggingface dataset:
Function at 0x164ea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x18
push 0x1bbc8
call fcn.00019ddc
xor edi, edi
mov dword [ebp - 0x20], edi
mov ecx, dword [ebp + 8]
cmp ecx, edi
je 0x165bb
mov edx, dword [ebp + 0xc]
cmp edx, edi
je 0x165bb
mov dword [ebp - 4], edi
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax + 0x7c], edi
je 0x165af
mov esi, dword [eax + 0x78]
add esi, ecx
je 0x165af
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x165af
mov eax, dword [esi + 0x20]
add eax, ecx
mov dword [ebp - 0x28], eax
mov edi, dword [esi + 0x1c]
add edi, ecx
mov ebx, dword [esi + 0x24]
add ebx, ecx
cmp edx, 0x1000
jae 0x16568
mov dword [ebp - 0x1c], edx
cmp edx, dword [ebp - 0x24]
jae 0x16564
movzx eax, word [ebx + edx*2]
mov edi, dword [edi + eax*4]
add edi, ecx
jmp 0x16598
xor edi, edi
jmp 0x16598
and dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x1c]
cmp edx, dword [esi + 0x18]
jae 0x165af
push 0x100
push dword [ebp + 0xc]
mov eax, dword [eax + edx*4]
add eax, ecx
push eax
call fcn.00018cd2
test al, al
je 0x1659d
mov eax, dword [ebp - 0x1c]
movzx eax, word [ebx + eax*2]
mov edi, dword [edi + eax*4]
add edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
jmp 0x165af
inc dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x28]
jmp 0x1656c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
jmp 0x165bd
xor eax, eax
call fcn.00019e21
ret 8

Function at 0x165ca
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x1c
push 0x1bbe8
call fcn.00019ddc
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov edi, dword [ebx + 0x3c]
add edi, ebx
cmp dword [edi + 0x7c], eax
je 0x166b6
push ebx
push edi
push dword [edi + 0x78]
call fcn.000163ae
mov esi, eax
test esi, esi
je 0x166b6
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x166b6
push ebx
push edi
push dword [esi + 0x20]
call fcn.000163ae
mov dword [ebp - 0x28], eax
push ebx
push edi
push dword [esi + 0x1c]
call fcn.000163ae
mov dword [ebp + 8], eax
push ebx
push edi
push dword [esi + 0x24]
call fcn.000163ae
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 0xc]
cmp ecx, 0x1000
jae 0x1665e
mov dword [ebp - 0x1c], ecx
cmp ecx, dword [ebp - 0x24]
jae 0x16657
movzx eax, word [eax + ecx*2]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax*4]
jmp 0x16659
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x166b6
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [esi + 0x18]
jae 0x166b6
push 0x100
push ecx
push ebx
push edi
mov ecx, dword [ebp - 0x28]
push dword [ecx + eax*4]
call fcn.000163ae
push eax
call fcn.00018cd2
test al, al
je 0x166a4
push ebx
push edi
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
movzx eax, word [eax + ecx*2]
mov ecx, dword [ebp + 8]
push dword [ecx + eax*4]
call fcn.000163ae
mov dword [ebp - 0x20], eax
sub dword [ebp - 0x20], ebx
jmp 0x166b6
inc dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1c]
jmp 0x16663
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00019e21
ret 8
Function at 0x16750
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x1bc08
call fcn.00019ddc
xor edx, edx
mov byte [ebp - 0x19], dl
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
cmp ecx, edx
je 0x16799
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x16799
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x16799
xor ecx, ecx
cmp dword [eax + 0xe8], edx
setne cl
mov byte [ebp - 0x19], cl
jmp 0x16799
mov dword [ebp - 4], 0xfffffffe
mov al, byte [ebp - 0x19]
call fcn.00019e21
ret 4

Function at 0x16802
Capabilities:
Find process by pid

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
xor bl, bl
cmp dword [0x1d94c], 0
jne 0x1682d
mov eax, dword [0x1d9e0]
add eax, 0x668
push eax
call fcn.000192c8
mov dword [0x1d94c], eax
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp dword [ebp + 8], eax
je 0x16849
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jl 0x16872
mov eax, dword [ebp - 4]
test eax, eax
jne 0x16856
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
push eax
call dword [0x1d94c]
mov ecx, dword [ebp - 4]
mov bl, al
neg bl
sbb bl, bl
inc bl
test ecx, ecx
je 0x16872
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
pop ebx
leave
ret 4

Function at 0x16976
Capabilities:
Find process by pid

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x169f8
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jl 0x169f8
lea eax, [ebp + 8]
push eax
mov eax, dword [sym.imp.ntoskrnl.exe_PsProcessType]
push 0
push dword [eax]
push 0x1f0fff
push 0
push 0x200
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
test eax, eax
jl 0x169ef
mov eax, dword [0x1d910]
test eax, eax
jne 0x169db
mov eax, dword [0x1d9e0]
add eax, 0x702
push eax
call fcn.000192c8
mov dword [0x1d910], eax
test eax, eax
je 0x169e6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
leave
ret 0xc
Function at 0x16a5a
Capabilities:
Find process by pid

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x16b1a
cmp dword [ebp + 0x10], esi
je 0x16b1a
cmp dword [ebp + 0x14], esi
je 0x16b1a
cmp dword [ebp + 0x18], esi
je 0x16b1a
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp dword [ebp + 8], eax
jne 0x16ab3
push dword [ebp + 0x18]
lea eax, [ebp + 0x10]
push dword [ebp + 0x14]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
jl 0x16b16
mov esi, dword [ebp + 0xc]
jmp 0x16b16
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jl 0x16b16
lea eax, [ebp - 4]
push eax
mov eax, dword [sym.imp.ntoskrnl.exe_PsProcessType]
push esi
push dword [eax]
push 8
push esi
push 0x200
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
test eax, eax
jl 0x16b0d
push dword [ebp + 0x18]
lea eax, [ebp + 0x10]
push dword [ebp + 0x14]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
test eax, eax
jl 0x16b04
mov esi, dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, esi
jmp 0x16b1c
xor eax, eax
pop esi
leave
ret 0x14

Function at 0x171ce
Capabilities:
Find process by pid

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor esi, esi
mov ebx, 0x64777355
push ebx
mov edi, 0x400
push edi
push esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 8], eax
cmp eax, esi
jne 0x1720d
xor eax, eax
jmp 0x172cf
xor esi, esi
inc dword [ebp - 0x14]
push edi
push esi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x100
push dword [ebp - 8]
call fcn.000168bc
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x172b6
push 8
mov dword [ebp - 4], esi
pop esi
cmp dword [ebp - 4], 0
jne 0x172ac
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jl 0x1729b
push dword [ebp - 0x1c]
push dword [ebp - 8]
push esi
call fcn.0001929c
test al, al
jne 0x17292
push esi
call fcn.00016802
test al, al
je 0x17292
cmp dword [ebp - 0x10], 0
mov dword [ebp - 4], esi
jne 0x1727f
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], 1
jmp 0x17292
cmp esi, dword [ebp - 0x10]
jne 0x17289
inc dword [ebp - 0xc]
jmp 0x17292
and dword [ebp - 4], 0
mov esi, 0x8004
mov ecx, dword [ebp - 0x18]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add esi, 4
cmp esi, 0x8000
jb 0x1723b
cmp dword [ebp - 4], 0
je 0x172b6
cmp dword [ebp - 0x14], 3
jb 0x1720b
push ebx
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 0xc]
sub eax, 3
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x172da
Capabilities:
Find process by pid

Disassembly:
push 0x10
push 0x1bc68
call fcn.00019ddc
mov dword [ebp - 0x20], 0xc000000d
xor esi, esi
mov dword [ebp - 0x1c], esi
cmp dword [0x1d944], esi
jne 0x1730f
mov eax, dword [0x1d9e0]
add eax, 0x743
push eax
call fcn.000192c8
mov dword [0x1d944], eax
cmp dword [ebp + 8], esi
je 0x1738a
cmp dword [ebp + 0xc], esi
je 0x1738a
cmp dword [ebp + 0x10], 0x10
jb 0x1738a
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp dword [ebp + 8], eax
je 0x1733b
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jl 0x1738a
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x1c]
cmp eax, esi
jne 0x1734b
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
push eax
call dword [0x1d944]
cmp eax, esi
je 0x17364
push eax
push 0x10
push dword [ebp + 0xc]
call fcn.00016ed4
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xfffffffe
jmp 0x1737d
mov ecx, dword [ebp - 0x1c]
cmp ecx, esi
je 0x1738a
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [ebp - 0x20], esi
je 0x1739c
cmp dword [ebp - 0x20], 0x80000005
je 0x1739c
xor eax, eax
jmp 0x1739f
xor eax, eax
inc eax
call fcn.00019e21
ret 0xc

Function at 0x1748a
Capabilities:
Find process by pid

Disassembly:
push 0x24
push 0x1bc88
call fcn.00019ddc
xor ebx, ebx
mov byte [ebp - 0x19], bl
cmp dword [ebp + 8], ebx
je 0x1756b
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x1756b
cmp dword [ebp + 0x10], ebx
je 0x1756b
mov esi, dword [ebp + 0x14]
cmp esi, ebx
je 0x1756b
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp dword [ebp + 8], eax
jne 0x174fe
mov dword [ebp - 4], ebx
push 1
push esi
push edi
call dword [sym.imp.ntoskrnl.exe_ProbeForRead]
push esi
push edi
push dword [ebp + 0x10]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov byte [ebp - 0x19], 1
jmp 0x174f5
mov dword [ebp - 4], 0xfffffffe
jmp 0x17566
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jl 0x17566
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0xc]
call fcn.00016c9c
test al, al
je 0x1755d
mov dword [ebp - 4], 1
push 1
push esi
push edi
call dword [sym.imp.ntoskrnl.exe_ProbeForRead]
push esi
push edi
push dword [ebp + 0x10]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov byte [ebp - 0x19], 1
jmp 0x1754a
mov dword [ebp - 4], 0xfffffffe
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0xc]
call fcn.00016d20
mov ecx, dword [ebp + 0xc]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, byte [ebp - 0x19]
jmp 0x1756d
xor al, al
call fcn.00019e21
ret 0x10
Function at 0x1757a
Capabilities:
Find process by pid

Disassembly:
push 0x24
push 0x1bcb0
call fcn.00019ddc
xor ebx, ebx
mov byte [ebp - 0x19], bl
cmp dword [ebp + 8], ebx
je 0x1765b
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x1765b
cmp dword [ebp + 0x10], ebx
je 0x1765b
mov esi, dword [ebp + 0x14]
cmp esi, ebx
je 0x1765b
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp dword [ebp + 8], eax
jne 0x175ee
mov dword [ebp - 4], ebx
push 1
push esi
push edi
call dword [sym.imp.ntoskrnl.exe_ProbeForWrite]
push esi
push dword [ebp + 0x10]
push edi
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov byte [ebp - 0x19], 1
jmp 0x175e5
mov dword [ebp - 4], 0xfffffffe
jmp 0x17656
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jl 0x17656
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0xc]
call fcn.00016c9c
test al, al
je 0x1764d
mov dword [ebp - 4], 1
push 1
push esi
push edi
call dword [sym.imp.ntoskrnl.exe_ProbeForWrite]
push esi
push dword [ebp + 0x10]
push edi
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov byte [ebp - 0x19], 1
jmp 0x1763a
mov dword [ebp - 4], 0xfffffffe
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0xc]
call fcn.00016d20
mov ecx, dword [ebp + 0xc]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, byte [ebp - 0x19]
jmp 0x1765d
xor al, al
call fcn.00019e21
ret 0x10

Function at 0x1766a
Capabilities:
Find process by pid

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push esi
cmp dword [ebp + 8], ebx
je 0x17774
cmp dword [ebp + 0xc], ebx
je 0x17774
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x17774
cmp dword [ebp + 0x14], ebx
je 0x17774
cmp dword [ebp + 0x18], ebx
je 0x17774
cmp dword [0x1d914], ebx
jne 0x176e2
mov eax, dword [0x1d9e0]
add eax, 0x75d
push eax
call fcn.000192c8
mov dword [0x1d914], eax
cmp eax, ebx
jne 0x176e2
mov eax, dword [0x1d9e0]
add eax, 0x75d
push eax
call fcn.00016f3c
mov dword [0x1d914], eax
cmp eax, ebx
je 0x17774
call dword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp dword [ebp + 8], eax
jne 0x1770d
push dword [ebp + 0x18]
lea eax, [ebp + 0x10]
push dword [ebp + 0x14]
mov dword [ebp + 0x10], esi
push eax
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
call dword [0x1d914]
test eax, eax
setge bl
jmp 0x17770
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jl 0x17770
lea eax, [ebp - 4]
push eax
mov eax, dword [sym.imp.ntoskrnl.exe_PsProcessType]
push ebx
push dword [eax]
push 8
push ebx
push 0x200
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
test eax, eax
jl 0x17767
push dword [ebp + 0x18]
lea eax, [ebp + 0x10]
push dword [ebp + 0x14]
mov dword [ebp + 0x10], esi
push eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 4]
call dword [0x1d914]
push dword [ebp - 4]
test eax, eax
setge bl
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, bl
jmp 0x17776
xor al, al
pop esi
pop ebx
leave
ret 0x14
Function at 0x186e2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x14]
xor edi, edi
push eax
xor ebx, ebx
mov dword [ebp - 4], edi
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
push 0x20019
lea eax, [ebp + 8]
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0x240
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x187b4
lea eax, [ebp - 4]
push eax
push edi
push edi
push 2
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000023
je 0x18763
cmp eax, 0x80000005
jne 0x187ab
cmp dword [ebp - 4], edi
jbe 0x187ab
mov esi, 0x64777355
push esi
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
cmp ebx, edi
je 0x187ab
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0xc]
push ebx
push 2
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
jl 0x187a1
mov eax, dword [ebx + 4]
cmp eax, dword [ebp + 0x10]
je 0x187ab
push esi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor ebx, ebx
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x187c2
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 8]
push eax
xor ebx, ebx
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
push 0x20006
lea eax, [ebp + 8]
push eax
mov dword [ebp - 0x28], 0x18
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 0x240
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x1883f
push dword [ebp + 0x18]
lea eax, [ebp - 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
push dword [ebp + 8]
test eax, eax
setge bl
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop esi
mov al, bl
pop ebx
leave
ret 0x14
Function at 0x19362
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, esi
jne 0x1937c
xor al, al
jmp 0x19476
push edi
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x1d9e0]
add eax, 0xb95
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push esi
push esi
push 1
push 1
push 7
lea eax, [ebp - 8]
mov dword [ebp - 0x20], eax
mov eax, 0x80
push eax
push esi
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x28]
push ecx
push eax
lea eax, [ebp + 8]
push eax
mov dword [ebp - 0x28], 0x18
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], 0x240
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jl 0x1946d
push 0x64777355
mov esi, 0x1000
push esi
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
test edi, edi
je 0x19462
push esi
push 0
push edi
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 9
push esi
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jl 0x19456
mov esi, dword [edi]
inc esi
push 0x64777355
inc esi
push esi
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebx + 4], eax
test eax, eax
je 0x19456
push esi
push 0
push eax
call sub.ntoskrnl.exe_memset
push dword [edi]
lea eax, [edi + 4]
push eax
push dword [ebx + 4]
call sub.ntoskrnl.exe_memcpy
mov ax, word [edi]
add esp, 0x18
mov word [ebx], ax
mov word [ebx + 2], si
push 0x64777355
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor esi, esi
xor eax, eax
cmp dword [ebx + 4], esi
pop edi
setne al
pop esi
pop ebx
leave
ret 4

Function at 0x1960a
Capabilities:
Find process by pid

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1d830]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
test esi, esi
je 0x196d5
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.000172da
test al, al
je 0x196d5
mov eax, dword [0x1d9e0]
push 0xb
add eax, 0xd11
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00018cd2
test al, al
je 0x196d5
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jl 0x196d5
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x18]
call fcn.00016c9c
test al, al
je 0x196ad
mov eax, dword [0x1d9e0]
add eax, 0xd1d
push eax
call fcn.00016478
test eax, eax
je 0x196a1
mov ecx, dword [0x1d9e0]
add ecx, 0xd3b
push ecx
push eax
call fcn.000164ea
mov edi, eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x18]
call fcn.00016d20
mov ecx, dword [ebp - 0x18]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test edi, edi
je 0x196d5
push 0x10
push 0x1b870
push edi
push esi
call fcn.00016220
test al, al
je 0x196d5
push 0x10
push edi
push esi
call fcn.00016976
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00019ba6
leave
ret 4
Function at 0x197a6
Capabilities:
Find process by pid

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov ebx, 0x64777355
push ebx
push 0x800
xor edi, edi
push edi
mov byte [ebp - 1], 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
cmp esi, edi
je 0x19845
push 0x200
push esi
call fcn.000168bc
mov dword [ebp - 0xc], eax
cmp eax, edi
jbe 0x1983d
test eax, eax
jbe 0x1983d
cmp byte [ebp - 1], 0
jne 0x1983d
lea eax, [ebp - 8]
push eax
push dword [esi + edi*4]
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jl 0x19837
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
call fcn.00016c9c
test al, al
je 0x1982e
mov eax, dword [0x1d9e0]
add eax, 0x1000
push eax
call fcn.00016478
test eax, eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
setne byte [ebp - 1]
call fcn.00016d20
mov ecx, dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
inc edi
cmp edi, dword [ebp - 0xc]
jb 0x197e5
push ebx
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4061b9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43189c], 0
push esi
jne 0x4061f0
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4061ca
mov dword [ecx*4 + 0x431898], eax
inc ecx
cmp ecx, 0x100
jl 0x4061c5
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406221
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431898]
xor eax, esi
inc ecx
dec edx
jne 0x406203
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x611567a8
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x32125641
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219