joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40921c
Capabilities:
Print debug messages

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
call sub.ntdll.dll_NtQueryPerformanceCounter
mov eax, dword [esp]
add eax, dword [esp + 4]
mov edx, dword [0x412414]
mov dword [edx], eax
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
push 0x3e8
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
call fcn.00403b6c
call fcn.00403b90
push eax
push ebx
push 0x409278
call sub.ntdll.dll_DbgPrint
add esp, 0xc
add esp, 0x10
pop ebx
ret

Function at 0x4092fc
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov edi, edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.004084d0
test al, al
jne 0x409337
mov edx, 0x90
mov eax, esi
call fcn.0040852c
test al, al
jne 0x409337
push esi
push 0x4094a4
call sub.ntdll.dll_DbgPrint
add esp, 8
jmp 0x409498
mov eax, edi
call fcn.004084d0
test al, al
jne 0x409366
mov edx, 0x90
mov eax, edi
call fcn.0040852c
test al, al
jne 0x409366
push edi
push esi
push 0x4094cc
call sub.ntdll.dll_DbgPrint
add esp, 0xc
jmp 0x409498
mov eax, esi
call fcn.00408d60
test al, al
je 0x409383
push 0x4094fc
call sub.ntdll.dll_DbgPrint
pop ecx
mov bl, 1
jmp 0x409498
push esi
lea eax, [esp + 8]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
mov ecx, 0x40
call fcn.00407d20
push 1
push 7
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push 0xc0000000
lea eax, [esp + 0x14]
push eax
call sub.ntdll.dll_NtOpenFile
mov ebp, eax
mov eax, ebp
call fcn.00407d14
test eax, eax
jne 0x4093e1
push ebp
push 0x409520
call sub.ntdll.dll_DbgPrint
add esp, 8
jmp 0x409498
push edi
call sub.ntdll.dll_wcslen
pop ecx
inc eax
mov ebx, eax
add ebx, ebx
add ebx, 8
add ebx, 0xc
mov eax, ebx
call fcn.00408b1c
mov esi, eax
push ebx
push esi
call sub.ntdll.dll_RtlZeroMemory
mov ebx, esi
push edi
call sub.ntdll.dll_wcslen
pop ecx
inc eax
add eax, eax
push eax
push edi
lea eax, [ebx + 0x10]
push eax
call fcn.00407f80
mov dword [ebx], 0xa0000003
push edi
call sub.ntdll.dll_wcslen
pop ecx
mov ebp, eax
add ebp, ebp
mov word [ebx + 0xa], bp
add bp, 2
mov word [ebx + 0xc], bp
movzx eax, word [ebx + 0xa]
add eax, 0xc
mov dword [ebx + 4], eax
push 0
push 0
mov eax, dword [esi + 4]
add eax, 8
push eax
push esi
push 0x900a4
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x24]
push eax
call sub.ntdll.dll_NtFsControlFile
mov ebp, eax
mov eax, ebp
call fcn.00407d14
test eax, eax
jne 0x409486
push ebp
push 0x409540
call sub.ntdll.dll_DbgPrint
add esp, 8
xor ebx, ebx
jmp 0x409488
mov bl, 1
mov eax, esi
call fcn.00408b30
mov eax, dword [esp]
push eax
call sub.ntdll.dll_NtClose
mov eax, ebx
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x409560
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, eax
xor ebx, ebx
mov eax, dword [esp]
call fcn.00408b44
test al, al
jne 0x409594
mov eax, dword [esp]
push eax
push 0x409738
call sub.ntdll.dll_DbgPrint
add esp, 8
jmp 0x40972e
mov eax, esi
call fcn.00408d60
test al, al
je 0x4095b1
push 0x40975c
call sub.ntdll.dll_DbgPrint
pop ecx
mov bl, 1
jmp 0x40972e
push esi
push 0x409780
call sub.ntdll.dll_DbgPrint
add esp, 8
push esi
