joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a9f0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x471bd3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00465cee
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0046b339
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0046c855
test eax, eax
je 0x43ab0c
mov ecx, dword [esp + 0x3c]
call fcn.0046b366
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43aad0
push edi
mov ecx, esi
call fcn.004689cd
mov ecx, esi
call fcn.0043ac70
cmp dword [esp + 0x38], 1
jne 0x43ab05
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00468b08
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x43d530
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43d563
push esi
call fcn.00440630
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43d55c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43d5e9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43d5d2
mov eax, dword [esi + 8]
test eax, eax
je 0x43d587
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43d5ce
cmp eax, 2
je 0x43d5d2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43d57a
cmp eax, 3
je 0x43d5ad
cmp eax, 1
jne 0x43d57a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43d57a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43d57a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043d610
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43d5f8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043d610
add esp, 4
pop esi
ret

Function at 0x466aca
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x466b02
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00464b6e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00464b46
jmp 0x466b0e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4681b8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4681fa
call fcn.0046db3a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4681fa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4681f1
xor eax, eax
jmp 0x468202
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00468208
pop edi
pop esi
pop ebx
ret 4

Function at 0x46e06a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46e098
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46e0b6
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046dfd0
jmp 0x46e0b6
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46e0b6
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046dfd0
test edi, edi
mov eax, edi
jne 0x46e0a0
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10018640
Capabilities:
Encode data using xor

Disassembly:
aad 0x85
xchg ecx, eax
lcall 0xd992, 0x7216a47f
out 0x1a, eax
xor ch, byte [esi - 0x5ce29897]
ja 0x100185d9
cwde
cwde
inc ebx
pop ebx
cmpsd dword [esi], dword es:[edi]
dec esp
xlatb
or al, 0x77
push ebp
pop ebp
js 0x10018630
mov eax, ss
lahf
push ebp
imul eax, dword [ebx - 0x63], 0xffffffa1
stosd dword es:[edi], eax
dec esi
mov dh, 0x7b
push esi
neg byte [esi + 1]
mov al, 0x4d
xor eax, dword [esi + 0x77]
xchg ebx, eax
sti
invalid

Function at 0x10018b94
Capabilities:
Encode data using xor

Disassembly:
sbb ebx, 0xffffff99
clc
jno 0x10018bee
pop ecx
pop ecx
enter 0xffffffffffffb7bd, 0xffffffffffffff87
pushfd
dec ebp
sub dword [esp + edx], ebx
sbb dl, byte [edx + ebp*8 - 0x5c]
mov edx, 0x3f2fd8cc
xchg ebx, eax
fcomp qword gs:[ecx - 0x104366fc]
inc esp
scasd eax, dword es:[edi]
mov byte [eax - 0x6a], ah
or ch, dh
inc esp
mov dl, 0x29
add byte [ecx + esi*4], 0xe4
mov eax, 0x805cfcd2
and byte [esi], al
jne 0x10018b8f
pop eax
inc eax
add dl, byte [esi + 0x47447527]
das
push esi
sbb edx, dword [eax - 0x5259a361]
invalid
das
push esp
mov cl, 0x83
sbb al, 0x18
popaw
add ebx, 0x70
test dword [ebp + 0x63], esp
and al, 0xba
xchg dword [ebp + 0x1f], eax
inc ebp
inc ebx
add dword [edx + 0x7b], esi
cmpsb byte [esi], byte es:[edi]
mov esp, 0xb859d029
pop edx
and bl, bl
mov esp, 0x9fa75ea8
aas
fdivrp st(0)
fidiv word [edx]
std
and cl, byte [edi - 0x30]
mov dl, 0xb
popfd
sbb al, byte [0x3cfaded3]
xor esi, dword [esi - 0x3424f6d5]
jge 0x10018c16
invalid
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x11648
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
push 0x20006
lea eax, [ebp + 8]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0x240
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, esi
jl 0x116bd
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_ZwFlushKey]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
pop esi
leave
ret 0x14

