joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a549b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x556d36
call fcn.004e5bfc
call fcn.004a4412
test al, al
jne 0x4a54bd
call fcn.004a45ac
test al, al
je 0x4a5622
call fcn.004a4783
test al, al
je 0x4a5622
call fcn.004a3a2f
test al, al
jne 0x4a561e
push 0xf
pop esi
xor ebx, ebx
mov dword [ebp - 0x2c], esi
mov edi, str.bEnableNetworkAccess
mov dword [ebp - 0x30], ebx
push edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x40], bl
call fcn.0045446b
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.004a46a9
neg al
pop ecx
mov ecx, dword [ebp - 0x2c]
sbb al, al
or dword [ebp - 4], 0xffffffff
inc al
mov byte [ebp - 0x49], al
cmp ecx, 0x10
jb 0x4a5554
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5544
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00453da0
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.004e570f
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x49]
pop ecx
pop ecx
test al, al
jne 0x4a561e
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x28], bl
call fcn.0045446b
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 2
je 0x4a55d8
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a55d8
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x50], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a55cf
cmp dword [ebp - 0x48], eax
setne bl
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a561a
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x4a5611
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00453da0
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.004e570f
pop ecx
pop ecx
mov al, bl
jmp 0x4a5624
mov al, 1
jmp 0x4a5624
xor al, al
call fcn.004e5ba6
ret
Function at 0x4a562a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x556d36
call fcn.004e5bfc
call fcn.004a4783
test al, al
je 0x4a579b
call fcn.004a3a2f
test al, al
jne 0x4a5797
push 0xf
pop esi
xor ebx, ebx
mov dword [ebp - 0x2c], esi
mov edi, str.bEnableDebugInterface
mov dword [ebp - 0x30], ebx
push edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x40], bl
call fcn.0045446b
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.004a46a9
neg al
pop ecx
mov ecx, dword [ebp - 0x2c]
sbb al, al
or dword [ebp - 4], 0xffffffff
inc al
mov byte [ebp - 0x49], al
cmp ecx, 0x10
jb 0x4a56cd
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a56bd
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00453da0
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.004e570f
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x49]
pop ecx
pop ecx
test al, al
jne 0x4a5797
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x28], bl
call fcn.0045446b
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 2
je 0x4a5751
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5751
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x50], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a5748
cmp dword [ebp - 0x48], eax
setne bl
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5793
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x4a578a
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00453da0
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.004e570f
pop ecx
pop ecx
mov al, bl
jmp 0x4a579d
mov al, 1
jmp 0x4a579d
xor al, al
call fcn.004e5ba6
ret
Function at 0x4a57a3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x556ccc
call fcn.004e5bfc
call fcn.004a4412
test al, al
je 0x4a58a0
call fcn.004a4783
test al, al
je 0x4a58a0
call fcn.004a3a2f
test al, al
je 0x4a57d9
mov al, 1
jmp 0x4a58a2
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableUniAccessFromFileUrls
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0045446b
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a585a
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a585a
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a5851
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a589c
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5893
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00453da0
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004e570f
pop ecx
pop ecx
mov al, bl
jmp 0x4a58a2
xor al, al
call fcn.004e5ba6
ret
Function at 0x4b1bc1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x98
mov eax, 0x55855b
call fcn.004e5bfc
call fcn.004b1fa6
test al, al
je 0x4b1de8
xor ebx, ebx
mov esi, 0x5dbd00
cmp byte [0x5dbcff], bl
jne 0x4b1c3b
lea eax, [ebp - 0x9c]
mov byte [0x5dbcff], 1
push eax
push str.SOFTWAREAdobeAcroPerf
push 0x80000001
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0xa0], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0xa0]
push eax
push esi
lea eax, [ebp - 0xa4]
push eax
push ebx
push str.tOutputDir
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [0x5dbcfe], bl
lea ecx, [ebp - 0x38]
mov eax, 0x589e5c
mov dword [ebp - 0x28], ebx
mov edi, 0x589e60
mov dword [ebp - 0x24], 0xf
push str.AcroCEF_TimeInfo
cmove edi, eax
mov byte [ebp - 0x38], bl
call fcn.0045446b
lea eax, [ebp - 0x38]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x98]
mov byte [ebp - 0x20], bl
push esi
push eax
call fcn.00432940
add esp, 0xc
mov esi, eax
push 0xa
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.004f60ac
push eax
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.00451ce6
push edi
push eax
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 2
push eax
call fcn.00451ce6
push str..log
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 3
push eax
call fcn.00451ce6
lea ecx, [ebp - 0x38]
add esp, 0x30
cmp ecx, eax
je 0x4b1ce3
mov byte [ebp - 0xa0], bl
push dword [ebp - 0xa0]
push eax
call fcn.00454112
lea ecx, [ebp - 0x50]
call fcn.00454280
lea ecx, [ebp - 0x68]
call fcn.00454280
lea ecx, [ebp - 0x80]
call fcn.00454280
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], bl
call fcn.00454280
cmp dword [ebp - 0x24], 0x10
lea eax, [ebp - 0x38]
push 0x589e80
cmovae eax, dword [ebp - 0x38]
push eax
call fcn.004f2c54
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4b1d94
call fcn.004b1f37
mov edi, eax
mov edx, dword [edi]
mov ecx, dword [edx]
mov dword [ebp - 0x9c], ecx
cmp ecx, edx
je 0x4b1d8d
movsd xmm0, qword [ecx + 0x28]
ucomisd xmm0, qword [0x56c278]
lahf
test ah, 0x44
jnp 0x4b1d78
add ecx, 0x10
cmp dword [ecx + 0x14], 0x10
jb 0x4b1d5a
mov ecx, dword [ecx]
divsd xmm0, qword [0x587570]
push ecx
push ecx
push ecx
movsd qword [esp], xmm0
push str._lf_t_s_n
push esi
call fcn.004b2131
add esp, 0x14
lea ecx, [ebp - 0x9c]
call fcn.00453133
mov ecx, dword [ebp - 0x9c]
cmp ecx, dword [edi]
jne 0x4b1d3c
push esi
call fcn.004f4199
pop ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x4b1de8
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 4], 4
cmp eax, 0x1000
jb 0x4b1ddf
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.00453da0
mov eax, dword [ebp - 0x9c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0xa0]
push eax
push ecx
call fcn.004e570f
pop ecx
pop ecx
call fcn.004e5ba6
ret
Function at 0x4b1fa6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5cf2a4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x5dbcfd], 0
jne 0x4b2032
cmp byte [0x5dbcfe], 0
mov byte [0x5dbcfd], 1
je 0x4b2032
push esi
push edi
push 0xc
pop ecx
lea eax, [ebp - 0x38]
mov esi, 0x589dec
push eax
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
push 1
xor esi, esi
lea eax, [ebp - 0x34]
push esi
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x38], esi
je 0x4b2030
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3c], esi
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x40], 4
push eax
push esi
push esi
push str.bLaunchTiming
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x3c], esi
push dword [ebp - 0x38]
setne byte [0x5dbcfc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov al, byte [0x5dbcfc]
xor ecx, ebp
call fcn.004e5b80
leave
ret

