joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1ba1165
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pushal
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x40306f
sub eax, 0x2000
add eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x40300c
sub eax, 0x2000
add eax, dword [ebp + 0x10]
push dword [eax]
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x4030fe
sub eax, 0x2000
add eax, dword [ebp + 0x10]
call dword [eax]
push eax
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x403010
sub eax, 0x2000
add eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x40300c
sub eax, 0x2000
add eax, dword [ebp + 0x10]
push dword [eax]
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x4030fe
sub eax, 0x2000
add eax, dword [ebp + 0x10]
call dword [eax]
pop eax
call eax
or eax, eax
jne 0x1ba1226
push eax
jmp 0x1ba1234
cmp eax, 0x7f
jne 0x1ba1232
push 0x100
jmp 0x1ba1234
push 1
mov esi, dword [ebp + 8]
mov ebx, 0xa
mov ecx, dword [ebp + 0xc]
shr ecx, 2
xor edx, edx
mov eax, dword [ebp + 0xc]
shr eax, 2
sub eax, ecx
push eax
div ebx
add edx, 2
sub dword [esi], edx
xor edx, edx
pop eax
div ebx
add edx, dword [esp]
push edx
add dword [esp], 0x259d23e6
pop edx
xor dword [esi], edx
add esi, 4
loop 0x1ba1242
pop eax
popal
leave
ret 0x10
Function at 0x1ba1371
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov esi, dword [esp + 0x8c]
and esi, 0xffff0000
mov eax, esi
cmp word [eax], 0x5a4d
jne 0x1ba1390
add eax, dword [eax + 0x3c]
sub esi, 0x10000
cmp word [eax], 0x4550
jne 0x1ba1384
add esi, 0x10000
push esi
mov eax, 0x40300c
pop dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01ba12d9
mov dword [0x4030fe], eax
push 0x403010
push 0x3e8
push 0
call fcn.01ba1b90
or eax, eax
jne 0x1ba13d4
leave
ret 8
push eax
push eax
push 0
call fcn.01ba1bae
or eax, eax
jne 0x1ba13e5
leave
ret 8
mov dword [ebp - 8], eax
pop eax
push eax
push 0
call fcn.01ba1ba2
or eax, eax
jne 0x1ba13f9
leave
ret 8
push eax
call fcn.01ba1ba8
or eax, eax
jne 0x1ba1407
leave
ret 8
mov dword [ebp - 0xc], eax
push 4
push 0x3000
push dword [ebp - 8]
push 0
call fcn.01ba1bb4
or eax, eax
jne 0x1ba1423
leave
ret 8
push eax
mov esi, dword [ebp - 0xc]
mov edi, eax
mov ecx, dword [ebp - 8]
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 8]
push dword [esp + 0xc]
call fcn.01ba1165
mov ebx, dword [esp]
add ebx, dword [ebx + 0x3c]
lea eax, [ebx + 0x18]
mov ebx, dword [eax + 0x38]
pop eax
push ebx
push 0x8000
push 0
push eax
call fcn.01ba1bba
mov ebx, dword [ebp + 0xc]
add ebx, dword [ebx + 0x3c]
lea eax, [ebx + 0x18]
mov ebx, dword [eax + 0x38]
mov dword [ebp - 4], ebx
mov ebx, dword [esp]
add ebx, dword [ebp + 0xc]
and ebx, 0xffff0000
add ebx, 0x10000
push 0x40
push 0x3000
push dword [ebp - 4]
push ebx
call fcn.01ba1bb4
or eax, eax
je 0x1ba1476
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
push eax
sub eax, dword [ebp + 0xc]
add dword [ebp + 8], eax
mov ebx, 0x4014ec
add ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov ebx, 0x401b88
add ebx, dword [ebp + 8]
sub ebx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
lea ebx, [ebp - 0x14]
push ebx
push 0x4012a4
push dword [ebp + 0xc]
call fcn.01ba1272
pop eax
pop ebx
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
mov eax, dword [ebp + 8]
add dword [ebp - 0xc], eax
push dword [ebp - 0xc]
mov eax, 0x401757
add eax, dword [ebp + 8]
call eax
leave
ret 8
Function at 0x100afd8
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x100d520]
and dword [ebp - 0x240], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0xa
pop ecx
mov esi, 0x100b0a0
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
push eax
call esi
test ebx, ebx
pop ecx
mov edi, eax
je 0x100b086
push ebx
call esi
cmp eax, edi
pop ecx
jb 0x100b086
push 0x104
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100b086
push edi
lea eax, [ebp - 0x30]
push eax
push ebx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x100b062
lea eax, [ebx + edi*2]
push eax
push 0x105
lea eax, [ebp - 0x23c]
push eax
call fcn.0100af9f
jmp 0x100b074
push ebx
push 0x105
lea eax, [ebp - 0x23c]
push eax
call fcn.01009e3a
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x23c]
push eax
call sym.spoolsv.exe_YDriverUnloadComplete
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x240], eax
pop edi
pop esi
setge al
pop ebx
call fcn.01004b8f
leave
ret 4