Function at 0x116c8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
xor esi, esi
push 0x20019
lea eax, [ebp + 8]
push eax
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0x240
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, esi
jl 0x1172f
push ebx
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebx]
push edi
add esi, 0x10
push esi
call fcn.00015866
mov edi, eax
test edi, edi
jne 0x11734
mov esi, 0xc000009a
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
mov eax, esi
pop ebx
pop esi
leave
ret 0x14
push esi
push 0
push edi
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
push edi
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov esi, eax
cmp esi, 0xc0000023
je 0x11795
cmp esi, 0x80000005
je 0x11795
test esi, esi
jl 0x1179d
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x11776
mov ecx, dword [edi + 4]
mov dword [eax], ecx
mov eax, dword [ebx]
mov ecx, dword [edi + 8]
cmp eax, ecx
jb 0x11781
mov eax, ecx
push eax
mov dword [ebx], eax
lea eax, [edi + 0xc]
push eax
push dword [ebp + 0x14]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
jmp 0x1179d
mov eax, dword [ebp - 4]
add eax, 0xfffffff4
mov dword [ebx], eax
push edi
call fcn.00015880
jmp 0x11722
Function at 0x122f6
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_KeQuerySystemTime]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
lea eax, [ebp - 8]
push eax
call fcn.000120d8
movzx ecx, byte [ebp - 4]
movzx eax, byte [ebp - 3]
add eax, ecx
movzx ecx, byte [ebp - 5]
add eax, ecx
movzx ecx, byte [ebp - 6]
add ecx, dword [ebp - 0x10]
push 0x21f60
add ecx, eax
mov dword [ebp - 0x10], ecx
call dword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
jne 0x12365
cmp dword [0x21f64], 6
jb 0x12365
push dword [ebp - 0x10]
call dword [sym.imp.ntoskrnl.exe_srand]
pop ecx
call dword [sym.imp.ntoskrnl.exe_rand]
leave
ret
mov ecx, dword [ebp - 0x10]
mov eax, 0x3039
test ecx, ecx
jne IoGetRelatedDeviceObject
mov ecx, dword [0x1f178]
imul ecx, ecx, 0x41c64e6d
add ecx, eax
imul ecx, ecx, 0x3e39b193
sub eax, ecx
shr eax, 0x10
and eax, 0x7fff
leave
ret

Function at 0x12f96
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor edi, edi
push 0x1c646
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x80
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
mov esi, eax
cmp esi, edi
jge 0x12feb
mov ecx, dword [ebp - 8]
cmp ecx, edi
je 0x12fe4
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, esi
jmp 0x13078
push ebx
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push edi
push dword [eax + 0x20]
push dword [eax + 0x2c]
push edi
push 0x14
pop esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov ebx, eax
cmp ebx, edi
jge 0x13019
mov ecx, dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x13075
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStack]
mov edx, eax
cmp edx, edi
jne 0x13039
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov dword [ebp - 4], edi
jmp 0x1300e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x28]
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ecx], esi
mov eax, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
and ecx, esi
or dword [eax + 0x1c], ecx
mov eax, dword [ebp - 4]
mov dword [0x1f194], eax
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x1371a
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [0x1d410]
and dword [ebp - 4], 0
push esi
mov esi, dword [0x1d40c]
push edi
mov edi, dword [0x1d414]
add eax, edi
add eax, dword [0x1d408]
xor ecx, esi
xor edx, esi
add eax, esi
mov esi, dword [ebp + 0xc]
mov edi, dword [esi + 4]
mov dword [ebp - 0xc], edi
mov edi, dword [esi]
mov dword [ebp + 0xc], edi
mov edi, dword [esi + 0xc]
mov esi, dword [esi + 8]
mov dword [ebp - 8], 0x20
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
add dword [ebp - 4], eax
dec dword [ebp - 8]
mov esi, edx
shl esi, 4
add esi, dword [ebp + 0xc]
mov edi, edx
shr edi, 5
add edi, dword [ebp - 0xc]
xor esi, edi
mov edi, dword [ebp - 4]
add edi, edx
xor esi, edi
add ecx, esi
mov esi, ecx
shl esi, 4
add esi, dword [ebp - 0x10]
mov edi, ecx
shr edi, 5
add edi, dword [ebp - 0x14]
xor esi, edi
mov edi, dword [ebp - 4]
add edi, ecx
xor esi, edi
add edx, esi
cmp dword [ebp - 8], 0
ja 0x13770
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
pop esi
leave
ret 8

Function at 0x137c6
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov ecx, dword [0x1d414]
push esi
mov esi, dword [eax + 4]
mov eax, dword [0x1d410]
add ecx, eax
mov eax, dword [ebp + 0xc]
add ecx, dword [0x1d40c]
push edi
mov edi, dword [eax + 0xc]
add ecx, dword [0x1d408]
mov dword [ebp - 0xc], edi
mov edi, dword [eax + 8]
mov dword [ebp + 0xc], edi
mov edi, dword [eax + 4]
mov eax, dword [eax]
mov edx, ecx
mov dword [ebp - 8], 0x20
shl edx, 5
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 4]
shl eax, 4
add eax, dword [ebp + 0xc]
dec dword [ebp - 8]
shr edi, 5
add edi, dword [ebp - 0xc]
xor eax, edi
mov edi, dword [ebp - 4]
add edi, edx
xor eax, edi
sub esi, eax
mov eax, esi
shl eax, 4
add eax, dword [ebp - 0x10]
mov edi, esi
shr edi, 5
add edi, dword [ebp - 0x14]
xor eax, edi
lea edi, [edx + esi]
xor eax, edi
sub dword [ebp - 4], eax
sub edx, ecx
cmp dword [ebp - 8], 0
ja 0x1381a
mov eax, dword [0x1d40c]
xor eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [0x1d40c]
xor eax, esi
pop edi
mov dword [ecx + 4], eax
pop esi
leave
ret 8

