joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ddf21ac
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQueryInformationFile]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp edi, ebx
je 0x7ddf21fe
push 0x17
push 8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call esi
cmp eax, ebx
jge 0x7ddf21e8
push eax
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x7ddf229d
mov eax, dword [ebp - 8]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, 2
cmp dword [ebp - 4], ebx
setne cl
or eax, ecx
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x7ddf222c
push 0x18
push 0x28
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call esi
cmp eax, ebx
jl 0x7ddf21db
mov ecx, dword [ebp - 0x34]
mov eax, 0xff
cmp ecx, eax
jb 0x7ddf222a
mov dword [edi], eax
jmp 0x7ddf222c
mov dword [edi], ecx
mov edi, dword [ebp + 0x14]
cmp edi, ebx
jne 0x7ddf2238
cmp dword [ebp + 0x18], ebx
je 0x7ddf2285
push 0x19
push 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call esi
cmp eax, ebx
jl 0x7ddf21db
cmp edi, ebx
je 0x7ddf2256
mov eax, dword [ebp - 8]
mov dword [edi], eax
mov esi, dword [ebp + 0x18]
cmp esi, ebx
je 0x7ddf2285
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
neg ecx
push ebx
adc eax, ebx
push 0x2710
neg eax
push eax
push ecx
call dword [sym.imp.ntdll.dll_RtlExtendedLargeIntegerDivide]
cmp edx, ebx
je 0x7ddf2283
mov dword [esi], 0xfffffffe
jmp 0x7ddf2285
mov dword [esi], eax
cmp dword [ebp + 0x1c], ebx
je 0x7ddf229a
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 8]
call fcn.7ddf2089
jmp 0x7ddf229d
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x1c

Function at 0x7ddf22a9
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push 0x18
push 0x28
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jge 0x7ddf22d4
push eax
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x7ddf2322
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x7ddf22ee
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0xc]
and ecx, 3
shl ecx, 2
and edx, 1
or ecx, edx
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x7ddf22fa
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x7ddf2306
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x7ddf231f
mov edx, dword [ebp - 0x28]
mov eax, 0xff
cmp edx, eax
jb 0x7ddf231d
mov dword [ecx], eax
jmp 0x7ddf231f
mov dword [ecx], edx
xor eax, eax
inc eax
leave
ret 0x14
Function at 0x7ddf2358
Capabilities:
Read pipe
Write pipe

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
xor edx, edx
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], 2
mov dword [ebp - 8], edx
cmp dword [ebp + 0x20], edx
je 0x7ddf238a
cmp dword [ebp + 0x20], 0xffffffff
je 0x7ddf238a
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 2], 1
call fcn.7ddf232b
jmp 0x7ddf238d
mov byte [ebp - 2], dl
push ebx
push esi
push edi
push edx
mov ebx, 0x80
push ebx
push 3
push edx
mov edi, 0xc0000000
jmp 0x7ddf240f
cmp byte [ebp - 1], 0
jne 0x7ddf2458
call fcn.7dd711c7
cmp eax, 0xe7
jne 0x7ddf2458
mov eax, dword [ebp + 0x20]
sub eax, dword [ebp - 8]
push eax
push dword [ebp + 8]
call sub.API_MS_Win_Core_NamedPipe_L1_1_0.dll_WaitNamedPipeW
cmp byte [ebp - 2], 0
je 0x7ddf23ff
lea eax, [ebp - 0x14]
push eax
call fcn.7ddf232b
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
sbb ecx, dword [ebp - 0x18]
push 0
push 0x2710
push ecx
push eax
call sub.ntdll.dll__alldiv
mov dword [ebp - 8], eax
cmp eax, dword [ebp + 0x20]
jb 0x7ddf23ff
mov byte [ebp - 1], 1
xor eax, eax
cmp dword [ebp + 0x20], eax
jne 0x7ddf240a
mov byte [ebp - 1], 1
push eax
push ebx
push 3
push eax
push 3
push edi
push dword [ebp + 8]
call sub.API_MS_Win_Core_File_L1_1_0.dll_CreateFileW
mov esi, eax
