NTSTATUS __stdcall NtFindAtom(PWSTR String,ULONG StringLength,PUSHORT Atom)
public NtFindAtom
NtFindAtom proc near
String= dword ptr 4
StringLength= dword ptr 8
Atom= dword ptr 0Ch
; FUNCTION CHUNK AT PAGE:0053AB56 SIZE 00000028 BYTES
; FUNCTION CHUNK AT PAGE:0053ABA4 SIZE 0000002B BYTES
; FUNCTION CHUNK AT PAGE:0053AC66 SIZE 0000000D BYTES
PAGE:005086C5 push 0B0h
PAGE:005086CA push offset dword_427688
PAGE:005086CF call sub_40BE83
PAGE:005086CF
PAGE:005086D4 mov eax, dword_482360
PAGE:005086D9 mov [ebp-1Ch], eax
PAGE:005086DC mov eax, [ebp+8]
PAGE:005086DF mov [ebp-0A8h], eax
PAGE:005086E5 mov edi, [ebp+10h]
PAGE:005086E8 mov [ebp-0ACh], edi
PAGE:005086EE call sub_4A37D3
PAGE:005086EE
PAGE:005086F3 mov [ebp-0B0h], eax
PAGE:005086F9 test eax, eax
PAGE:005086FB jz loc_53AB56
PAGE:005086FB
PAGE:00508701 mov ebx, [ebp+0Ch]
PAGE:00508704 cmp ebx, 1FEh
PAGE:0050870A ja loc_53AB60
PAGE:0050870A
PAGE:00508710 mov eax, large fs:124h
PAGE:00508716 mov al, [eax+140h]
PAGE:0050871C mov ecx, [ebp-0A8h]
PAGE:00508722 mov [ebp-0A0h], ecx
PAGE:00508728 test al, al
PAGE:0050872A jz loc_5087D9
PAGE:0050872A
PAGE:00508730 test edi, edi
PAGE:00508732 jz short loc_50874F
PAGE:00508732
PAGE:00508734 and dword ptr [ebp-4], 0
PAGE:00508738 mov eax, MmUserProbeAddress
PAGE:0050873D cmp edi, eax
PAGE:0050873F jnb loc_53AB6A
PAGE:0050873F
PAGE:00508745
PAGE:00508745 loc_508745: ; CODE XREF: NtFindAtom+324AAj
PAGE:00508745 mov ax, [edi]
PAGE:00508748 mov [edi], ax
PAGE:0050874B or dword ptr [ebp-4], 0FFFFFFFFh
PAGE:0050874B
PAGE:0050874F
PAGE:0050874F loc_50874F: ; CODE XREF: NtFindAtom+6Dj
PAGE:0050874F test ecx, ecx
PAGE:00508751 jz loc_5087D9
PAGE:00508751
PAGE:00508757 lea esi, [ebx+2]
PAGE:0050875A and esi, 0FFFFFFFEh
PAGE:0050875D xor edi, edi
PAGE:0050875F inc edi
PAGE:00508760 mov [ebp-4], edi
PAGE:00508763 test ebx, ebx
PAGE:00508765 jz short loc_50878D
PAGE:00508765
PAGE:00508767 test cl, 1
PAGE:0050876A jnz loc_53AB74
PAGE:0050876A
PAGE:00508770
PAGE:00508770 loc_508770: ; CODE XREF: NtFindAtom+324B4j
PAGE:00508770 mov ecx, [ebp-0A8h]
PAGE:00508776 lea eax, [ebx+ecx]
PAGE:00508779 cmp eax, ecx
PAGE:0050877B jb loc_50883E
PAGE:0050877B
PAGE:00508781 cmp eax, MmUserProbeAddress
PAGE:00508787 ja loc_50883E
PAGE:00508787
PAGE:0050878D
PAGE:0050878D loc_50878D: ; CODE XREF: NtFindAtom+A0j
PAGE:0050878D ; NtFindAtom+17Ej
PAGE:0050878D or dword ptr [ebp-4], 0FFFFFFFFh
PAGE:00508791 cmp esi, 80h
PAGE:00508797 ja loc_53ABA4
PAGE:00508797
PAGE:0050879D lea eax, [ebp-9Ch]
PAGE:005087A3 mov [ebp-0A0h], eax
PAGE:005087A3
PAGE:005087A9
PAGE:005087A9 loc_5087A9: ; CODE XREF: NtFindAtom+32505j
PAGE:005087A9 mov dword ptr [ebp-4], 2
PAGE:005087B0 mov ecx, ebx
PAGE:005087B2 mov esi, [ebp-0A8h]
PAGE:005087B8 mov edi, eax
PAGE:005087BA mov edx, ecx
PAGE:005087BC shr ecx, 2
PAGE:005087BF rep movsd
PAGE:005087C1 mov ecx, edx
PAGE:005087C3 and ecx, 3
PAGE:005087C6 rep movsb
PAGE:005087C8 or dword ptr [ebp-4], 0FFFFFFFFh
PAGE:005087CC shr ebx, 1
PAGE:005087CE and word ptr [eax+ebx*2], 0
PAGE:005087D3 mov edi, [ebp-0ACh]
PAGE:005087D3
PAGE:005087D9
PAGE:005087D9 loc_5087D9: ; CODE XREF: NtFindAtom+65j
PAGE:005087D9 ; NtFindAtom+8Cj
PAGE:005087D9 lea eax, [ebp-0A4h]
PAGE:005087DF push eax
PAGE:005087E0 push dword ptr [ebp-0A0h]
PAGE:005087E6 push dword ptr [ebp-0B0h]
PAGE:005087EC call RtlLookupAtomInAtomTable
PAGE:005087EC
PAGE:005087F1 mov esi, eax
PAGE:005087F3 test esi, esi
PAGE:005087F5 jl short loc_508810
PAGE:005087F5
PAGE:005087F7 test edi, edi
PAGE:005087F9 jz short loc_508810
PAGE:005087F9
PAGE:005087FB mov dword ptr [ebp-4], 3
PAGE:00508802 mov ax, [ebp-0A4h]
PAGE:00508809 mov [edi], ax
PAGE:00508809
PAGE:0050880C
PAGE:0050880C loc_50880C: ; CODE XREF: PAGE:0053AC61j
PAGE:0050880C or dword ptr [ebp-4], 0FFFFFFFFh
PAGE:0050880C
PAGE:00508810
PAGE:00508810 loc_508810: ; CODE XREF: NtFindAtom+130j
PAGE:00508810 ; NtFindAtom+134j
PAGE:00508810 mov eax, [ebp-0A0h]
PAGE:00508816 cmp eax, [ebp-0A8h]
PAGE:0050881C jz short loc_50882C
PAGE:0050881C
PAGE:0050881E lea ecx, [ebp-9Ch]
PAGE:00508824 cmp eax, ecx
PAGE:00508826 jnz loc_53AC66
PAGE:00508826
PAGE:0050882C
PAGE:0050882C loc_50882C: ; CODE XREF: NtFindAtom+157j
PAGE:0050882C ; NtFindAtom+325A9j
PAGE:0050882C mov eax, esi
PAGE:0050882C
PAGE:0050882E
PAGE:0050882E loc_50882E: ; CODE XREF: NtFindAtom+32496j
PAGE:0050882E ; NtFindAtom+324A0j
PAGE:0050882E ; NtFindAtom+324FAj
PAGE:0050882E ; PAGE:0053AC12j
PAGE:0050882E mov ecx, [ebp-1Ch]
PAGE:00508831 call sub_4025AF
PAGE:00508831
PAGE:00508836 call sub_40BEBE
PAGE:00508836
PAGE:0050883B retn 0Ch
PAGE:0050883B
PAGE:0050883E ; ---------------------------------------------------------------------------
PAGE:0050883E
PAGE:0050883E loc_50883E: ; CODE XREF: NtFindAtom+B6j
PAGE:0050883E ; NtFindAtom+C2j
PAGE:0050883E call ExRaiseAccessViolation
PAGE:0050883E
PAGE:00508843 jmp loc_50878D
PAGE:00508843
PAGE:00508843 NtFindAtom endp
PAGE:00508843
问题是反汇编引擎是怎么知道这个函数应该在这里结束？
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