Function at 0x4bcace
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x552b9b
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5cf2a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [edi], vtable.rna::messaging::NamedPipeChannelServer.0
call fcn.00516380
cmp dword [edi + 0xc], 0xffffffff
je 0x4bcb28
push 0xfa
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [edi + 0xac]
test ebx, ebx
je 0x4bcb44
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x56642c]
mov ecx, ebx
call esi
mov ebx, dword [edi + 0xb0]
test ebx, ebx
je 0x4bcb60
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x56642c]
mov ecx, ebx
call esi
lea ecx, [edi + 0xb4]
call fcn.004565a0
lea esi, [edi + 0x94]
lea ecx, [esi + 0x14]
call fcn.004565a0
mov ecx, esi
call fcn.004a6fed
lea ecx, [edi + 0x50]
call fcn.004a71fc
lea ecx, [edi + 0x38]
call fcn.004542a6
lea ecx, [edi + 0x20]
call fcn.004542a6
mov dword [edi], vtable.rna::messaging::IpcChannelBase.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4cd520
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x5dbf94], 0x12c
push ebx
push esi
push edi
mov esi, ecx
jle 0x4cd53d
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x30]
push eax
call fcn.00516bda
add esp, 0xc
lea edi, [esi + 0xc]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x4cd595
cmp dword [ebp - 4], 0
jne 0x4cd595
lea eax, [ebp - 4]
push eax
push edi
call fcn.00516d6b
pop ecx
pop ecx
test al, al
je 0x4cd595
and dword [0x5dbf94], 0
mov ebx, dword [esi + 0x14]
test ebx, ebx
je 0x4cd595
mov eax, dword [ebx]
push edi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x56642c]
mov ecx, ebx
call esi
test al, al
jne 0x4cd5cb
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x4cd5b4
cmp dword [ebp - 4], 0
jne 0x4cd5af
push edi
call fcn.00516ad3
or dword [edi], 0xffffffff
or eax, 0xffffffff
pop ecx
cmp eax, 0xffffffff
jne 0x4cd5cb
cmp dword [ebp - 4], 0
je 0x4cd5cb
inc dword [0x5dbf94]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x50525d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005050d3

Function at 0x505843
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005057c5

Function at 0x5123fa
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
xor ecx, ecx
push ecx
push esi
push 0x512480
push ecx
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
pop esi
leave
ret

Function at 0x51295e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x5cf2a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, str.Proxy_object_acquired_for_write_by_thread__d._n
mov dword [esi], eax
mov al, byte [ebp + 0xc]
mov byte [esi + 4], al
test al, al
jne 0x51298b
mov edi, str.Proxy_object_acquired_for_read__by_thread__d._n
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea eax, [ebp - 0x68]
push edi
push eax
call fcn.00511e37
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [esi + 4], 1
mov ecx, dword [esi]
jne 0x5129b8
call fcn.004565c7
jmp 0x5129bd
call fcn.004565b1
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004e5b80
leave
ret 8
Function at 0x512a93
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55e487
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x5cf2a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 4], 0
mov edi, str.Thread__d_releasing_Proxy_object_acquired_for_write._n
jne 0x512acf
mov edi, str.Thread__d_releasing_Proxy_object_acquired_for_read._n
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea eax, [ebp - 0x74]
push edi
push eax
call fcn.00511e37
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [esi + 4], 1
mov ecx, dword [esi]
jne 0x512afc
call fcn.004565d2
jmp 0x512b01
call fcn.004565bc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e5b80
leave
ret

Function at 0x5166f6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
xor ecx, ecx
push ecx
push esi
push 0x516810
push ecx
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
pop esi
leave
ret

Function at 0x516b2d
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
jne 0x516b4d
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
or eax, 0xffffffff
jmp 0x516bd7
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push edi
mov edi, dword [ebp + 0x10]
mov ecx, 0xfa
mov dword [edi], 7
mov eax, dword [eax]
div ecx
mov dword [ebp - 4], eax
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x516b73
mov ecx, dword [esi]
push 0
push 0x4110100
push 3
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x516bd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp eax, 2
je 0x516ba8
cmp eax, 0xe7
jne 0x516bc2
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 4]
mov eax, edx
dec edx
mov dword [ebp - 4], edx
test eax, eax
jne 0x516b69
jmp 0x516bd3
lea eax, [ebp - 8]
push eax
call fcn.00516a48
pop ecx
mov dword [edi], eax
jmp 0x516bd3
and dword [edi], 0
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret
Function at 0x516bda
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
or ebx, 0xffffffff
push edi
mov edi, dword [ebp + 8]
mov dword [esi], 7
cmp dword [edi + 0x10], eax
jne 0x516c04
mov dword [esi], 1
jmp 0x516c8f
push eax
mov dword [ebp - 4], eax
xor ebx, ebx
lea eax, [ebp - 4]
inc ebx
push eax
push ebx
push str.S:_ML__NW___LW_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
and dword [ebp - 8], 0
cmp dword [edi + 0x14], 8
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0xc], eax
jb 0x516c33
mov edi, dword [edi]
cmp byte [0x5cfc64], 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, 0x400
push eax
push eax
push 0xff
mov eax, 0x80001
push 8
cmovne ebx, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push dword [ebp - 4]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp ebx, 0xffffffff
jne 0x516c85
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.00516a48
pop ecx
mov dword [esi], eax
jmp 0x516c8f
and dword [esi], 0
mov byte [0x5cfc64], 0
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x516c96
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, eax
mov dword [esi], 7
cmp dword [ebx], 0xffffffff
jne 0x516cbf
mov dword [esi], 1
jmp 0x516d64
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x516cf1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp eax, 0xea
je 0x516cf1
lea eax, [ebp - 0xc]
jmp 0x516d5b
cmp dword [ebp - 8], 0x1fffff
jbe 0x516d02
mov dword [esi], 3
jmp 0x516d64
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 1]
push eax
push dword [ebp - 8]
mov byte [ebp - 1], 0
call fcn.004b26dc
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
and dword [ebp - 0xc], 0
sub ecx, edi
push 0
push edx
mov eax, dword [eax]
push ecx
add eax, edi
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x516d49
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
cmp eax, 0xea
jne 0x516d58
add edi, dword [ebp - 0xc]
and dword [esi], 0
mov ecx, dword [ebp - 8]
cmp edi, ecx
jb 0x516d18
jmp 0x516d64
lea eax, [ebp - 0x14]
push eax
call fcn.00516a48
mov dword [esi], eax
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x537850
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563d78
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x5cf2a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x53788e
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, 0xffffffff
jne 0x5378c0
push dword [ebp - 0x10]
push ebx
push edi
call fcn.00537720
add esp, 0xc
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push ebx
call fcn.005375f0
add esp, 8
mov ecx, eax
mov dword [ebp - 0x14], ecx
test esi, 0x400
je 0x537997
cmp dword [ebx + 0x14], 8
mov edx, ebx
jb 0x5378e5
mov edx, dword [ebx]
mov ecx, edx
mov dword [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x537900
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
call fcn.00454561
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push 0
cmovae eax, dword [ebp - 0x34]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0
call fcn.00452ddf
cmp esi, 0xffffffff
je 0x53789f
push ebx
call fcn.005374f0
add esp, 4
push esi
test al, al
jne 0x53798b
mov eax, dword [ebp - 0x14]
mov dword [edi], 9
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x5379af
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x587388
and esi, 0x10
je 0x5379b9
mov edx, dword [ebp - 0x18]
jmp 0x5379be
mov edx, ecx
mov ecx, dword [ebp - 0x18]
xor eax, eax
test esi, esi
setne al
add eax, 2
test esi, esi
mov dword [edi], eax
mov eax, edi
cmove ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53b359
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret