joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4567154a
Capabilities:
Get os information via kuser_shared_data
Get windows directory from kuser_shared_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.456714ad
test eax, eax
je 0x4567167e
mov esi, 0x800
mov eax, esi
call fcn.45674280
mov edi, esp
xor eax, eax
mov ecx, 0x7ffe0030
mov word [ebp - 8], ax
mov word [ebp - 6], si
mov dword [ebp - 4], edi
movzx eax, word [ecx]
movzx edx, word [ebp - 8]
mov esi, dword [ebp - 4]
mov word [esi + edx*2], ax
inc word [ebp - 8]
inc ecx
inc ecx
cmp ax, 0x5c
jne 0x45671583
shl word [ebp - 8], 1
cmp dword [0x7ffe026c], 6
mov eax, 0x456769b0
jb 0x456715b4
mov eax, str._Recycle.Bin_
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
mov ax, word [ebp - 8]
sub word [ebp - 6], ax
movzx ecx, ax
add dword [ebp - 4], ecx
xor eax, eax
push eax
mov word [ebp - 8], ax
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlConvertSidToUnicodeString]
test eax, eax
jl 0x4567167e
movzx eax, word [ebp - 8]
movzx ecx, word [ebp - 6]
sub ecx, eax
cmp ecx, 0x50
jb 0x4567167e
movzx ecx, byte [ebp - 9]
push ecx
movzx ecx, byte [ebp - 0xa]
push ecx
movzx ecx, byte [ebp - 0xb]
push ecx
movzx ecx, byte [ebp - 0xc]
push ecx
movzx ecx, byte [ebp - 0xd]
push ecx
movzx ecx, byte [ebp - 0xe]
push ecx
movzx ecx, byte [ebp - 0xf]
push ecx
movzx ecx, byte [ebp - 0x10]
push ecx
movzx ecx, word [ebp - 0x12]
push ecx
movzx ecx, word [ebp - 0x14]
push ecx
push dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
add eax, ecx
push str.__08x_04x_04x_02x_02x_02x_02x_02x_02x_02x_02x_
push eax
call dword [sym.imp.ntdll.dll_swprintf]
push edi
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 0x38
push 2
pop edx
inc eax
xor ecx, ecx
mul edx
seto cl
neg ecx
or eax, ecx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x45678248], eax
test eax, eax
je 0x4567167e
push edi
push eax
call dword [sym.imp.ntdll.dll_wcscpy]
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x45671680
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
leave
ret 4

Function at 0x4567178a
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
sub eax, 0
je 0x456717d7
dec eax
jne 0x456717f7
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push dword [esp + 4]
call fcn.4567174e
call fcn.45671689
test eax, eax
je 0x456717f7
call fcn.45671715
test eax, eax
je 0x456717f7
push 0
push 0
push dword [esp + 0xc]
push 0x45671362
push 0x80000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x456717f0
mov eax, dword [0x45678248]
test eax, eax
je 0x456717e7
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x4567824c]
test eax, eax
je 0x456717f7
push eax
call dword [sym.imp.ntdll.dll_ZwClose]
xor eax, eax
inc eax
ret 0xc
Function at 0x45671a5e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov al, byte [0x45678254]
push esi
movzx eax, al
push edi
call fcn.45674280
xor esi, esi
mov dword [ebp - 8], esp
xor edi, edi
mov dword [ebp - 4], 0x40
mov eax, dword [ebp - 4]
cmp edi, eax
jae 0x45671a96
sub eax, edi
call fcn.45674280
mov edi, dword [ebp - 8]
mov esi, esp
sub edi, esi
lea eax, [ebp - 4]
push eax
push edi
push esi
push 2
push dword [ebp + 8]
push dword [ebx + 4]
call dword [sym.imp.ntdll.dll_ZwQueryValueKey]
cmp eax, 0x80000005
je 0x45671a81
test eax, eax
jl 0x45671b76
cmp dword [esi + 4], 1
jne 0x45671b76
mov eax, dword [esi + 8]
cmp eax, 2
jbe 0x45671b76
test al, 1
jne 0x45671b76
cmp word [eax + esi + 0xa], 0
jne 0x45671b76
mov eax, dword [ebx + 8]
mov cx, word [esi + 8]
mov word [eax + 2], cx
mov ax, word [esi + 8]
mov ecx, dword [ebx + 8]
sub ax, 2
mov word [ecx], ax
mov ecx, dword [ebx + 8]
lea eax, [esi + 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebx + 8]
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x14], 0x40
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
push 0x20019
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntdll.dll_ZwOpenKey]
test eax, eax
jl 0x45671b76
lea eax, [ebp - 4]
push eax
push 0x10
push esi
push 2
push 0x45676b24
push dword [ebp - 0x1c]
call dword [sym.imp.ntdll.dll_ZwQueryValueKey]
test eax, eax
jl 0x45671b6d
cmp dword [esi + 4], 4
mov eax, dword [esi + 0xc]
jne 0x45671b6d
test eax, eax
je 0x45671b6d
lea ecx, [ebp - 0x20]
push ecx
push 0x45676b2c
push eax
call dword [ebp + 0xc]
push dword [ebp - 0x1c]
call dword [sym.imp.ntdll.dll_ZwClose]
lea esp, [ebp - 0x28]
pop edi
pop esi
leave
ret 8

