joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f3a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 8], 0x3e3f3031
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x43f3fe
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x44a519f6
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x38
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x43f3d0
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 8]
mov ecx, dword [0x44ab98]
test ecx, ecx
je 0x43f45c
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
xor ebx, ebx
mov ebp, dword [0x44ab9c]
cmp dword [ebp + ebx*8], 0x72e9dc72
je 0x43f431
inc ebx
cmp ecx, ebx
jne 0x43f420
jmp 0x43f45c
mov ecx, dword [ebp + ebx*8 + 4]
cmp ecx, eax
je 0x43f45c
lea eax, [esp + 0x10]
push 0
push 0
push edi
push edx
push eax
push 0
push 0
push 0
push esi
push 9
push dword [0x44aba0]
push ecx
call fcn.0043cdc0
add esp, 0x30
mov edi, dword [esp + 0x38]
cmp eax, 0x103
jne 0x43f516
mov dword [esp + 8], 0x3e3f3031
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 6
ja 0x43f4c1
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x44a519f6
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x38
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 7
jb 0x43f490
mov eax, dword [esp + 8]
mov ecx, dword [0x44ab98]
test ecx, ecx
je 0x43f50e
xor edx, edx
mov ebx, dword [0x44ab9c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x7e28bda7
je 0x43f4f0
inc edx
cmp ecx, edx
jne 0x43f4e0
jmp 0x43f50e
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x43f50e
push 0
push 0
push esi
push 3
push dword [0x44aba0]
push ecx
call fcn.0043cdc0
add esp, 0x18
test eax, eax
js 0x43f516
mov eax, dword [esp + 0x10]
test edi, edi
je 0x43f529
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43f527
mov ecx, dword [esp + 0x14]
mov dword [edi], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f540
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 8], 0x3e3f3031
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x43f59e
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x44a519f6
xor eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0x38
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x43f570
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 8]
mov ecx, dword [0x44ab98]
test ecx, ecx
je 0x43f5fc
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
xor ebx, ebx
mov ebp, dword [0x44ab9c]
cmp dword [ebp + ebx*8], 0xe6919031
je 0x43f5d1
inc ebx
cmp ecx, ebx
jne 0x43f5c0
jmp 0x43f5fc
mov ecx, dword [ebp + ebx*8 + 4]
cmp ecx, eax
je 0x43f5fc
lea eax, [esp + 0x10]
push 0
push 0
push edi
push edx
push eax
push 0
push 0
push 0
push esi
push 9
push dword [0x44aba0]
push ecx
call fcn.0043cdc0
add esp, 0x30
mov edi, dword [esp + 0x38]
cmp eax, 0x103
jne 0x43f6b6
mov dword [esp + 8], 0x3e3f3031
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 6
ja 0x43f661
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x44a519f6
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x38
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 7
jb 0x43f630
mov eax, dword [esp + 8]
mov ecx, dword [0x44ab98]
test ecx, ecx
je 0x43f6ae
xor edx, edx
mov ebx, dword [0x44ab9c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x7e28bda7
je 0x43f690
inc edx
cmp ecx, edx
jne 0x43f680
jmp 0x43f6ae
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, eax
je 0x43f6ae
push 0
push 0
push esi
push 3
push dword [0x44aba0]
push ecx
call fcn.0043cdc0
add esp, 0x18
test eax, eax
js 0x43f6b6
mov eax, dword [esp + 0x10]
test edi, edi
je 0x43f6c0
mov ecx, dword [esp + 0x14]
mov dword [edi], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f6d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
mov edi, dword [esp + 0x44]
mov ebx, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x43f6f0
sar ebx, 1
mov ebp, ebx
and ebp, 0xfffd
mov ecx, ebx
and ecx, 2
or ebx, 2
imul ebx, ecx
xor ecx, 2
imul ecx, ebp
lea ebp, [ecx + ebx]
mov word [esp + 0xc], bp
add ecx, ebx
add ecx, 2
mov word [esp + 0xe], cx
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 0x40
lea eax, [esp + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0x3e3f3031
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x43f7ae
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
add eax, 0x44a519f6
xor eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add al, 0x38
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x43f780
mov eax, dword [esp + 4]
mov edi, dword [0x44ab98]
test edi, edi
je 0x43f805
xor ebx, ebx
mov ebp, dword [0x44ab9c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0x81105f7a
je 0x43f7e1
inc ebx
cmp edi, ebx
jne 0x43f7d0
jmp 0x43f805
mov edi, dword [ebp + ebx*8 + 4]
cmp edi, eax
je 0x43f805
lea eax, [esp + 0x18]
push esi
push eax
push edx
push dword [esp + 0x54]
push 4
push dword [0x44aba0]
push edi
call fcn.0043cdc0
add esp, 0x1c
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x405050
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.HAL.dll_KeGetCurrentIrql]
push edi
call esi
cmp al, 1
jbe 0x405077
call esi
movzx eax, al
push eax
push str.EX:_Pageable_code_called_at_IRQL__d_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
int 0x2c
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.ntoskrnl.exe_RtlAssert]
test ebx, ebx
jne 0x405097
push 0
push 0x4c2
push str.UFileEncyptionDriver.c
push str.DeviceObject___NULL
call edi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4050b0
push esi
push 0x4c3
push str.UFileEncyptionDriver.c
push str.Irp___NULL
call edi
mov ecx, dword [ebx + 0x28]
xor eax, eax
mov dword [ecx], eax
pop edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4050d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [sym.imp.HAL.dll_KeGetCurrentIrql]
call esi
cmp al, 1
jbe 0x4050f8
call esi
movzx eax, al
push eax
push str.EX:_Pageable_code_called_at_IRQL__d_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
int 0x2c
push 0
push 0
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 0x18]
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp + 0x14]
lea eax, [ebp - 8]
push eax
xor eax, eax
cmp byte [ebp + 0x1c], al
push ecx
sete al
push edx
push esi
add eax, 3
push eax
call dword [sym.imp.ntoskrnl.exe_IoBuildSynchronousFsdRequest]
test eax, eax
jne 0x40514c
mov eax, 0xc000009a
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov edx, eax
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
cmp eax, 0x103
jne 0x405172
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov eax, dword [ebp - 0x10]
pop esi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x405180
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.HAL.dll_KeGetCurrentIrql]
push edi
call esi
cmp al, 1
jbe 0x4051a7
call esi
movzx eax, al
push eax
push str.EX:_Pageable_code_called_at_IRQL__d_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
int 0x2c
mov eax, dword [ebp + 0xc]
mov esi, eax
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4051b0
sub eax, edx
sar eax, 1
lea ebx, [eax - 9]
xor edi, edi
test ebx, ebx
jle 0x4051e4
push 9
push str.Harddisk
push esi
call sub.ntoskrnl.exe__wcsnicmp
add esp, 0xc
test eax, eax
je 0x4051ee
inc edi
add esi, 2
cmp edi, ebx
jl 0x4051c8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret 8
movzx eax, word [esi + 0x12]
add esi, 0x12
xor ecx, ecx
xor dl, dl
cmp eax, 0x30
jb 0x4051e4
mov edi, edi
cmp ax, 0x39
ja 0x405227
movzx edx, ax
movzx eax, word [esi + 2]
add esi, 2
lea ecx, [ecx + ecx*4]
lea ecx, [edx + ecx*2 - 0x30]
mov dl, 1
cmp eax, 0x30
jae 0x405200
pop edi
pop esi
mov eax, ecx
pop ebx
pop ebp
ret 8
test dl, dl
je 0x4051e4
pop edi
pop esi
mov eax, ecx
pop ebx
pop ebp
ret 8
Function at 0x405240
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.HAL.dll_KeGetCurrentIrql]
push edi
call esi
cmp al, 1
jbe 0x40526a
call esi
movzx eax, al
push eax
push str.EX:_Pageable_code_called_at_IRQL__d_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
int 0x2c
mov ecx, dword [ebp + 0xc]
push str.DriverDisk
lea edx, [ebp - 0x10]
push edx
mov dword [ecx], 0
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ecx, dword [sym.imp.ntoskrnl.exe_IoDriverObjectType]
mov edx, dword [ecx]
lea eax, [ebp - 8]
push eax
mov eax, dword [edx]
push 0
push 0
push eax
push 0
push 0
push 0x40
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByName]
test eax, eax
js 0x40538d
mov edx, dword [ebp - 8]
mov ebx, dword [edx + 4]
test ebx, ebx
je 0x40538d
jmp 0x4052c0
cmp dword [ebx + 0x2c], 7
jne 0x405382
test byte [ebx + 0x1c], 0x40
je 0x405382
mov esi, dword [sym.imp.ntoskrnl.exe_ObQueryNameString]
lea eax, [ebp - 4]
push eax
push 0
push 0
push ebx
call esi
mov ecx, dword [ebp - 4]
push 0x20734649
push ecx
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
test edi, edi
je 0x40539b
mov eax, dword [ebp - 4]
lea edx, [ebp - 4]
push edx
push eax
push edi
push ebx
call esi
test eax, eax
jne 0x405379
mov edx, dword [edi + 4]
test edx, edx
je 0x405379
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405320
sub eax, esi
sar eax, 1
lea esi, [edx + eax*2]
cmp esi, edx
jbe 0x405379
push 3
push 0x40373c
push esi
call sub.ntoskrnl.exe__wcsnicmp
add esp, 0xc
test eax, eax
je 0x405368
push 4
push str.DP_
push esi
call sub.ntoskrnl.exe__wcsnicmp
add esp, 0xc
test eax, eax
je 0x405379
sub esi, 2
cmp esi, dword [edi + 4]
ja 0x405336
jmp 0x405379
mov ecx, dword [edi + 4]
mov edx, dword [edi]
push ecx
push edx
call fcn.00405180
cmp eax, dword [ebp + 8]
je 0x4053a9
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ebx, dword [ebx + 0xc]
test ebx, ebx
jne 0x4052c0
pop edi
pop esi
mov eax, 0xc000000e
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, 0xc000009a
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax], ebx
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x405500
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.HAL.dll_KeGetCurrentIrql]
push edi
call esi
cmp al, 1
jbe 0x405527
call esi
movzx eax, al
push eax
push str.EX:_Pageable_code_called_at_IRQL__d_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
int 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [sym.imp.ntoskrnl.exe_RtlAssert]
test ebx, ebx
jne 0x405547
push 0
push 0x46f
push str.UFileEncyptionDriver.c
push str.DeviceObject___NULL
call esi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x405560
push edi
push 0x470
push str.UFileEncyptionDriver.c
push str.Irp___NULL
call esi
mov esi, dword [ebx + 0x28]
mov edi, dword [edi + 0xc]
mov ecx, dword [edi + 0x1c]
push esi
push ecx
call fcn.00405240
test eax, eax
js 0x40564b
mov edx, dword [edi + 0x18]
and dword [ebx + 0x20], 0xfffffffd
dec edx
mov dword [ebx + 0x5c], edx
mov ecx, dword [edi + 0x14]
mov edx, dword [edi + 0x10]
mov eax, dword [edi + 0x18]
push ecx
push edx
push 0
push eax
call sub.ntoskrnl.exe__allmul
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov eax, dword [edi + 8]
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x18], edx
mov eax, dword [edi + 0x14]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x24]
mov ecx, dword [edi + 0x18]
xor ebx, ebx
mov dword [esi + 0x20], ecx
cmp eax, ebx
je 0x4055ce
push ebx
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [esi + 0x24], ebx
mov edx, dword [esi + 0x20]
add edx, edx
push edx
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov ecx, dword [esi + 0x20]
push 1
add ecx, ecx
push ecx
push eax
xor edx, edx
push edx
mov dword [esi + 0x24], eax
mov eax, dword [esi]
push ecx
push eax
call fcn.004050d0
mov edi, eax
cmp edi, ebx
jge 0x40561e
push str.Load_Key_Buffer_Error__n
call sub.ntoskrnl.exe_DbgPrint
mov ecx, dword [esi + 0x24]
add esp, 4
push ebx
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
pop edi
mov dword [esi + 0x24], ebx
pop esi
pop ebx
pop ebp
ret 8
mov edx, dword [esi + 0x24]
mov ecx, dword [esi + 0x20]
mov edi, edx
xor ebx, ebx
lea eax, [ecx + edi]
test ecx, ecx
je 0x40563e
nop
mov cl, byte [edi]
cmp cl, byte [eax]
jne 0x405652
inc ebx
inc edi
inc eax
cmp ebx, dword [esi + 0x20]
jb 0x405630
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
push 0
push edx
mov dword [ebp + 8], eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [ebp + 8]
mov dword [esi + 0x24], 0
movzx eax, byte [edx]
movzx ecx, byte [edi]
push eax
push ecx
push ebx
push str.Key_Buffer_compare_Error__d_0x_x_0x_x__n
call sub.ntoskrnl.exe_DbgPrint
add esp, 0x10
pop edi
pop esi
mov eax, 0xc000003d
pop ebx
pop ebp
ret 8
Function at 0x405690
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.HAL.dll_KeGetCurrentIrql]
push edi
call esi
cmp al, 1
jbe 0x4056b7
call esi
movzx eax, al
push eax
push str.EX:_Pageable_code_called_at_IRQL__d_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
int 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [sym.imp.ntoskrnl.exe_RtlAssert]
test ebx, ebx
jne 0x4056d7
push 0
push 0x5bc
push str.UFileEncyptionDriver.c
push str.DeviceObject___NULL
call esi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x4056f0
push edi
push 0x5bd
push str.UFileEncyptionDriver.c
push str.Irp___NULL
call esi
mov esi, dword [edi + 0xc]
mov eax, dword [esi + 0x14]
mov ecx, dword [ebx + 0x28]
lea edx, [ebp + 8]
push edx
push eax
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], 0
call fcn.00405240
mov ebx, eax
test ebx, ebx
jns 0x40572a
push ebx
push str.Disk_Direct_Read_On_Seek__0x_x_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
mov ecx, dword [esi + 0x10]
mov eax, dword [edi + 0xc]
push 1
mov dword [edi + 0x1c], ecx
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
push edx
mov edx, dword [esi + 8]
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call fcn.004050d0
mov ebx, eax
test ebx, ebx
jns 0x40576f
push ebx
push str.Disk_Direct_Read__0x_x_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov dword [edi + 0x1c], 0
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
cmp dword [esi + 0x18], 0
je 0x405793
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x24], 0
je 0x405793
mov ecx, dword [eax + 0x20]
push ecx
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
Function at 0x4057a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.HAL.dll_KeGetCurrentIrql]
push edi
call esi
cmp al, 1
jbe 0x4057c7
call esi
movzx eax, al
push eax
push str.EX:_Pageable_code_called_at_IRQL__d_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
int 0x2c
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.ntoskrnl.exe_RtlAssert]
test esi, esi
jne 0x4057e7
push 0
push 0x5fe
push str.UFileEncyptionDriver.c
push str.DeviceObject___NULL
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x405800
push edi
push 0x5ff
push str.UFileEncyptionDriver.c
push str.Irp___NULL
call ebx
mov edi, dword [edi + 0xc]
mov edx, dword [edi + 0x14]
mov esi, dword [esi + 0x28]
lea ecx, [ebp + 8]
push ecx
push edx
mov dword [ebp + 8], 0
call fcn.00405240
mov ebx, eax
test ebx, ebx
jns 0x405837
push ebx
push str.Disk_Direct_write_On_Seek__0x_x_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
mov eax, dword [edi + 0x18]
cmp eax, 0x10aa
jne 0x40588f
mov eax, dword [esi + 0x24]
test eax, eax
je 0x405858
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [esi + 0x24], 0
mov eax, dword [edi + 0x10]
mov dword [esi + 0x20], eax
add eax, eax
push eax
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov ecx, dword [esi + 0x20]
push ecx
lea ebx, [edi + 0x1c]
push ebx
push eax
mov dword [esi + 0x24], eax
call sub.ntoskrnl.exe_memcpy
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
push eax
add edx, eax
push ebx
push edx
call sub.ntoskrnl.exe_memcpy
add esp, 0x18
jmp 0x4058ae
test eax, eax
je 0x4058ae
cmp dword [esi + 0x24], 0
je 0x4058ae
mov eax, dword [esi + 0x20]
push eax
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [edi + 0x10]
mov eax, dword [edi + 0xc]
push 0
push ecx
mov ecx, dword [edi + 8]
lea edx, [edi + 0x1c]
push edx
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call fcn.004050d0
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x1c], 0
test esi, esi
jns 0x4058e7
push esi
push str.Disk_Direct_Write__0x_x_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40686f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x404180]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
lea edx, [ebp - 0x18]
push edx
push 0x10
lea edx, [ebp - 0x14]
push edx
push 2
push ecx
push eax
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
jl 0x4068b7
cmp dword [ebp - 0x10], 4
jne 0x4068b2
mov esi, dword [ebp - 8]
jmp 0x4068b7
mov eax, 0xc0000024
mov ecx, dword [ebp - 4]
mov dword [edi], esi
pop edi
xor ecx, ebp
pop esi
call fcn.00401a86
leave
ret 0x10
Function at 0x4068c9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x18]
and dword [eax], 0
push esi
mov esi, dword [ebp + 0xc]
movzx eax, word [esi]
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0x14]
add eax, 0x1b
and eax, 0xfffffffc
push eax
mov dword [ebp - 4], eax
call fcn.00401a4a
test eax, eax
jge 0x406900
mov eax, 0xc0000095
jmp 0x4069b9
push edi
push 0x62527050
push dword [ebp - 4]
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
test edi, edi
jne 0x406921
mov eax, 0xc000009a
jmp 0x4069b8
push ebx
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push edi
push 1
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
call esi
mov ebx, eax
test ebx, ebx
jge 0x40699d
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp ebx, 0x80000005
je 0x40695b
cmp ebx, 0xc0000023
je 0x40695b
mov eax, ebx
jmp 0x4069b7
push 0x62527050
push dword [ebp + 0x14]
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
test edi, edi
jne 0x406978
mov eax, 0xc000009a
jmp 0x4069b7
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x14]
push edi
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jge 0x40699d
mov esi, eax
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
jmp 0x4069b7
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4069b0
cmp dword [edi + 4], eax
je 0x4069b0
mov esi, 0xc0000024
jmp 0x406990
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 0x14

Function at 0x406b0f
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 0x10]
movzx ecx, word [esi]
movzx edx, word [esi + 2]
movzx eax, cx
sub edx, eax
push edi
cmp edx, 2
jb 0x406b53
mov ecx, dword [esi + 4]
shr eax, 1
xor edx, edx
mov word [ecx + eax*2], dx
movzx eax, word [esi]
inc eax
inc eax
push eax
push dword [esi + 4]
push 1
push edx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov edi, eax
jmp 0x406bb0
push ecx
lea eax, [ebp - 8]
push eax
call fcn.00406ace
mov edi, eax
test edi, edi
jl 0x406bb0
movzx eax, word [esi]
mov word [ebp - 8], ax
movzx eax, ax
push eax
push dword [esi + 4]
push dword [ebp - 4]
call sub.ntoskrnl.exe_memcpy
movzx eax, word [ebp - 8]
mov edx, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
mov word [edx + eax*2], cx
movzx eax, word [ebp - 8]
add esp, 0xc
inc eax
inc eax
push eax
push dword [ebp - 4]
push 1
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov edi, eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov eax, edi
pop edi
pop esi
leave
ret 0xc