Function at 0x100b123
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0x100b150
push dword [eax + 0xc]
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
pop ecx
pop ecx
jne 0x100b147
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
pop ebp
ret 4

Function at 0x401005
Capabilities:
Access peb ldr_data

Disassembly:
push 0
push 2
push 0x403071
push 0x403053
call dword [sym.imp.Winmm.dll_mciSendStringA]
cmp eax, 0x107
je 0x401021
ret
mov edi, edi
mov esi, 0x402058
mov edi, esi
push 1
push 0x40308f
push 1
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateSemaphoreW]
mov edx, eax
pop ebx
mov ecx, 0x340
mov al, byte [esi]
sub al, bl
stosb byte es:[edi], al
inc esi
loop 0x401045
push dword fs:[0x30]
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
cmp word [eax], 0x5a4d
je 0x40106b
xor eax, eax
mov dword [0x4030a2], eax
add esp, 4
ret
Function at 0x4026ef
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x423008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
call fcn.0040212d
mov ebx, eax
cmp ebx, esi
je 0x402760
lea ecx, [ebp - 0x214]
call fcn.004020b6
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c55c
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x40277e
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.004026ef
cmp eax, esi
jne 0x4027c5
lea eax, [ebp - 0x220]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x208], 0x100
call ebx
test eax, eax
je 0x402768
lea ecx, [ebp - 0x214]
call fcn.004020b6
push dword [ebp - 0x218]
mov ecx, edi
call fcn.00402094
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.004020b6
mov eax, esi
jmp 0x40274f
Function at 0x407e5a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x423008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
push 2
push ebx
push eax
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x408], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x40c], eax
cmp eax, ebx
jne 0x407ead
call fcn.00401ea1
mov esi, eax
jmp 0x407f4b
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
jne 0x407ec3
call fcn.00401ea1
jmp 0x407f3d
push esi
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
je 0x407ebc
push esi
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x407ef3
mov esi, 0x8007000e
jmp 0x407f3f
push eax
lea ecx, [ebp - 0x408]
call fcn.00402e35
cmp dword [ebp - 0x408], ebx
je 0x407eec
push esi
push dword [ebp - 0x408]
push esi
push edi
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x407ebc
mov edx, dword [ebp - 0x408]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x408]
lea ecx, [ebp - 0x414]
call fcn.00403e16
mov esi, eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x407f64
lea ecx, [ebp - 0x408]
call fcn.0040269d
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c55c
leave
ret 0x10

Function at 0x408925
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x41c068
lea ecx, [ebp - 4]
call fcn.0040872f
push dword [ebp - 4]
xor ebx, ebx
push 0xcd
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
call fcn.0040887f
pop ecx
mov edi, 0x4241ac
push eax
mov ecx, edi
call fcn.00403dc6
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.004012d9
mov esi, str.funshion.tmp
push esi
call fcn.0040c433
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00403c69
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push dword [0x4241ac]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4089e2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.004012d9
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x40add9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ecx
push dword [ebp + 8]
push ebx
push ebx
call fcn.0040e776
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add esp, 0x18
push dword [ebp + 0xc]
lea ecx, [ebp + 8]
push eax
mov dword [ebp + 8], eax
mov dword [ebp - 8], ecx
mov byte [ebp - 4], bl
call esi
cmp eax, 0x102
jne 0x40ae18
push 0xffffffffffffffff
push dword [ebp + 8]
call esi
lea ecx, [ebp - 8]
call fcn.0040ad99
pop esi
pop ebx
leave
ret 8

Function at 0x40b53e
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9e4
mov eax, dword [0x423008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
push esi
mov ecx, edi
mov dword [ebp - 0x9e4], eax
call fcn.004040b2
push 0x41b830
lea ecx, [ebp - 0x9e0]
call fcn.00408ba6
push 0
push 0x28
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0040c433
pop ecx
push eax
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x9e0]
call fcn.00403ce9
push str._funshion.ini
lea ecx, [ebp - 0x9e0]
call fcn.004089f4
push dword [ebp - 0x9e0]
lea eax, [ebp - 0x9dc]
push 0x3e8
push eax
push esi
push dword [ebp - 0x9e4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, eax
lea eax, [ebp - 0x9dc]
push eax
mov ecx, edi
call fcn.004040b2
mov ecx, dword [ebp - 0x9e0]
add ecx, 0xfffffff0
call fcn.004012d9
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c55c
leave
ret 0x10

Function at 0x40b7a5
Capabilities:
Check internet connectivity via wininet
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], edi
call fcn.0040b3a0
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.0040b612
pop ecx
pop ecx
mov bl, al
push edi
neg bl
push 1
lea ecx, [ebp - 0x20]
sbb bl, bl
call fcn.0040b073
inc bl
je 0x40b7f0
xor al, al
jmp 0x40b83c
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x40], eax
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov eax, dword [ebp - 0x24]
and al, 4
sub al, 4
movzx eax, al
push edi
neg eax
push edi
sbb eax, eax
push edi
and eax, 4
push eax
push str.Mozilla_4.0__compatible__MSIE_7.0__Windows_NT_5.2__.NET_CLR_1.1.4322__.NET_CLR_2.0.50727_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 0x38], eax
cmp eax, edi
jne 0x40b833
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x4c], eax
jmp 0x40b7ec
mov ecx, esi
call fcn.0040ae26
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c55c
leave
ret 8
Function at 0x40bb90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x424220], 0
push esi
push edi
jne 0x40bb06
call fcn.0040ba72
test eax, eax
je 0x40bb4b
mov eax, dword [0x424220]
cmp eax, 1
jne 0x40bb27
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40bb4b
jmp 0x40bb8d
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x40bb8d
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40bb4f
xor eax, eax
jmp 0x40bb8d
mov eax, dword [esi]
push dword [0x424220]
call edi
mov edi, eax
test edi, edi
je 0x40bb71
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x40bb8d
lea edi, [esi + 0xff0]
push esi
push dword [0x424220]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x40bb77
mov eax, esi
pop edi
pop esi
ret
jmp 0x40baf2

Function at 0x40c55c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x423008]
jne 0x40c566
repz ret
jmp fcn.0040f7d0
Function at 0x413ac6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00410e1e
and dword [ebp - 0x14], 0
cmp dword [0x424fe8], 0
mov dword [ebp - 0x18], eax
jne 0x413b79
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x413c21
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x413c21
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x424fe8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x424fec], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x424ff0], eax
call edi
push eax
call esi
mov dword [0x424ff8], eax
test eax, eax
je 0x413b79
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x424ff4], eax
mov eax, dword [0x424ff4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x413bd2
cmp dword [0x424ff8], ecx
je 0x413bd2
push eax
call esi
push dword [0x424ff8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x413bd2
test ebx, ebx
je 0x413bd2
call edi
test eax, eax
je 0x413bc9
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x413bc9
test byte [ebp - 8], 1
jne 0x413bd2
or dword [ebp + 0x10], 0x200000
jmp 0x413c05
mov eax, dword [0x424fec]
cmp eax, dword [ebp - 0x18]
je 0x413c05
push eax
call esi
test eax, eax
je 0x413c05
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x413c05
mov eax, dword [0x424ff0]
cmp eax, dword [ebp - 0x18]
je 0x413c05
push eax
call esi
test eax, eax
je 0x413c05
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x424fe8]
call esi
test eax, eax
je 0x413c21
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x413c23
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c55c
leave
ret
Function at 0x401ef0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401dd0
test eax, eax
je 0x401f89
cmp dword [ebp - 0xc], 0
jbe 0x401f84
mov edx, dword [ebp - 0xc]
push edx
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401f2c
jmp 0x401ef6
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x401f63
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x401ef6
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
push str._s__d_r_n
call fcn.0040adc0
add esp, 0xc
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x401ef6
mov esp, ebp
pop ebp
ret 4

Function at 0x402140
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push str.GLOBAL__pipeNPXPipeClient
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea ecx, [ebp - 0xc]
push ecx
call fcn.00402080
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40217b
push 0x4105e0
call fcn.0040adc0
add esp, 4
mov eax, 0xc0000001
jmp 0x40219f
mov edx, dword [ebp - 4]
push edx
push 0x402000
push 0
push 0
push 0
push 0x1f03ff
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4021b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
xor eax, eax
mov word [ebp - 0x50], ax
push 0x4a
push 0
lea ecx, [ebp - 0x4e]
push ecx
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov dword [ebp - 0x68], 0x20001
mov dword [ebp - 0x64], 0x20002
mov dword [ebp - 0x60], 0x120000
mov dword [ebp - 0x5c], 0x1f000f
call dword [sym.imp.HAL.dll_KeGetCurrentIrql]
movzx edx, al
cmp edx, 1
jle 0x402221
call dword [sym.imp.HAL.dll_KeGetCurrentIrql]
movzx eax, al
push eax
push 0x4105f0
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
push 0
push 0x18
push str.DebugMask.c
push 0x410624
call dword [sym.imp.ntoskrnl.exe_RtlAssert]
push 0x410628
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edx, 0x4c
mov word [ebp - 0x50], dx
mov byte [ebp - 0x34], 1
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x30], 0
push 0x1e
push str.DbgkpDeleteObject
call fcn.0040b850
mov dword [ebp - 0x18], eax
push 0x14
push 0x410650
call fcn.0040b850
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x38], 0x1f000f
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
push 0x4154a4
push 0
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x58]
push edx
push 0x23
push str.ObCreateObjectType
call fcn.0040b790
call eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jge 0x4022c1
mov eax, dword [ebp - 0x6c]
jmp 0x4022c4
mov eax, dword [ebp - 0x6c]
mov esp, ebp
pop ebp
ret

Function at 0x403220
Capabilities:
Create device object
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x38], 0x403190
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x40], 0x4031e0
mov edx, dword [ebp + 8]
mov dword [edx + 0x70], 0x403000
push 0x411414
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0
push 0x22
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x403293
mov ecx, dword [ebp - 0x18]
push ecx
push 0x411434
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov eax, dword [ebp - 0x18]
jmp 0x4032eb
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x1c]
or eax, 4
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x1c], eax
push str.DosDevicesNPX
lea edx, [ebp - 8]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x4032e8
mov edx, dword [ebp - 0x18]
push edx
push 0x411478
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, dword [ebp - 0x18]
jmp 0x4032eb
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 4