cmp esi, 0xffffffff
je 0x7ddf23a1
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.7de1f6ce
mov edi, eax
cmp edi, 1
jne 0x7ddf244e
push ebx
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.7de1f6c3
mov edi, eax
push esi
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov eax, edi
jmp 0x7ddf245a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x1c

Function at 0x7ddf293e
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
mov esi, dword [ebp + 8]
cmp word [esi], 4
push edi
jae 0x7ddf29ce
cmp byte [esi + 2], 0x20
jae 0x7ddf29ce
xor ebx, ebx
cmp byte [esi + 3], bl
jne 0x7ddf29ce
lea eax, [ebp + 8]
push eax
push 0x108
lea eax, [ebp - 0x108]
push eax
push 0x37
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, ebx
jge 0x7ddf2991
mov edx, dword [ebp + 0xc]
mov ecx, 0xffff
push eax
mov word [edx], cx
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7ddf29e1
movzx ecx, byte [esi + 2]
xor eax, eax
inc eax
xor edx, edx
call sub.ntdll.dll__allshl
movzx edi, word [esi]
xor ecx, ecx
imul ecx, ecx, 0xc
cmp word [ebp + ecx - 0xfc], di
jne 0x7ddf29c2
mov ecx, dword [ebp + ecx - 0x100]
xor esi, esi
and ecx, eax
and esi, edx
or ecx, esi
jne 0x7ddf29ea
inc ebx
movzx ecx, bx
cmp ecx, dword [ebp - 0x108]
jbe 0x7ddf29a4
mov ecx, dword [ebp + 0xc]
mov eax, 0xffff
push 0x57
mov word [ecx], ax
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp + 0xc]
mov word [eax], bx
xor eax, eax
inc eax
jmp 0x7ddf29e3
Function at 0x7ddf2b0d
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push 0x35
push 2
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jge 0x7ddf2b37
push eax
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x7ddf2b44
mov eax, dword [ebp + 0xc]
mov cx, word [ebp + 8]
mov word [eax], cx
xor eax, eax
inc eax
leave
ret 8
Function at 0x7ddf35c2
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x7ddf35da
push 0x57
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
xor eax, eax
jmp 0x7ddf3607
push eax
push dword [eax]
lea eax, [ebp + 8]
push dword [ebp + 0xc]
push 2
push eax
push 0x6c
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
cmp eax, 0xc0000004
jne 0x7ddf35f8
add eax, 0x1f
test eax, eax
jge 0x7ddf3604
push eax
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7ddf35d6
xor eax, eax
inc eax
pop ebp
ret 0xc
Function at 0x7ddf3dcd
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov edi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
push 0
push 0x2c
lea eax, [ebp - 0x34]
push eax
push 0
call edi
mov ebx, eax
test ebx, ebx
jl 0x7ddf3ef4
movsx esi, byte [ebp - 0xc]
imul esi, esi, 0x30
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov ecx, dword fs:[0x18]
push esi
push eax
mov eax, dword [ecx + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 4], eax
test eax, eax
jne 0x7ddf3e29
mov ebx, 0xc0000017
jmp 0x7ddf3ef4
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push 8
call edi
mov ebx, eax
test ebx, ebx
jl 0x7ddf3ed2
cmp dword [ebp - 8], esi
je 0x7ddf3e4c
mov ebx, 0xc00000e5
jmp 0x7ddf3ed2
mov edi, dword [ebp + 8]
test edi, edi
je 0x7ddf3e76
movsx ecx, byte [ebp - 0xc]
xor edx, edx
xor esi, esi
test ecx, ecx
jle 0x7ddf3e71
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
add edx, ebx
mov ebx, dword [eax + 4]
adc esi, ebx
add eax, 0x30
dec ecx
jne 0x7ddf3e62
mov dword [edi], edx
mov dword [edi + 4], esi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x7ddf3ea3
movsx ecx, byte [ebp - 0xc]
xor edx, edx
xor esi, esi
test ecx, ecx
jle 0x7ddf3e9e
mov eax, dword [ebp - 4]
add eax, 8
mov ebx, dword [eax]
add edx, ebx
mov ebx, dword [eax + 4]
adc esi, ebx
add eax, 0x30
dec ecx
jne 0x7ddf3e8f
mov dword [edi], edx
mov dword [edi + 4], esi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x7ddf3ed0
movsx ecx, byte [ebp - 0xc]
xor edx, edx
xor esi, esi
test ecx, ecx
jle 0x7ddf3ecb
mov eax, dword [ebp - 4]
add eax, 0x10
mov ebx, dword [eax]
add edx, ebx
mov ebx, dword [eax + 4]
adc esi, ebx
add eax, 0x30
dec ecx
jne 0x7ddf3ebc
mov dword [edi], edx
mov dword [edi + 4], esi
xor ebx, ebx
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
push dword [ebp - 4]
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test ebx, ebx
jge 0x7ddf3efe
push ebx
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
jmp 0x7ddf3f01
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7ddf4b1b
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0x20]
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_CreateRemoteThreadEx
pop ebp
ret 0x1c

Function at 0x7ddf4b7f
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.7de163f3

Function at 0x7ddf5b7b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
call sym.KERNEL32.dll_RegKrnGetGlobalState
mov eax, dword [eax + 0x24]
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [ebp - 0xc], eax
push 0x7ddf5ca0
lea eax, [ebp - 0x14]
push eax
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x34]
push eax
xor ebx, ebx
push 1
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x34], 0x18
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], 0x40
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x7ddf5c65
mov eax, dword fs:[0x18]
push edi
push 0x14
pop ecx
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
cmp edi, ebx
je 0x7ddf5c5b
push 0x7ddf5c6c
lea eax, [ebp - 0x1c]
push eax
call esi
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x1c]
push edi
push 2
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
jl 0x7ddf5c24
mov esi, dword [edi + 0xc]
jmp 0x7ddf5c27
mov esi, dword [ebp - 0xc]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test dword [ebp + 8], 0x20000
je 0x7ddf5c47
and esi, 0xfffffffd
test dword [ebp + 8], 0x10000
je 0x7ddf5c53
and esi, 0xfffffffe
call sym.KERNEL32.dll_RegKrnGetGlobalState
mov dword [eax + 0x24], esi
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x7ddf5d6e
Capabilities:
Suspend thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtSuspendThread]
test eax, eax
jge 0x7ddf5d8f
push eax
call sym.KERNEL32.dll_BaseSetLastNTError
or eax, 0xffffffff
jmp 0x7ddf5d92
mov eax, dword [ebp + 8]
pop ebp
ret 4
Function at 0x7ddf5fd1
Capabilities:
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 4], esi
cmp edi, esi
je 0x7ddf6063
cmp dword [edi], 0x10
jne 0x7ddf6063
push 4
push esi
xor ebx, ebx
inc ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push esi
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp + 0xc], esi
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
cmp eax, esi
jge 0x7ddf6020
push eax
jmp 0x7ddf6068
mov eax, dword [ebp + 0xc]
cmp dword [eax], esi
jne 0x7ddf6044
mov eax, dword [edi]
sub eax, 4
push eax
push esi
add edi, 4
push edi
call sub.ntdll.dll_memset
add esp, 0xc
push 0x12
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7ddf6053
mov esi, dword [eax + 0x10]
add esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], ebx
mov dword [eax + 0x20], ebx
push dword [ebp + 0xc]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, dword [ebp - 4]
jmp 0x7ddf606f
push 0xc0000004
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x7ddf607b
Capabilities:
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp edi, esi
je 0x7ddf60fc
cmp dword [edi], 0x10
jne 0x7ddf60fc
push 4
push esi
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp + 0xc], esi
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
cmp eax, esi
jge 0x7ddf60c4
push eax
jmp 0x7ddf6101
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x20]
cmp ecx, dword [eax]
jae 0x7ddf60e5
mov esi, ecx
shl esi, 4
add esi, dword [eax + 0x10]
add esi, eax
inc ecx
mov dword [eax + 0x20], ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
inc esi
jmp 0x7ddf60ed
push 0x12
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
push dword [ebp + 0xc]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, esi
jmp 0x7ddf6108
push 0xc0000004
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0x7ddf654b
Capabilities:
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 4], esi
cmp edi, esi
je 0x7ddf65df
cmp dword [edi], 0x1c
jne 0x7ddf65df
push 4
push esi
xor ebx, ebx
inc ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push esi
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp + 0xc], esi
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
cmp eax, esi
jge 0x7ddf659a
push eax
jmp 0x7ddf65e4
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0xc], esi
jne 0x7ddf65bf
mov eax, dword [edi]
sub eax, 4
push eax
push esi
add edi, 4
push edi
call sub.ntdll.dll_memset
add esp, 0xc
push 0x12
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7ddf65cf
mov esi, dword [eax + 0x1c]
push 7
add esi, eax
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [eax + 0x2c], ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, dword [ebp - 4]
jmp 0x7ddf65eb
push 0xc0000004
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x7ddf65f7
Capabilities:
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp edi, esi
je 0x7ddf667a
cmp dword [edi], 0x1c
jne 0x7ddf667a
push 4
push esi
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp + 0xc], esi
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
cmp eax, esi
jge 0x7ddf6640
push eax
jmp 0x7ddf667f
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x2c]
cmp ecx, dword [eax + 0xc]
jae 0x7ddf6663
mov esi, ecx
imul esi, esi, 0x1c
add esi, dword [eax + 0x1c]
push 7
add esi, eax
inc ecx
mov dword [eax + 0x2c], ecx
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
inc esi
jmp 0x7ddf666b
push 0x12
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
push dword [ebp + 0xc]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, esi
jmp 0x7ddf6686
push 0xc0000004
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0x7ddf6ff0
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, 0x7de40d20
push 0x106
push esi
call fcn.7dd77902
test eax, eax
jge 0x7ddf7015
push 0xfffffffffffffff9
pop eax
jmp 0x7ddf70bb
push ebx
push edi
push 0
mov edi, 0x80
push edi
push dword [ebp + 0x14]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call sub.API_MS_Win_Core_File_L1_1_0.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x7ddf706c
call fcn.7dd711c7
cmp eax, 2
jne 0x7ddf7067
push 0x106
push esi
call fcn.7de1ffec
push 0
push edi
push dword [ebp + 0x14]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call sub.API_MS_Win_Core_File_L1_1_0.dll_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x7ddf706c
or eax, 0xffffffff
jmp 0x7ddf70b9
cmp dword [ebp + 0x14], 3
push ebx
je 0x7ddf7089
call fcn.7ddf685a
mov esi, eax
cmp esi, 0xfffffffb
jne 0x7ddf7085
push ebx
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov eax, esi
jmp 0x7ddf70b9
call sym.KERNEL32.dll_LZInit
mov edi, eax
test edi, edi
jge 0x7ddf709a
push ebx
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
cmp dword [ebp + 0x18], 0
je 0x7ddf70b7
push esi
push 0x104
push dword [ebp + 0x18]
call fcn.7dd77902
test eax, eax
jge 0x7ddf70b7
push 0xfffffffffffffff9
pop eax
jmp 0x7ddf70b9
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
ret 0x14
Function at 0x7ddf9561
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xf4
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, dword [ebp + 0xc]
and dword [ebp - 0xb4], 0
push 0xc
push 0x10010008
mov dword [ebp - 0xb8], eax
push 0
lea eax, [ebp - 0xf4]
push eax
call dword [sym.imp.ntdll.dll_CsrClientCallServer]
test eax, eax
jl 0x7ddf95d1
cmp dword [ebp - 0xb4], 0
je 0x7ddf95d1
push dword [ebp - 0xb4]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.7dd71442
leave
ret 8

Function at 0x7ddf9b45
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xfc
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0
push 8
lea eax, [ebp - 0xfc]
push eax
push 0
push esi
call dword [sym.imp.ntdll.dll_NtQueryEvent]
test eax, eax
jge 0x7ddf9b7e
xor eax, eax
jmp 0x7ddf9bbe
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x10]
push 0xc
push 0x1001000a
mov dword [ebp - 0xbc], eax
push 0
lea eax, [ebp - 0xf4]
push eax
mov dword [ebp - 0xb8], esi
call dword [sym.imp.ntdll.dll_CsrClientCallServer]
test eax, eax
jl 0x7ddf9b7a
mov eax, dword [ebp - 0xb4]
mov dword [edi], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.7dd71442
leave
ret 8
Function at 0x7ddfbd78
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x7ddfbd98
push 0x57
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
or eax, 0xffffffff
jmp 0x7ddfbf17
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
cmp eax, edi
jge 0x7ddfbdb1
push eax
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x7ddfbd90
movzx eax, word [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
shr eax, 1
cmp word [ecx + eax*2 - 2], 0x5c
je 0x7ddfbdc9
push 0xc0000033
jmp 0x7ddfbdaa
push dword [ebp + 8]
call fcn.7dd74298
cmp eax, 4
je 0x7ddfbd88
push 0x7ddfbf20
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
movzx eax, word [ebp - 0x18]
movzx ecx, word [ebp - 0x10]
lea eax, [eax + ecx + 2]
cmp eax, 0xffff
ja 0x7ddfbdc2
mov word [ebp - 6], ax
xor eax, eax
push esi
mov word [ebp - 8], ax
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov ecx, dword fs:[0x18]
movzx edx, word [ebp - 6]
mov eax, dword [eax + 0x2c]
mov esi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push edx
push eax
mov eax, dword [ecx + 0x30]
push dword [eax + 0x18]
call esi
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x7ddfbe3d
push 8
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
or eax, 0xffffffff
jmp 0x7ddfbf16
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlCopyUnicodeString]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
movzx eax, word [ebp - 8]
mov edx, dword [ebp - 4]
push edi
push 0x2020000
push 3
push edi
push 1
shr eax, 1
xor ecx, ecx
push 0x80000000
mov word [edx + eax*2], cx
push dword [ebp - 4]
call sub.API_MS_Win_Core_File_L1_1_0.dll_CreateFileW
push dword [ebp - 4]
mov ebx, dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp + 8], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call ebx
or eax, 0xffffffff
cmp dword [ebp + 8], eax
je 0x7ddfbf15
call sub.KERNELBASE.dll_KernelBaseGetGlobalData
mov eax, dword [eax + 0x2c]
mov ecx, dword fs:[0x18]
push 0x18
push eax
mov eax, dword [ecx + 0x30]
push dword [eax + 0x18]
call esi
mov esi, eax
cmp esi, edi
jne 0x7ddfbed6
push dword [ebp + 8]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
push 8
call dword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x7ddfbf0e
push 6
pop ecx
push 1
push dword [ebp + 0x10]
xor eax, eax
push dword [ebp + 0xc]
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push esi
mov dword [esi], eax
call fcn.7ddfb9c1
test eax, eax
jne 0x7ddfbf13
push dword [esi]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call ebx
or eax, 0xffffffff
jmp 0x7ddfbf15
mov eax, esi
pop ebx
pop esi
pop edi
leave
ret 0xc