Function at 0x13922
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
xor ecx, ecx
or eax, 0xffffffff
cmp dword [ebp + 0xc], ecx
jbe 0x13950
mov edx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x21500]
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x13931
not eax
pop ebp
ret 8
Function at 0x16f7a
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1f108]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x18], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x4000
push esi
call fcn.00015866
mov edi, eax
test edi, edi
jne 0x16fbb
mov eax, dword [0x1f1c8]
test eax, eax
je 0x16fb3
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
jmp 0x17104
push 0x11
push 2
push 2
call fcn.000109a4
add esp, 0xc
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x16fed
push edi
call fcn.00015880
mov eax, dword [0x1f1c8]
test eax, eax
jne 0x16fb0
push 0x1ca0e
call sub.ntoskrnl.exe_DbgPrint
pop ecx
jmp 0x16fb3
push esi
push 0
push edi
call sub.ntoskrnl.exe_memset
add esp, 0xc
push ebx
push edi
call fcn.00016e0c
push 2
mov dword [ebp - 0x24], eax
pop eax
push 0x35
mov word [ebp - 0x14], ax
call fcn.000109fe
pop ecx
mov word [ebp - 0x12], ax
call fcn.00016d22
push 0x10
pop ebx
push ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x24]
push edi
push dword [ebp - 0x1c]
call fcn.00010904
add esp, 0x18
mov dword [ebp - 0x20], eax
test eax, eax
jge 0x17094
push edi
call fcn.00015880
push dword [ebp - 0x1c]
call fcn.00010542
cmp dword [ebp - 0x20], 0xc0000022
mov eax, dword [0x1f1c8]
pop ecx
jne 0x17079
test eax, eax
jne 0x1706e
mov eax, dword [0x1f1c4]
and eax, 3
mov eax, dword [eax*4 + 0x1d424]
inc dword [0x1f1c4]
jmp 0x16fb0
test eax, eax
jne 0x16fb0
push dword [ebp - 0x20]
push 0x1c9f0
call sub.ntoskrnl.exe_DbgPrint
pop ecx
jmp 0x16fea
push esi
push 0
push edi
mov dword [ebp - 0x20], ebx
call sub.ntoskrnl.exe_memset
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push edi
push dword [ebp - 0x1c]
call fcn.0001082a
mov esi, eax
add esp, 0x24
test esi, esi
jge 0x170e1
push edi
call fcn.00015880
push dword [ebp - 0x1c]
call fcn.00010542
mov eax, dword [0x1f1c8]
pop ecx
test eax, eax
jne 0x16fb0
push esi
push 0x1c9ce
jmp 0x17089
push esi
push edi
call fcn.00016ee2
mov esi, eax
test esi, esi
jne 0x170f9
mov eax, dword [0x1f1c8]
test eax, eax
je 0x170f9
mov esi, eax
push dword [ebp - 0x1c]
call fcn.00010542
pop ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0001b175
leave
ret 4
Function at 0x18828
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
mov edi, 0x40000
push edi
call fcn.00015866
xor esi, esi
mov dword [0x1f1d0], eax
cmp eax, esi
je 0x18934
push edi
push esi
push eax
call sub.ntoskrnl.exe_memset
mov eax, dword [0x1f1d8]
add esp, 0xc
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 0x24], 0x21298
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov edi, dword [eax + 0x28]
push eax
call dword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov dword [edi + 8], eax
cmp eax, esi
jne 0x18891
mov eax, dword [edi + 4]
mov dword [edi + 8], eax
push dword [edi + 8]
lea eax, [ebp - 0x14]
push 0x800
push esi
push esi
push esi
push esi
push 0x60
push 1
push 1
push 0x80
push esi
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x80000000
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
test eax, eax
jge 0x188d7
push dword [0x1f1d0]
call fcn.00015880
mov dword [0x1f1d0], esi
jmp 0x18934
push 5
push 0x18
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jl 0x188c4
mov edi, dword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
push esi
push 1
push dword [ebp - 4]
call edi
mov eax, dword [ebp - 0x3c]
push esi
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [0x1f1d0]
mov dword [0x1f1d4], eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
jl 0x188c4
push esi
push 1
push dword [ebp - 4]
call edi
pop edi
pop esi
leave
ret
Function at 0x1893e
Capabilities:
Get file attributes
Set file attributes
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1f1d8]
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp eax, esi
je 0x18a57
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [eax + 0x28]
push eax
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], 0x40
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.ntoskrnl.exe_IoGetDeviceAttachmentBaseRef]
mov dword [edi + 8], eax
cmp eax, esi
jne 0x1898e
mov eax, dword [edi + 4]
mov dword [edi + 8], eax
push dword [edi + 8]
lea eax, [ebp - 0xc]
push 0x800
push esi
push esi
push esi
push esi
push 0x60
push 5
push 3
push 6
push esi
push eax
lea eax, [ebp - 0x24]
push eax
push 0xc0000000
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateFileSpecifyDeviceObjectHint]
mov edi, eax
cmp edi, esi
jl 0x18a52
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwWriteFile]
push esi
push 1
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ntoskrnl.exe_ZwWaitForSingleObject]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call fcn.00017e38
push 4
push 0x28
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
cmp dword [ebp - 0xc], esi
jl 0x18a49
mov eax, 0xfa2b0929
push 4
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], eax
push 0x28
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xc]
mov ecx, 0x1c95a06
push eax
push dword [ebp - 4]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x40], ecx
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
pop edi
jmp 0x18a5c
mov eax, 0xc000000e
pop esi
leave
ret 0x10