lea eax, [esp + 0x10]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0x14]
lea eax, [esp + 0x28]
mov ecx, 0x40
call fcn.00407d20
push 0
push 0
push 0
push 2
push 3
push 0
push 0
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x40]
push eax
push 0x12019f
lea eax, [esp + 0x30]
push eax
call sub.ntdll.dll_NtCreateFile
mov esi, eax
mov eax, esi
call fcn.00407d14
test eax, eax
jne 0x409627
push esi
push 0x4097a0
call sub.ntdll.dll_DbgPrint
add esp, 8
jmp 0x40972e
mov eax, dword [esp]
push eax
call sub.ntdll.dll_wcslen
pop ecx
add eax, eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 4]
push eax
call sub.ntdll.dll_wcslen
pop ecx
mov esi, eax
add esi, esi
lea ebp, [esp + 0x48]
lea eax, [esp + 0x38]
sub bp, ax
movzx ebp, bp
mov eax, dword [esp + 0x1c]
add eax, esi
add eax, 4
add ebp, eax
mov eax, ebp
call fcn.00408b1c
mov edi, eax
push ebp
push edi
call sub.ntdll.dll_RtlZeroMemory
mov ebx, edi
mov dword [ebx], 0xa000000c
mov word [ebx + 6], 0
mov eax, ebp
sub ax, 8
mov word [ebx + 4], ax
mov word [ebx + 0xc], 0
mov eax, esi
mov word [ebx + 0xe], ax
mov word [ebx + 8], ax
mov ax, word [esp + 0x1c]
mov word [ebx + 0xa], ax
push esi
mov eax, dword [esp + 8]
push eax
lea eax, [ebx + 0x10]
add eax, 4
push eax
call fcn.00407f80
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 4]
push eax
lea eax, [ebx + 0x10]
xor edx, edx
push edx
push eax
mov eax, esi
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
add eax, 4
adc edx, 0
push eax
call fcn.00407f80
push 0
push 0
push ebp
push edi
push 0x900a4
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x2c]
push eax
call sub.ntdll.dll_NtFsControlFile
mov esi, eax
mov eax, esi
call fcn.00407d14
test eax, eax
jne 0x40971b
push esi
push 0x4097c4
call sub.ntdll.dll_DbgPrint
add esp, 8
xor ebx, ebx
jmp 0x40971d
mov bl, 1
mov eax, edi
call fcn.00408b30
mov eax, dword [esp + 8]
push eax
call sub.ntdll.dll_NtClose
mov eax, ebx
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4097e4
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x4097ee
mov eax, dword [esp + 0x4000]
add esp, 0xfffffd68
mov edi, ecx
mov ebp, edx
mov ebx, eax
mov byte [esp], 0
mov byte [edi], 0
lea edx, [esp + 4]
mov eax, ebx
call fcn.00408ed4
test al, al
je 0x409828
cmp dword [esp + 4], 0xffffffff
jne 0x40983b
push ebx
push 0x4099c0
call sub.ntdll.dll_DbgPrint
add esp, 8
jmp 0x4099b1
test byte [esp + 5], 4
je 0x4099b1
test byte [esp + 4], 0x10
je 0x409854
mov esi, 0x200001
jmp 0x409859
mov esi, 0x200000
push ebx
lea eax, [esp + 0x10]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0x14]
lea eax, [esp + 0x428c]
mov ecx, 0x40
call fcn.00407d20
xor eax, eax
mov dword [esp + 8], eax
push 0
push 0
push esi
push 1
push 7
push 0
push 0
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x42a4]
push eax
push 0x80000000
lea eax, [esp + 0x30]
push eax
call sub.ntdll.dll_NtCreateFile
mov esi, eax
mov eax, esi
call fcn.00407d14
test eax, eax
jne 0x4098cc
push esi
push 0x4099d8
call sub.ntdll.dll_DbgPrint
add esp, 8
jmp 0x4099b1
lea ebx, [esp + 0x1c]
push 0x4268
push ebx
push 0
push 0
push 0x900a8
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x2c]
push eax
call sub.ntdll.dll_NtFsControlFile
mov esi, eax
mov eax, dword [esp + 8]
push eax
call sub.ntdll.dll_NtClose
mov eax, esi
call fcn.00407d14
test eax, eax
jne 0x40991e
push esi
push 0x4099f8
call sub.ntdll.dll_DbgPrint
add esp, 8
jmp 0x4099b1
mov eax, dword [ebx]
sub eax, 0xa0000003
je 0x409931
sub eax, 9
je 0x409969
jmp 0x4099b1
lea eax, [ebx + 0x10]
movzx esi, word [ebx + 8]
add esi, eax
movzx eax, word [ebx + 0xa]
push eax
push esi
push ebp
call sub.ntdll.dll_wcsncpy
add esp, 0xc
push 0x409a20
push ebp
call sub.ntdll.dll_wcsstr
add esp, 8
test eax, eax
je 0x409960
mov byte [edi], 1
jmp 0x409963
mov byte [edi], 2
mov byte [esp], 1
jmp 0x4099b1
lea eax, [ebx + 0x10]
movzx esi, word [ebx + 8]
add esi, eax
push 0x409a24
push esi
call sub.ntdll.dll_wcsstr
add esp, 8
cmp esi, eax
jne 0x409995
movzx eax, word [ebx + 0xa]
push eax
push esi
push ebp
call sub.ntdll.dll_wcsncpy
add esp, 0xc
jmp 0x4099aa
movzx eax, word [ebx + 0xa]
sub eax, 2
push eax
lea eax, [esi + 4]
push eax
push ebp
call sub.ntdll.dll_wcsncpy
add esp, 0xc
mov byte [edi], 3
mov byte [esp], 1
mov al, byte [esp]
add esp, 0x429c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40a3f4
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebx
add esp, 0xffffffa8
mov ebx, eax
mov eax, dword [0x41233c]
cmp byte [eax], 0
je 0x40a41c
mov eax, 0x40a4f0
xor edx, edx
call fcn.004081ec
mov eax, ebx
add eax, 8
mov dl, 1
call fcn.004081ec
push ebx
lea eax, [esp + 4]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 8]
lea eax, [esp + 0x1c]
mov ecx, 0x42
call fcn.00407d20
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x18]
push eax
call sub.ntdll.dll_NtQueryAttributesFile
test eax, eax
jne 0x40a4ea
xor eax, eax
mov dword [esp + 0x10], eax
push 0
push 0
push 0x40
push 1
push 7
mov eax, dword [esp + 0x64]
push eax
push 0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x34]
push eax
push 0x180
lea eax, [esp + 0x38]
push eax
call sub.ntdll.dll_NtCreateFile
test eax, eax
jne 0x40a4e0
push 4
push 0x28
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push eax
call sub.ntdll.dll_NtQueryInformationFile
test eax, eax
jne 0x40a4d6
and dword [esp + 0x50], 0xfffffffe
push 4
push 0x28
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push eax
call sub.ntdll.dll_NtSetInformationFile
cmp eax, 0x103
jne 0x40a4d6
push 0
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.ntdll.dll_NtWaitForSingleObject
mov eax, dword [esp + 0x10]
push eax
call sub.ntdll.dll_NtClose
lea eax, [esp + 0x14]
push eax
call sub.ntdll.dll_NtDeleteFile
add esp, 0x58
pop ebx
ret

Function at 0x40a51c
Capabilities:
Get file attributes
Set file attributes

Disassembly:
add esp, 0xffffffa8
push eax
lea eax, [esp + 4]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 8]
lea eax, [esp + 0x1c]
mov ecx, 0x40
call fcn.00407d20
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x18]
push eax
call sub.ntdll.dll_NtQueryAttributesFile
test eax, eax
jne 0x40a5f2
xor eax, eax
mov dword [esp + 0x10], eax
push 0
push 0
push 0
push 1
push 7
mov eax, dword [esp + 0x64]
push eax
push 0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x34]
push eax
push 0x180
lea eax, [esp + 0x38]
push eax
call sub.ntdll.dll_NtCreateFile
cmp dword [esp + 0x10], 0
je 0x40a5f2
push 4
push 0x28
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push eax
call sub.ntdll.dll_NtQueryInformationFile
test eax, eax
jne 0x40a5e8
mov eax, dword [esp + 0x50]
and eax, 0xfffffffe
and eax, 0xfffffffd
and eax, 0xfffffffb
mov dword [esp + 0x50], eax
push 4
push 0x28
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push eax
call sub.ntdll.dll_NtSetInformationFile
cmp eax, 0x103
jne 0x40a5e8
push 0
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.ntdll.dll_NtWaitForSingleObject
mov eax, dword [esp + 0x10]
push eax
call sub.ntdll.dll_NtClose
add esp, 0x58
ret
Function at 0x40a910
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040b394
test al, al
jne 0x40a93d
push ebx
push 0x40a980
call sub.ntdll.dll_DbgPrint
add esp, 8
jmp 0x40a977
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push edi
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ntdll.dll_NtDeviceIoControlFile
test eax, eax
je 0x40a96e
push eax
push esi
push ebx
push 0x40a9b0
call sub.ntdll.dll_DbgPrint
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call sub.ntdll.dll_NtClose
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40a9fc
Capabilities:
Print debug messages

Disassembly:
push ebx
add esp, 0xfffffff0
xor ebx, ebx
mov eax, esp
xor edx, edx
call fcn.0040b394
test al, al
jne 0x40aa20
push 0
push 0x40aa74
call sub.ntdll.dll_DbgPrint
add esp, 8
jmp 0x40aa6b
push 4
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x8900182c
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x24]
push eax
call sub.ntdll.dll_NtDeviceIoControlFile
test eax, eax
je 0x40aa5e
push eax
push 0x8900182c
push 0x40aaa4
call sub.ntdll.dll_DbgPrint
add esp, 0xc
jmp 0x40aa62
mov ebx, dword [esp + 0xc]
mov eax, dword [esp]
push eax
call sub.ntdll.dll_NtClose
mov eax, ebx
add esp, 0x10
pop ebx
ret
Function at 0x40ad84
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov ebx, ecx
mov esi, edx
mov dword [esp], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x18], 0x100000
mov dword [esp + 0x1c], 0
push 0
push 0x400
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
call fcn.00403b6c
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
push 0
push 5
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
call fcn.00403b6c
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
test bh, 0x40
setne byte [esp + 0x14]
cmp dword [esi + 0x15], 0
jne 0x40adf9
cmp dword [esi + 0x11], 0
je 0x40ae53
test bh, 0x20
je 0x40ae1a
test bh, 0x80
je 0x40ae1a
push 0x40afb8
call sub.ntdll.dll_DbgPrint
pop ecx
mov dl, 1
mov eax, dword [esp]
call fcn.0040a5f8
mov eax, dword [esi + 0x19]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x1d]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
push 0x40afe0
call sub.ntdll.dll_DbgPrint
add esp, 0x14
cmp byte [esi + 0x23], 0
je 0x40ae53
mov eax, esi
call fcn.0040ad34
mov eax, dword [esp]
push eax
lea eax, [esp + 8]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
call fcn.0040acd4
inc eax
jne 0x40ae79
push 0x40b03c
call sub.ntdll.dll_DbgPrint
pop ecx
jmp 0x40afad
xor edi, edi
mov ebp, 0x4137c4
mov ebx, ebp
cmp dword [ebx + 4], 0
jne 0x40ae91
cmp dword [ebx], 0
je 0x40af9d
cmp dword [ebx + 8], 0xc
jne 0x40af9d
cmp dword [esi + 0x15], 0
jne 0x40aea5
cmp dword [esi + 0x11], 0
je 0x40aefc
cmp edi, dword [esi]
jne 0x40aefc
cmp byte [esp + 0x14], 0
jne 0x40af9d
cmp byte [esi + 0x23], 0
je 0x40af9d
cmp byte [esi + 0x24], 0
jne 0x40af9d
push edi
push 0x40b058
call sub.ntdll.dll_DbgPrint
add esp, 8
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esi + 4]
push eax
mov al, byte [esi + 0x21]
push eax
mov ecx, ebx
mov edx, edi
mov eax, dword [esp + 0x10]
call fcn.0040ab8c
jmp 0x40af9d
mov eax, dword [ebx + 0x18]
cmp eax, 7
je 0x40af9d
cmp eax, 9
je 0x40af9d
cmp eax, 6
je 0x40af9d
cmp eax, 0x10
je 0x40af9d
mov ecx, dword [ebx + 0x24]
cmp ecx, 0x6e7a6674
je 0x40af68
cmp dword [ebx + 0x14], 2
je 0x40af68
cmp dword [ebx + 0x14], 3
je 0x40af68
cmp dword [ebx + 0x14], 7
je 0x40af68
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
cmp edx, dword [esp + 0x1c]
jne 0x40af4f
cmp eax, dword [esp + 0x18]
jae 0x40af68
jmp 0x40af51
jge 0x40af68
mov eax, dword [ebx + 0x14]
push eax
push ecx
mov eax, dword [ebx]
push eax
push 0x40b088
call sub.ntdll.dll_DbgPrint
add esp, 0x10
jmp 0x40af9d
cmp byte [esi + 0x22], 0
je 0x40af9d
xor eax, eax
mov al, byte [esi + 0x21]
push eax
mov eax, dword [ebx + 8]
push eax
push edi
push 0x40b0c4
call sub.ntdll.dll_DbgPrint
add esp, 0x10
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
mov al, byte [esi + 0x21]
push eax
mov ecx, ebx
mov edx, edi
mov eax, dword [esp + 0x10]
call fcn.0040ab8c
inc edi
add ebp, 0x228
cmp edi, 0x10
jne 0x40ae80
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40b2ac
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd8
mov edi, ecx
mov esi, edx
push eax
lea eax, [esp + 4]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 8]
lea eax, [esp + 0x18]
mov ecx, 0x40
call fcn.00407d20
lea eax, [esp + 0x10]
push eax
push 1
lea eax, [esp + 0x10]
push eax
call sub.ntdll.dll_NtOpenSymbolicLinkObject
mov ebx, eax
test ebx, ebx
jne 0x40b345
push esi
lea eax, [esp + 4]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
mov word [esp], 0
mov word [esp + 2], di
xor eax, eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.ntdll.dll_NtQuerySymbolicLinkObject
mov ebx, eax
mov eax, ebx
call fcn.00407d14
test eax, eax
jne 0x40b339
push ebx
push 0x40b35c
call sub.ntdll.dll_DbgPrint
add esp, 8
mov eax, dword [esp + 8]
push eax
call sub.ntdll.dll_NtClose
jmp 0x40b353
push ebx
push 0x40b378
call sub.ntdll.dll_DbgPrint
add esp, 8
add esp, 0x28
pop edi
pop esi
pop ebx
ret

Function at 0x40b394
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd4
mov ebp, edx
mov esi, eax
xor eax, eax
mov dword [esi], eax
xor ebx, ebx
mov eax, 0x80
call fcn.00408b1c
mov edi, eax
push 0x80
push edi
call sub.ntdll.dll_RtlZeroMemory
push ebp
push 0x40b440
push edi
call sub.ntdll.dll_swprintf
add esp, 0xc
push edi
lea eax, [esp + 0x10]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
mov ecx, 0x40
call fcn.00407d20
push 0
push 0
push 0x40
push 1
push 7
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push 0x80000000
lea eax, [esp + 0x28]
push eax
call sub.ntdll.dll_NtCreateFile
test eax, eax
jne 0x40b420
mov eax, dword [esp]
mov dword [esi], eax
mov bl, 1
jmp 0x40b42e
push eax
push 0x40b46c
call sub.ntdll.dll_DbgPrint
add esp, 8
mov eax, edi
call fcn.00408b30
mov eax, ebx
add esp, 0x2c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40b494
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd0
mov dword [esp], ecx
mov ebp, edx
mov esi, eax
xor eax, eax
mov dword [esi], eax
xor ebx, ebx
mov eax, 0x80
call fcn.00408b1c
mov edi, eax
push 0x80
push edi
call sub.ntdll.dll_RtlZeroMemory
mov eax, dword [esp]
push eax
push ebp
push 0x40b548
push edi
call sub.ntdll.dll_swprintf
add esp, 0x10
push edi
lea eax, [esp + 0x14]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0x18]
lea eax, [esp + 0x20]
mov ecx, 0x40
call fcn.00407d20
push 0
push 0
push 0x40
push 1
push 7
push 0
push 0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x38]
push eax
push 0x80000000
lea eax, [esp + 0x2c]
push eax
call sub.ntdll.dll_NtCreateFile
test eax, eax
jne 0x40b528
mov eax, dword [esp + 4]
mov dword [esi], eax
mov bl, 1
jmp 0x40b536
push eax
push 0x40b588
call sub.ntdll.dll_DbgPrint
add esp, 8
mov eax, edi
call fcn.00408b30
mov eax, ebx
add esp, 0x30
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40b5b0
Capabilities:
Print debug messages
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov eax, 0x1000
call fcn.00408b1c
mov ebx, eax
mov dword [ebp - 8], 0x7200
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 8]
push eax
push 0x1000
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push edi
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x40b604
push 0
push 0
push edi
call sub.ntdll.dll_NtWaitForSingleObject
mov eax, dword [ebx + 4]
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 8]
mov dword [esi + 0x18], eax
mov eax, dword [ebx + 0x2c]
mov dword [esi + 0x1c], eax
mov eax, dword [ebx + 0x134]
mov dword [esi + 0x20], eax
mov eax, dword [ebx]
mov dword [esi + 0x24], eax
push 0x20
lea eax, [ebx + 0xb4]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00407f80
mov eax, dword [esi + 0x24]
push eax
mov eax, dword [esi + 0x14]
push eax
push 0x40b678
call sub.ntdll.dll_DbgPrint
add esp, 0xc
cmp dword [ebx + 8], 4
jne 0x40b666
mov edx, 0x40b698
mov eax, 0x40b6ac
mov ecx, dword [ebx + 0x12c]
call fcn.004087e0
mov eax, ebx
call fcn.00408b30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40bdbc
Capabilities:
Print debug messages
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffcc
mov esi, edx
mov ebp, eax
mov eax, 0x40
call fcn.00408b1c
mov ebx, eax
push esi
push 0x40bef0
push ebx
call sub.ntdll.dll_swprintf
add esp, 0xc
push ebx
lea eax, [esp + 4]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 8]
lea eax, [esp + 0x24]
mov ecx, 0x40
call fcn.00407d20
xor eax, eax
mov dword [esp + 0x18], eax
push 0x40
push 3
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
push 0x120089
lea eax, [esp + 0x2c]
push eax
call sub.ntdll.dll_NtOpenFile
mov esi, eax
cmp dword [esp + 0x18], 0
je 0x40bec4
mov eax, 0x200
call fcn.00408b1c
mov edi, eax
push 0x200
push edi
call sub.ntdll.dll_RtlZeroMemory
mov dword [esp + 0x10], 0x7200
mov dword [esp + 0x14], 0
push 0
lea eax, [esp + 0x14]
push eax
push 0x200
push edi
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x38]
push eax
call sub.ntdll.dll_NtReadFile
mov esi, eax
cmp esi, 0x103
jne 0x40be96
push 0
push 0
mov eax, dword [esp + 0x20]
push eax
call sub.ntdll.dll_NtWaitForSingleObject
mov esi, eax
test esi, esi
jne 0x40beb1
push 0x144
push ebp
call sub.ntdll.dll_RtlZeroMemory
push 0x144
push edi
push ebp
call fcn.00407f80
mov eax, edi
call fcn.00408b30
mov eax, dword [esp + 0x18]
push eax
call sub.ntdll.dll_NtClose
jmp 0x40bede
mov eax, 0x40bf28
mov dl, 1
call fcn.004081ec
push esi
push 0x40bf70
call sub.ntdll.dll_DbgPrint
add esp, 8
mov eax, ebx
call fcn.00408b30
add esp, 0x34
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40bf9c
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, eax
xor edi, edi
mov dword [esp + 0x14], 0x4137c4
mov eax, dword [esp + 0x14]
mov esi, eax
cmp dword [esi + 4], 0
jne 0x40bfc4
cmp dword [esi], 0
je 0x40c135
cmp byte [ebp + 0x22], 0
je 0x40c135
cmp dword [esi + 0x24], 0x6e7a6674
jne 0x40c135
mov eax, dword [esi + 0x14]
cmp eax, 2
je 0x40bff1
cmp eax, 3
je 0x40bff1
cmp eax, 7
jne 0x40c135
mov edx, dword [esi + 0x18]
cmp edx, 4
je 0x40c002
cmp edx, 1
jne 0x40c135
cmp byte [ebp + 0x22], 0
je 0x40c018
push edi
push 0x40c150
call sub.ntdll.dll_DbgPrint
add esp, 8
jmp 0x40c026
push edi
push 0x40c178
call sub.ntdll.dll_DbgPrint
add esp, 8
xor eax, eax
mov dword [esp], eax
mov eax, dword [esp]
shl eax, 2
lea ebx, [esi + eax*8 + 0x28]
cmp dword [ebx + 0xc], 0
jne 0x40c045
cmp dword [ebx + 8], 0
je 0x40c128
cmp edi, dword [ebp]
jne 0x40c056
mov eax, dword [ebp + 4]
cmp eax, dword [ebx + 0x14]
je 0x40c128
lea eax, [esp + 4]
mov ecx, dword [ebx + 0x14]
mov edx, edi
call fcn.0040b494
test al, al
je 0x40c128
cmp byte [ebp + 0x22], 0
je 0x40c085
mov eax, dword [ebx + 0x14]
push eax
push 0x40c19c
call sub.ntdll.dll_DbgPrint
add esp, 8
jmp 0x40c096
mov eax, dword [ebx + 0x14]
push eax
push 0x40c1c4
call sub.ntdll.dll_DbgPrint
add esp, 8
mov eax, dword [ebx + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x1c], eax
mov al, byte [ebp + 8]
mov byte [esp + 0x20], al
mov eax, edi
mov byte [esp + 0x21], al
mov al, byte [ebx + 0x14]
mov byte [esp + 0x22], al
mov al, byte [ebx + 0x19]
mov byte [esp + 0x23], al
push 0
push 0
push 0xc
lea eax, [esp + 0x24]
push eax
push 0x8900200c
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x28]
push eax
call sub.ntdll.dll_NtDeviceIoControlFile
mov dword [esp + 8], eax
cmp dword [esp + 8], 0x103
jne 0x40c100
push 0
push 0
mov eax, dword [esp + 0xc]
push eax
call sub.ntdll.dll_NtWaitForSingleObject
cmp dword [esp + 8], 0
je 0x40c11e
mov eax, dword [esp + 8]
push eax
mov eax, dword [ebx + 0x14]
push eax
push edi
push 0x40c1e8
call sub.ntdll.dll_DbgPrint
add esp, 0x10
mov eax, dword [esp + 4]
push eax
call sub.ntdll.dll_NtClose
inc dword [esp]
cmp dword [esp], 0x10
jne 0x40c02b
inc edi
add dword [esp + 0x14], 0x228
cmp edi, 0x10
jne 0x40bfaf
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret