joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ea2e
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x412a8b
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x413b9c
push 1
xor ebx, ebx
push ebx
push 0x413c4c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x412b5c
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x413c3c
push eax
call dword [ecx]
test eax, eax
jl 0x412b53
cmp byte [ebp + 8], bl
je 0x412ade
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 2
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x18], ebx
je 0x412afb
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
cmp dword [ebp + 0x1c], ebx
jne 0x412b0d
push 0x413744
jmp 0x412b10
push dword [ebp + 0x1c]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], ebx
je 0x412b25
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x412b36
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x412b4a
mov bl, 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, bl
pop ebx
leave
ret 0x1c

Function at 0x412b76
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8
Function at 0x40106e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov byte [ebp - 0x1c], 0
lea eax, [ebp - 4]
push eax
push 0
lea ecx, [ebp - 4]
push ecx
push 0xb
call dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
push 0x206b6444
mov edx, dword [ebp - 4]
push edx
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 8], eax
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0xb
call dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
add ecx, 4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0
jmp 0x4010d4
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jae 0x401145
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0x11c
mov edx, dword [ebp - 0x10]
lea edi, [edx + ecx + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 8
jb 0x401143
push str.ndis.sys
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x11c
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov edx, dword [ebp - 0xc]
lea eax, [ecx + edx + 0x14]
push eax
call sub.ntoskrnl.exe__stricmp
add esp, 8
test eax, eax
jne 0x401143
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0x11c
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 8]
mov dword [0x40d488], eax
mov byte [ebp - 0x1c], 1
jmp 0x401145
jmp 0x4010cb
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePool]
mov al, byte [ebp - 0x1c]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x401185
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x30], 0
cmp dword [ebp + 8], 0
jne 0x4011d7
xor eax, eax
jmp 0x401321
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
add eax, 0x78
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x28], 0
jmp 0x401242
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp edx, dword [ecx + 0x18]
jae 0x40131e
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 8]
movsx edx, word [ecx + eax*2]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + eax*4]
cmp edx, dword [ebp - 0x10]
jb 0x401281
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x1c]
cmp dword [edx + ecx*4], eax
jb 0x401319
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov dl, byte [ecx]
mov byte [ebp - 0x39], dl
mov eax, dword [ebp - 0x34]
cmp dl, byte [eax]
jne 0x4012d3
cmp byte [ebp - 0x39], 0
je 0x4012ca
mov ecx, dword [ebp - 0x38]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x3a], dl
mov eax, dword [ebp - 0x34]
cmp dl, byte [eax + 1]
jne 0x4012d3
add dword [ebp - 0x38], 2
add dword [ebp - 0x34], 2
cmp byte [ebp - 0x3a], 0
jne 0x401296
mov dword [ebp - 0x40], 0
jmp 0x4012db
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 0
jne 0x401319
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
call fcn.00401157
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + eax*4], edx
call fcn.00401172
jmp 0x40131e
jmp 0x401239
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4015ee
Capabilities:
Check os version
Create device object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0
xor eax, eax
mov dword [0x408e28], eax
mov word [0x408e2c], ax
xor ecx, ecx
mov dword [0x40c220], ecx
mov word [0x40c224], cx
xor edx, edx
mov dword [0x40916c], edx
mov word [0x409170], dx
push str.DeviceVDFltIp
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0
push 0
push 0x40d44c
push 0x40d448
call sub.ntoskrnl.exe_PsGetVersion
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 0x8300
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x4016ba
push 0x4060d0
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x70], 0x4017a6
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x70]
mov dword [edx + 0x40], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp + 8]
mov dword [edx + 0x34], 0x401893
cmp dword [ebp - 0x18], 0
jge 0x4016d0
cmp dword [ebp - 0xc], 0
je 0x4016d0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
call fcn.00402fde
call fcn.0040106e
and eax, 0xff
test eax, eax
je 0x40177a
cmp dword [0x40d488], 0
je 0x40177a
push 0x40d48c
push 0x40136d
push str.NdisRegisterProtocol
mov ecx, dword [0x40d488]
push ecx
call fcn.00401185
push 0x40d490
push 0x401532
push str.NdisDeregisterProtocol
mov edx, dword [0x40d488]
push edx
call fcn.00401185
push 0x40d494
push 0x40155d
push str.NdisOpenAdapter
mov eax, dword [0x40d488]
push eax
call fcn.00401185
push 0x40d498
push 0x40159b
push str.NdisCloseAdapter
mov ecx, dword [0x40d488]
push ecx
call fcn.00401185
push 0x40d49c
push 0x4015c6
push str.NdisSend
mov edx, dword [0x40d488]
push edx
call fcn.00401185
push 0
push section..text
call sub.ntoskrnl.exe_PsSetCreateProcessNotifyRoutine
cmp dword [0x40d448], 5
jne 0x40179d
cmp dword [0x40d44c], 2
jbe 0x40179d
call fcn.0040262a
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 8

Function at 0x4023fc
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 1]
and ecx, 0xff
push ecx
mov edx, dword [ebp - 2]
and edx, 0xff
push edx
mov eax, dword [ebp - 3]
and eax, 0xff
push eax
mov ecx, dword [ebp - 4]
and ecx, 0xff
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s__d._d._d._d__n
call sub.ntoskrnl.exe_DbgPrint
add esp, 0x18
mov esp, ebp
pop ebp
ret 8
Function at 0x402444
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 5]
push ecx
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 4]
push eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 3]
push edx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 2]
push ecx
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 1]
push eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
push edx
mov eax, dword [ebp + 8]
push eax
push str._s__02X__02X__02X__02X__02X__02X__n
call sub.ntoskrnl.exe_DbgPrint
add esp, 0x20
pop ebp
ret 8

Function at 0x40271e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
jmp 0x402736
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [0x40d458]
jge 0x4027a4
mov edx, dword [ebp - 4]
mov eax, dword [edx*4 + 0x40d4c0]
cmp eax, dword [ebp + 8]
jne 0x4027a2
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
jmp 0x402761
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [0x40d458]
sub eax, 1
cmp dword [ebp - 8], eax
jge 0x402784
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x40d4c4]
mov dword [ecx*4 + 0x40d4c0], eax
jmp 0x402758
mov ecx, dword [0x40d458]
sub ecx, 1
mov dword [0x40d458], ecx
push str.______DelTcpIpBindHandle_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
jmp 0x4027a4
jmp 0x40272d
mov esp, ebp
pop ebp
ret 4

Function at 0x402a23
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov ecx, 0x408e48
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov byte [ebp - 4], al
mov dword [ebp - 8], 0
jmp 0x402a4a
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x80
jge 0x402a9c
mov ecx, dword [ebp - 8]
imul ecx, ecx, 0x61
mov edx, dword [ecx + 0x4091a0]
cmp edx, dword [ebp + 8]
jne 0x402a9a
push str._____DelAdapterHandle_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov eax, dword [ebp - 8]
imul eax, eax, 0x61
add eax, 0x4091a0
push eax
call fcn.0040271e
mov ecx, 0x18
xor eax, eax
mov edi, dword [ebp - 8]
imul edi, edi, 0x61
add edi, 0x4091a0
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
jmp 0x402a9c
jmp 0x402a41
mov dl, byte [ebp - 4]
mov ecx, 0x408e48
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x402ab1
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov ecx, 0x408e34
call dword [sym.imp.HAL.dll_KfAcquireSpinLock]
mov byte [ebp - 4], al
mov eax, dword [0x40d454]
cmp eax, dword [ebp + 8]
jne 0x402ae7
push str._____W2K_NdisDeregisterProtocol_TcpIp_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov dword [0x40d458], 0
mov dword [ebp - 8], 0
jmp 0x402af9
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x20
jge 0x402b3d
mov edx, dword [ebp - 8]
imul edx, edx, 0x91
mov eax, dword [edx + 0x40c228]
cmp eax, dword [ebp + 8]
jne 0x402b3b
push str._____DelProtoHandle_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov ecx, 0x24
xor eax, eax
mov edi, dword [ebp - 8]
imul edi, edi, 0x91
add edi, 0x40c228
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
jmp 0x402b3d
jmp 0x402af0
mov dl, byte [ebp - 4]
mov ecx, 0x408e34
call dword [sym.imp.HAL.dll_KfReleaseSpinLock]
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x402ee1
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x402ef3
xor eax, eax
jmp 0x402fb7
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jne 0x402f11
push str.______HookProtoProc_Same_OldFunc
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
xor eax, eax
jmp 0x402fb7
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0x4091a0
jb 0x402f39
mov ecx, 0x40c220
mov edx, dword [ebp + 0xc]
cmp dword [edx], ecx
ja 0x402f39
push str.______PtrInAdapterHandle
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
xor eax, eax
jmp 0x402fb7
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0x40c228
jb 0x402f61
mov ecx, 0x40d448
mov edx, dword [ebp + 0xc]
cmp dword [edx], ecx
ja 0x402f61
push str.______PtrInProtoHandle
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
xor eax, eax
jmp 0x402fb7
mov eax, dword [ebp + 8]
mov byte [eax], 0x58
mov ecx, dword [ebp + 8]
mov byte [ecx + 1], 0x68
mov edx, dword [ebp + 8]
mov byte [edx + 6], 0x50
mov eax, dword [ebp + 8]
mov byte [eax + 7], 0xe9
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov dword [ecx + 2], edx
mov eax, dword [ebp + 8]
add eax, 0xc
mov ecx, dword [ebp + 0x10]
sub ecx, eax
mov edx, dword [ebp + 8]
mov dword [edx + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [edx], eax
mov eax, 1
pop ebp
ret 0x10
Function at 0x40322a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
and ecx, 0xff
push ecx
push 0x408e4c
call fcn.00403044
push 0x496d5674
push 0x400
lea edx, [ebp - 8]
push edx
call dword [sym.imp.NDIS.SYS_NdisAllocateMemoryWithTag]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40327f
jmp 0x4033d4
mov ecx, 0x100
xor eax, eax
mov edi, dword [ebp - 8]
rep stosd dword es:[edi], eax
mov ecx, 0xc8
mov esi, 0x408e4c
mov edi, dword [ebp - 8]
rep movsd dword es:[edi], dword [esi]
push 0x232
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [0x40e4e0]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.NDIS.SYS_NdisAllocateBuffer]
cmp dword [ebp - 4], 0
jne 0x4032e4
push 0x496d5674
push 0x400
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.NDIS.SYS_NdisFreeMemory]
push str.SendVDPacket:_unable_to_allocate_the_MDL._n
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
jmp 0x4033d4
mov edx, dword [0x40d4a4]
push edx
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.NDIS.SYS_NdisAllocatePacket]
cmp dword [ebp - 0x10], 0
je 0x403322
push 0x496d5674
push 0x400
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.NDIS.SYS_NdisFreeMemory]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoFreeMdl]
jmp 0x4033d4
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp dword [edx], 0
jne 0x403332
jmp 0x40333c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
jmp 0x403328
mov edx, dword [ebp - 0xc]
cmp dword [edx + 8], 0
jne 0x40334e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0xc]
mov byte [ecx + 0x1c], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
mov dword [eax], 0
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
call dword [edx + 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
and ecx, 0xff
push ecx
push str.SEND_PACK_code_d_Status_d
call sub.ntoskrnl.exe_DbgPrint
add esp, 0xc
cmp dword [ebp - 0x10], 0x103
je 0x4033d4
push 0x496d5674
push 0x400
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.NDIS.SYS_NdisFreeMemory]
mov eax, dword [ebp - 0xc]
push eax
call fcn.004031cc
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4039a3
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x40d47c], 0
jne 0x4039ec
push str.BaseNamedObjectsStopProcEvent
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x40d480
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.ntoskrnl.exe_IoCreateNotificationEvent]
mov dword [0x40d47c], eax
mov edx, dword [0x40d47c]
push edx
call dword [sym.imp.ntoskrnl.exe_KeClearEvent]
call sub.ntoskrnl.exe_PsGetCurrentProcessId
mov dword [0x40d484], eax
mov eax, dword [0x40d484]
push eax
mov ecx, dword [0x40d47c]
push ecx
push str.CreateStopProcEvent_g_StopProcEvent_X_g_hVDialProcID_X_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x403a0a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x40d47c], 0
je 0x403a7e
cmp dword [ebp + 8], 0
je 0x403a38
push 0x20
mov eax, dword [ebp + 8]
push eax
push 0x409178
call sub.ntoskrnl.exe_strncpy
add esp, 0xc
mov byte [0x409198], 0
jmp 0x403a3f
mov byte [0x409178], 0
mov ecx, dword [ebp + 0xc]
mov dword [0x409199], ecx
push 0
push 0
mov edx, dword [0x40d47c]
push edx
call dword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov eax, dword [0x40d47c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeClearEvent]
mov ecx, dword [0x40d47c]
push ecx
push 0x409178
push str.NotifyStopProc_KeSetEvent_Stop_Proc_s_g_StopProcEvent_X_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 0xc
pop ebp
ret 8

Function at 0x403a82
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov ecx, 3
mov edi, 0x40c220
mov esi, 0x408e28
xor eax, eax
repe cmpsw word [esi], word es:[edi]
jne 0x403ab4
lea ecx, [ebp - 4]
push ecx
push 6
push 6
push 0x408e28
mov edx, dword [ebp + 0x10]
push edx
call fcn.004019f0
cmp dword [0x40d46c], 0
jne 0x403ad3
lea eax, [ebp - 4]
push eax
push 0x1a
push 4
push 0x40d46c
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004019f0
mov ecx, 3
mov edi, 0x40c220
mov esi, 0x40916c
xor edx, edx
repe cmpsw word [esi], word es:[edi]
jne 0x403aff
lea eax, [ebp - 4]
push eax
push 0
push 6
push 0x40916c
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004019f0
mov edx, dword [ebp + 8]
push edx
push str.SEND_STOPPROC_TO_DEVICE_PROC_NAME_s
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x58585858
push 0x40916c
push 3
call fcn.004033dc
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00403a0a
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403cad
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
call fcn.00401f8a
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
sub ecx, dword [eax + 0x26c]
mov dword [ebp - 8], ecx
xor edx, edx
mov dl, byte [0x40d469]
test edx, edx
je 0x403d3c
lea eax, [ebp - 0xc]
push eax
push 0
push 6
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004019f0
mov ecx, 3
mov edi, 0x406008
lea esi, [ebp - 0x14]
xor eax, eax
repe cmpsw word [esi], word es:[edi]
je 0x403d3c
mov ecx, dword [ebp - 0x14]
and ecx, 0xff
cmp ecx, 1
je 0x403d3c
mov ecx, 3
mov edi, section..data
lea esi, [ebp - 0x14]
xor edx, edx
repe cmpsw word [esi], word es:[edi]
je 0x403d3c
mov ecx, 3
mov edi, 0x40916c
lea esi, [ebp - 0x14]
xor eax, eax
repe cmpsw word [esi], word es:[edi]
je 0x403d3c
jmp 0x403dd7
cmp dword [ebp - 8], 0xbb8
jae 0x403dbf
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dx, word [ecx + 0x270]
cmp edx, 0xffff
jge 0x403d71
mov eax, dword [ebp + 0xc]
mov cx, word [eax + 0x270]
add cx, 1
mov edx, dword [ebp + 0xc]
mov word [edx + 0x270], cx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax + 0x270]
cmp ecx, 0x1f40
jl 0x403dbd
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx + 0x268]
test eax, eax
jne 0x403db3
mov ecx, dword [ebp + 0xc]
push ecx
push str.Stop__s_for_pkt_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov edx, dword [ebp + 8]
push edx
push 4
mov eax, dword [ebp + 0xc]
push eax
call fcn.00403a82
mov ecx, dword [ebp + 0xc]
mov byte [ecx + 0x268], 1
jmp 0x403dd7
mov edx, dword [ebp + 0xc]
mov word [edx + 0x270], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x26c], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x403ddf
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.00401f8a
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
sub ecx, dword [eax + 0x238]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], 0
lea edx, [ebp - 4]
push edx
push 0x26
push 4
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004019f0
cmp dword [ebp - 0x10], 0
je 0x403ede
mov edx, dword [ebp - 0x10]
push edx
call fcn.00401951
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0xbb8
jae 0x403ea4
push 0xa
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x23c
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x240
push eax
call fcn.00402558
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dx, word [ecx + 0x23c]
cmp edx, 0xa
jl 0x403ea2
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax + 0x234]
test ecx, ecx
jne 0x403e98
mov edx, dword [ebp + 0xc]
push edx
push str.Stop__s_for_arp_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 2
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00403a82
mov edx, dword [ebp + 0xc]
mov byte [edx + 0x234], 1
jmp 0x403ede
mov eax, dword [ebp + 0xc]
mov word [eax + 0x23c], 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [ecx + 0x238], edx
push 0xa
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x23c
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x240
push eax
call fcn.00402558
mov esp, ebp
pop ebp
ret 8