Function at 0x45671bec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
xor esi, esi
push esi
push esi
push 0x20
push 5
push 7
xor eax, eax
push 6
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4567808c
push 0x100024
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_ZwCreateFile]
test eax, eax
jl 0x45671c78
push esi
push esi
push ebx
push 0x45675258
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_ZwWriteFile]
mov edi, dword [sym.imp.ntdll.dll_ZwClose]
test eax, eax
jl 0x45671c73
push dword [ebp - 4]
lea eax, [ebp - 8]
push 0x1000000
push 0x10
push esi
push 0x4567815c
push 0xf001f
push eax
call dword [sym.imp.ntdll.dll_ZwCreateSection]
test eax, eax
jl 0x45671c73
push dword [ebp - 8]
call edi
push dword [ebp - 4]
call edi
pop edi
pop esi
leave
ret
Function at 0x45671da1
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 1]
push eax
xor edi, edi
push edi
push 1
push 0x14
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
mov al, byte [0x45678254]
movzx eax, al
xor esi, esi
mov dword [ebp - 8], 0x10000
call fcn.45674280
mov ebx, esp
mov eax, dword [ebp - 8]
cmp esi, eax
jae 0x45671de8
sub eax, esi
call fcn.45674280
mov edi, esp
mov eax, ebx
sub eax, edi
mov esi, eax
lea eax, [ebp - 8]
push eax
push esi
push edi
push 5
call dword [sym.imp.ntdll.dll_ZwQuerySystemInformation]
cmp eax, 0xc0000004
je 0x45671dd2
test eax, eax
jl 0x45671e19
mov eax, edi
xor ecx, ecx
add eax, ecx
cmp dword [eax + 4], 0
je 0x45671e13
cmp dword [eax + 0x48], 0
jne 0x45671e23
mov ecx, dword [eax]
test ecx, ecx
jne 0x45671e05
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret
add eax, 0xd8
push eax
call fcn.45671d23
jmp 0x45671e1b

Function at 0x45671eb7
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
push ebx
push esi
push edi
push 0x45678028
push 0x100000
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ntdll.dll_ZwCreateEventPair]
mov esi, eax
cmp esi, 0x40000000
jne 0x45671eef
push dword [esp + 0x10]
call dword [sym.imp.ntdll.dll_ZwSetHighWaitLowEventPair]
xor edi, edi
cmp esi, edi
jl 0x45671f8f
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x45671f7b
call fcn.456734b8
test eax, eax
je 0x45671f75
push dword [ebp + 8]
call fcn.45672a71
test eax, eax
je 0x45671f75
push dword [ebp + 0xc]
call fcn.45672de8
test eax, eax
je 0x45671f75
call fcn.456739f1
test eax, eax
je 0x45671f75
call fcn.45673eef
test eax, eax
je 0x45671f75
push 0x20
push 0x3e8
push edi
push edi
push 0x45673f38
push edi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test eax, eax
je 0x45671f75
push dword [esp + 0x10]
call dword [sym.imp.ntdll.dll_ZwWaitHighEventPair]
push 0xffffffffffffffff
push dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
call dword [sym.imp.WS2_32.dll_WSACleanup]
push dword [esp + 0x10]
call dword [sym.imp.ntdll.dll_ZwSetLowEventPair]
push dword [esp + 0x10]
call dword [sym.imp.ntdll.dll_ZwClose]
mov byte [0x45678256], 1
cmp dword [0x45679bcc], edi
je 0x45671fda
mov ebx, 0x45679bd8
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x45678008]
mov edi, 0x45678008
mov esi, eax
cmp eax, edi
je 0x45671fd3
test esi, esi
je 0x45671fc3
lea eax, [esi - 0x78]
jmp 0x45671fc5
xor eax, eax
lea ecx, [eax + 8]
call fcn.45672200
mov esi, dword [esi]
cmp esi, edi
jne 0x45671fba
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.45673ac3
call fcn.45672144
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call esi
cmp byte [0x45678255], 0
je 0x45671fea
push 0x7d0
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x456721b5
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 1
push 0
push 0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov ecx, dword [esp + 4]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x456721da
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x456721fd
push 0
push 0x456720aa
push eax
call dword [sym.imp.KERNEL32.dll_BindIoCompletionCallback]
test eax, eax
je 0x456721f0
xor eax, eax
jmp 0x456721fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
ret 4

Function at 0x45672520
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, eax
bt dword [esi + 0x74], 2
jae 0x45672537
xor eax, eax
jmp 0x456725cf
push edi
xor edi, edi
cmp dword [esi + 0x10], edi
jne 0x45672547
xor eax, eax
inc eax
jmp 0x456725ce
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
sub ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 8]
lea eax, [ecx + eax + 0xc]
mov dword [ebp - 0xc], eax
jne 0x45672564
push 0x7a
pop eax
jmp 0x456725ce
lea edx, [esi + 0x68]
call fcn.456720f9
test eax, eax
jne 0x45672577
mov eax, 0x45d
jmp 0x456725ce
mov eax, dword [esi + 0x10]
push ebx
push 0x76636572
mov ecx, esi
call fcn.45672158
mov ebx, eax
cmp ebx, edi
jne 0x4567259a
push dword [esi + 0x70]
call fcn.45672664
push 8
pop eax
jmp 0x456725cd
push edi
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
mov dword [ebp - 4], edi
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x456725c2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x456725c4
xor eax, eax
mov edi, eax
mov esi, ebx
call fcn.456720c0
pop ebx
pop edi
pop esi
leave
ret

Function at 0x456725d2
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, eax
mov esi, ecx
test edi, edi
jne 0x456725e5
mov edi, dword [esi + 0x10]
lea edx, [esi + 0x68]
call fcn.456720f9
test eax, eax
jne 0x456725f8
mov eax, 0x45d
jmp 0x45672660
push ebx
push 0x646e6573
mov eax, edi
mov ecx, esi
call fcn.45672158
mov ebx, eax
test ebx, ebx
jne 0x4567261a
push dword [esi + 0x70]
call fcn.45672664
push 8
pop eax
jmp 0x4567265f
mov eax, dword [edi + 8]
add edi, 0xc
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edi
lea eax, [esi + 0x6c]
inc ecx
lock xadd dword [eax], ecx
push 0
push ebx
push 0
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x45672654
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x45672656
xor eax, eax
mov edi, eax
mov esi, ebx
call fcn.456720c0
pop ebx
pop edi
pop esi
leave
ret
Function at 0x456727bc
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 1
push 0
push 0
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov ecx, eax
mov dword [esi + 8], ecx
cmp ecx, 0xffffffff
jne 0x456727e6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x45672859
push edi
push 2
pop eax
mov word [ebp - 0x10], ax
mov ax, word [ebp + 8]
mov word [ebp - 0xe], ax
push 4
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
push 0x456781b8
push 0x20
stosd dword es:[edi], eax
push 0xffff
push ecx
stosd dword es:[edi], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_bind]
pop edi
test eax, eax
je 0x4567282f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x45672831
xor eax, eax
test eax, eax
jne 0x45672859
push eax
push 0x456720aa
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_BindIoCompletionCallback]
test eax, eax
je 0x4567284c
xor eax, eax
jmp 0x45672859
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
leave
ret 4

Function at 0x4567285d
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push 0x646e6573
mov ecx, ebx
mov edi, eax
call fcn.45672158
mov esi, eax
test esi, esi
jne 0x4567287e
push 8
pop eax
jmp 0x456728da
mov eax, dword [edi + 8]
push 2
mov dword [ebp - 0xc], eax
pop eax
mov word [ebp - 0x1c], ax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x1a], ax
add edi, 0xc
xor eax, eax
mov dword [ebp - 8], edi
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push esi
push 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
push dword [ebx + 8]
call dword [sym.imp.WS2_32.dll_WSASendTo]
test eax, eax
je 0x456728d1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x456728d3
xor eax, eax
mov edi, eax
call fcn.456720c0
pop edi
pop esi
leave
ret 8

Function at 0x456728e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, eax
push 0x76636572
mov eax, ebx
mov ecx, edi
call fcn.45672158
mov esi, eax
test esi, esi
jne 0x45672903
push 8
pop eax
jmp 0x45672955
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 4]
sub ecx, eax
push 0
lea eax, [eax + ebx + 0xc]
push esi
mov dword [ebp - 8], eax
lea eax, [edi + 0x24]
push eax
lea edx, [edi + 0x10]
push edx
mov dword [ebp - 0xc], ecx
lea ecx, [edi + 0x20]
and dword [ecx], 0
push ecx
mov dword [eax], 0x10
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
push dword [edi + 8]
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
test eax, eax
je 0x4567294c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x4567294e
xor eax, eax
mov edi, eax
call fcn.456720c0
pop edi
pop esi
leave
ret
Function at 0x45672a71
Capabilities:
Map section object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0x20
push 7
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push 0x12019f
xor esi, esi
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.ntdll.dll_ZwOpenFile]
test eax, eax
jl 0x45672b21
push edi
push dword [ebp - 4]
lea eax, [ebp + 8]
push 0x8000000
push 4
push 0x456781c0
push esi
push 0xf001f
push eax
call dword [sym.imp.ntdll.dll_ZwCreateSection]
mov edi, dword [sym.imp.ntdll.dll_ZwClose]
test eax, eax
jl 0x45672b1b
push 4
push esi
push 2
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push 0x45678274
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_ZwMapViewOfSection]
test eax, eax
jl 0x45672b16
mov eax, 0x100
cmp dword [0x45678270], eax
jae 0x45672b16
mov ecx, dword [0x45678274]
add ecx, 4
mov edx, dword [ecx]
add ecx, 8
test edx, edx
je 0x45672b16
inc dword [0x45678270]
cmp dword [0x45678270], eax
jb 0x45672aff
push dword [ebp + 8]
call edi
push dword [ebp - 4]
call edi
pop edi
xor eax, eax
cmp dword [0x45678274], esi
pop esi
setne al
leave
ret 4

Function at 0x45672d74
Capabilities:
Map section object

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push dword [ebp + 0xc]
xor esi, esi
push 0x8000000
push 8
push esi
push esi
push 6
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_ZwCreateSection]
test eax, eax
jl 0x45672de1
push 8
push esi
push 2
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
mov dword [ebp + 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ntdll.dll_ZwMapViewOfSection]
test eax, eax
jl 0x45672dd8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.456735ab
push dword [ebp + 0xc]
mov esi, eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_ZwUnmapViewOfSection]
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_ZwClose]
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x45672de8
Capabilities:
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
push ebx
push esi
push edi
push 0x21
push 7
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
push 0x12019f
push 0x456782fc
call dword [sym.imp.ntdll.dll_ZwOpenFile]
test eax, eax
jge 0x45672e1a
xor eax, eax
jmp 0x45672f93
mov ebx, 0x1000
mov eax, ebx
call fcn.45674280
mov dword [ebp - 0x14], esp
push 0x14
pop eax
mov word [ebp - 0x20], ax
mov word [ebp - 0x1e], ax
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
mov eax, dword [0x456782fc]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x44], 0x18
mov dword [ebp - 0x38], 0x40
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
mov dword [ebp + 8], 0x45678300
stosd dword es:[edi], eax
mov dword [ebp - 8], 0x10
xor esi, esi
jmp 0x45672f6b
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0xc], esi
add edi, dword [ebp - 0xc]
push 0x10
mov eax, dword [edi]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0xc], eax
lea eax, [edi + 0x40]
push ecx
push eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.ntdll.dll_wcstoul]
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp eax, esi
je 0x45672f62
mov eax, dword [ebp - 0x2c]
cmp word [eax], 0x2e
jne 0x45672f62
cmp dword [edi + 0x2c], esi
jne 0x45672f62
push 0x20
push 7
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x44]
push eax
push 0x120089
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_ZwOpenFile]
test eax, eax
jl 0x45672f4e
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.ADVAPI32.dll_MD5Init]
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.45672d18
test eax, eax
je 0x45672f40
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
cmp dword [eax], ecx
jne 0x45672f40
mov ecx, dword [eax + 8]
cmp ecx, dword [edi + 0x28]
jne 0x45672f40
push eax
lea eax, [ebp - 0xb4]
call fcn.4567351d
test eax, eax
je 0x45672f40
mov eax, dword [ebp + 8]
push dword [eax + 8]
lea eax, [ebp - 0xb4]
push dword [ebp - 0x10]
push eax
call fcn.45672d74
test eax, eax
je 0x45672f40
push esi
push dword [ebp - 0x18]
call fcn.45671167
add dword [ebp + 8], 0x8c
dec dword [ebp - 8]
push dword [ebp - 0x10]
call dword [sym.imp.ntdll.dll_ZwClose]
cmp dword [ebp - 8], esi
je 0x45672f90
mov ecx, dword [ebp - 0x1c]
push 0x7e
pop eax
mov word [ecx + 0x12], ax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.ntdll.dll_ZwDeleteFile]
cmp dword [ebp - 0xc], esi
jne 0x45672e78
push esi
push 0x45676dc8
push esi
push 1
push ebx
push dword [ebp - 0x14]
lea eax, [ebp - 0x28]
push eax
push esi
push esi
push esi
push dword [ebp - 0x40]
call dword [sym.imp.ntdll.dll_ZwQueryDirectoryFile]
test eax, eax
jge 0x45672e72
xor eax, eax
inc eax
lea esp, [ebp - 0xc4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4567300b
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x23
xor ebx, ebx
pop ecx
mov eax, 0x8c
mov word [esp + 0x8e], ax
mov dword [esp + 0x88], ebx
mov byte [esp + 0x8c], bl
mov byte [esp + 0x8d], 3
mov dword [esp + 0x90], 0x524556
lea edi, [esp + 0x94]
rep movsd dword es:[edi], dword [esi]
push dword [esp + 0x94]
lea eax, [esp + 0x4c]
push str._08x._
push eax
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ntdll.dll_swprintf]
add esp, 0xc
push ebx
push ebx
push 0x20
push 5
push 7
push ebx
push ebx
lea eax, [esp + 0x30]
push eax
push dword [0x456782fc]
lea eax, [esp + 0x6c]
push eax
lea esi, [esp + 0x90]
call fcn.456717fd
push eax
push 0x110014
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ntdll.dll_ZwCreateFile]
test eax, eax
jl 0x4567320b
push ebx
push ebx
push dword [ebp + 0x10]
lea eax, [esp + 0x20]
push dword [ebp + 0xc]
push eax
push ebx
push ebx
push ebx
push dword [esp + 0x2c]
call dword [sym.imp.ntdll.dll_ZwWriteFile]
test eax, eax
jl 0x45673201
push 0x98
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x18]
call sub.ntdll.dll_ZwSetEaFile
test eax, eax
jl 0x45673201
push 6
pop ecx
push 0x40
xor eax, eax
mov byte [esp + 0x28], 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x14
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
pop eax
push 0x1000
mov word [esp + 0x5e], ax
push 7
lea eax, [esp + 0x1c]
push eax
push dword [0x456782fc]
lea eax, [esp + 0x58]
push eax
lea esi, [esp + 0x7c]
call fcn.456717fd
push eax
push 0x10000
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.ntdll.dll_ZwOpenFile]
mov esi, dword [sym.imp.ntdll.dll_ZwSetInformationFile]
test eax, eax
jl 0x45673192
push dword [esp + 0x94]
lea eax, [esp + 0x34]
push str._08x.
push eax
call dword [sym.imp.ntdll.dll_swprintf]
add esp, 0xc
push 0xa
push 0x24
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x2c]
call esi
push dword [esp + 0x1c]
call dword [sym.imp.ntdll.dll_ZwClose]
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ntdll.dll_wcscpy]
pop ecx
pop ecx
push 0xa
push 0x24
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x1c]
call esi
xor ecx, ecx
test eax, eax
setge cl
mov dword [esp + 0x10], ecx
cmp ecx, ebx
je 0x45673201
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [esp + 0x20], 0x10
mov edi, 0x45678300
mov edx, ecx
mov esi, edi
xor eax, eax
lock cmpxchg dword [esi], edx
cmp eax, ebx
je 0x456731f9
cmp eax, ecx
je 0x456731f9
add edi, 0x8c
dec dword [esp + 0x20]
jne 0x456731d9
jmp 0x45673201
mov esi, dword [ebp + 8]
push 0x23
pop ecx
rep movsd dword es:[edi], dword [esi]
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_ZwClose]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc