joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403c30
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x114
mov eax, dword [0x464010]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [0x464bd4]
test eax, eax
jne 0x403da6
cmp dword [0x464bdc], 0
je 0x403da6
xor esi, esi
cmp byte [0x464be8], 0
jne 0x403d98
mov byte [0x464be8], 1
lea edi, [esp + 0xa]
push edi
push 0x106
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x403d98
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, eax
push 0
push 0
push eax
push edi
push str._sputty__lu__llu.chm
call fcn.0040dd70
add esp, 0x14
mov esi, eax
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x403d36
mov dword [esp], ebp
xor ebp, ebp
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x403d98
push esi
call fcn.0040e4c0
add esp, 4
add ebp, 1
adc edi, 0
push edi
push ebp
push dword [esp + 8]
lea eax, [esp + 0x16]
push eax
push str._sputty__lu__llu.chm
call fcn.0040dd70
add esp, 0x14
mov esi, eax
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x403ce0
mov ebx, eax
mov eax, dword [0x464be4]
test eax, eax
je 0x403d87
mov edi, dword [0x464bdc]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
sub eax, ebp
mov dword [esp + 4], 0
lea ecx, [edi + ebp]
push 0
lea edx, [esp + 8]
push edx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403e10
mov eax, dword [esp + 4]
add ebp, eax
add ebp, 1
mov eax, dword [0x464be4]
cmp eax, ebp
ja 0x403d50
mov dword [0x464bd4], esi
mov byte [0x464bd8], 1
xor esi, esi
jmp 0x403e17
push esi
call fcn.0040e4c0
add esp, 4
mov eax, dword [0x464bd4]
test eax, eax
je 0x403df7
mov ecx, dword [esp + 0x12c]
mov edi, dword [esp + 0x128]
test ecx, ecx
je 0x403de4
push ecx
push eax
push str._s::__s.html_main
call fcn.0040dd70
add esp, 0xc
mov esi, eax
push 0
push 0
push eax
push edi
call dword [0x464bd0]
push esi
call fcn.0040e4c0
add esp, 4
jmp 0x403df0
push 0
push 0
push eax
push edi
call dword [0x464bd0]
mov byte [0x464be0], 1
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0043208f
add esp, 0x114
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.0040e4c0
add esp, 4
cmp ebx, 0xffffffff
je 0x403da1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403da1
Function at 0x404410
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
push 0x45a254
push dword [eax]
call fcn.0043d28b
add esp, 8
test eax, eax
je 0x404486
mov esi, eax
mov ebp, dword [esp + 0x14]
mov dword [ebp + 4], 0
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x40449d
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
add eax, dword [ebp]
push esi
push ecx
push 1
push eax
call fcn.0043d423
add esp, 0x10
mov edi, eax
push esi
call fcn.0043d117
add esp, 4
test eax, eax
jne 0x40448d
mov eax, dword [ebp + 4]
test edi, edi
je 0x404494
add eax, edi
mov dword [ebp + 4], eax
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x404450
jmp 0x404497
mov ebx, 2
jmp 0x4044d7
mov ebx, 2
jmp 0x4044ce
mov ecx, dword [ebp + 8]
xor ebx, ebx
cmp eax, ecx
jne 0x4044b1
push esi
call fcn.0043d143
add esp, 4
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
mov eax, dword [ebp + 4]
mov ecx, dword [ebp]
lea edx, [ebp + 0xc]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], edx
push esi
call fcn.0043cfc2
add esp, 4
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d6a0
Capabilities:
Create pipe

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov eax, dword [0x464010]
xor eax, esp
mov dword [esp + 0xc], eax
push 0
push 0x34
push 1
call fcn.0040e430
add esp, 0xc
mov esi, eax
mov dword [eax + 0x30], 0x4515e4
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], 0
mov dword [eax], 0
push ebx
call fcn.0040ddc0
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi + 0x24], 0
push 9
push str..pipe_
push ebx
call fcn.0043df90
add esp, 0xc
test eax, eax
je 0x40d726
push 0xd5
push 0x45d822
push str.strncmp_pipename___.pipe___9___0
call fcn.0043bf69
add esp, 0xc
lea ebp, [esi + 0x2c]
lea ebx, [esi + 4]
mov eax, dword [esp + 0x24]
add eax, 9
push 0x5c
push eax
call fcn.00434e10
add esp, 8
test eax, eax
je 0x40d759
push 0xd6
push 0x45d822
push 0x45e424
call fcn.0043bf69
add esp, 0xc
mov edi, esi
add edi, 0x30
push ebp
push ebx
push esi
push 0xc0000000
call fcn.0040f940
add esp, 0x10
test al, al
je 0x40d82c
mov dword [esp], 0xc
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov eax, esp
push eax
push 0
push 0x1000
push 0x1000
push 0xff
push 8
push 0x40080003
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x40d808
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x20], eax
push esi
push 0x40d850
push eax
call fcn.004040e0
add esp, 0xc
mov dword [esi + 0x24], eax
mov ecx, esi
xor edx, edx
call fcn.0040d860
jmp 0x40d82c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00410050
add esp, 4
push eax
push dword [esp + 0x28]
push str.unable_to_create_named_pipe__s:__s
call fcn.0040dd70
add esp, 0xc
mov dword [ebp], eax
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0043208f
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40d860
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov esi, ecx
mov eax, dword [0x464010]
xor eax, esp
mov dword [esp + 0xc], eax
lea ebp, [ecx + 0x10]
jmp 0x40d8c1
mov dword [esp], 0xc
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov eax, esp
push eax
push 0
push 0x1000
push 0x1000
push 0xff
push 8
push 0x40000003
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x40d921
test bl, 1
jne 0x40d8f0
push ebp
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x40d8f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40d8f2
mov edi, eax
cmp eax, 0x217
je 0x40d8f2
jmp 0x40d97b
xor ebx, ebx
mov edi, dword [esi + 0xc]
mov eax, dword [esi + 0x28]
mov dword [esp], edi
mov ecx, dword [eax]
mov edx, dword [esp]
push edx
push 0x40da30
push eax
call dword [ecx + 0x10]
add esp, 0xc
test eax, eax
je 0x40d880
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d880
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
call fcn.00410050
add esp, 4
push eax
push str.Error_while_listening_to_named_pipe:__s
call fcn.0040dd70
add esp, 8
mov ebx, eax
push dword [esi + 8]
call fcn.0040c1f0
add esp, 4
mov ecx, dword [esi + 0x28]
mov edx, dword [ecx]
push edi
push ebx
push 0
push eax
push 1
push ecx
call dword [edx]
add esp, 0x18
push ebx
call fcn.0040e4c0
add esp, 4
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0043208f
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
cmp edi, 0x3e5
jne 0x40d929
jmp 0x40d968

Function at 0x40f0e0
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x2c]
mov eax, dword [0x464010]
xor eax, esp
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
xor esi, esi
call fcn.0040f680
test al, al
je 0x40f132
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
xor esi, esi
push edi
push eax
push ecx
push 0x1f0001
call fcn.0040f940
add esp, 0x10
test al, al
je 0x40f188
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x28]
mov dword [esp], 0xc
mov dword [esp + 4], esi
mov dword [esp + 8], 0
mov eax, esp
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x40f166
mov esi, eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40f188
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00410050
add esp, 4
push eax
push ebx
push str.CreateMutex___s___failed:__s
call fcn.0040dd70
add esp, 0xc
mov dword [edi], eax
xor esi, esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40f197
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40f1a6
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0043208f
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
ret
Function at 0x40f480
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x20]
mov eax, dword [0x464010]
xor eax, esp
mov dword [esp + 8], eax
mov ebx, esp
lea eax, [esp + 4]
push ebx
push 0
push eax
push 0
push dword [esp + 0x34]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor esi, esi
test eax, eax
jne 0x40f51f
cmp dword [esp + 4], 1
jne 0x40f51f
mov ebp, dword [esp]
add ebp, 1
push 0
push 1
push ebp
call fcn.0040e430
add esp, 0xc
mov ecx, edi
mov edi, eax
push ebx
push eax
lea eax, [esp + 0xc]
push eax
push 0
push dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40f516
cmp dword [esp + 4], 1
jne 0x40f516
mov eax, dword [esp]
cmp eax, ebp
jb 0x40f50e
push 0x6c
push 0x45cd54
push 0x45cb40
call fcn.0043bf69
add esp, 0xc
mov eax, dword [esp]
mov byte [edi + eax], 0
mov esi, edi
jmp 0x40f51f
push edi
call fcn.0040e4c0
add esp, 4
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0043208f
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40f580
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x108
mov esi, dword [esp + 0x120]
mov edi, dword [esp + 0x11c]
mov al, byte [esp + 0x124]
mov ecx, dword [0x464010]
xor ecx, esp
mov dword [esp + 0x104], ecx
xor ebp, ebp
mov ebx, 0
test al, al
je 0x40f5d2
mov eax, esp
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
add eax, 0xffffffff
cmp eax, 0x103
setb bl
mov al, byte [esp + 0x128]
mov dword [esi], 0x4c
test edi, edi
je 0x40f5eb
xor ebp, ebp
cmp byte [edi], 0
cmovne ebp, edi
mov dword [esi + 0x2c], ebp
test al, al
je 0x40f5fb
push esi
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
jmp 0x40f602
push esi
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
mov esi, eax
test edi, edi
je 0x40f623
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
add eax, 0xfffffefc
cmp eax, 0xfffffefc
ja 0x40f623
mov byte [edi], 0
test bl, bl
je 0x40f630
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test esi, esi
setne bl
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0043208f
mov eax, ebx
add esp, 0x108
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f690
Capabilities:
Link many functions at runtime

Disassembly:
cmp byte [0x46532c], 1
jne 0x40f69f
mov al, byte [0x46532d]
ret
mov byte [0x46532c], 1
push str.advapi32.dll
call fcn.0040f1e0
add esp, 4
mov dword [0x465330], eax
test eax, eax
je 0x40f7e7
push str.GetSecurityInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x465334], eax
test eax, eax
je 0x40f7e7
mov eax, dword [0x465330]
test eax, eax
je 0x40f7ad
push str.SetSecurityInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x465338], eax
test eax, eax
je 0x40f7e7
mov eax, dword [0x465330]
test eax, eax
je 0x40f7b9
push str.OpenProcessToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46533c], eax
test eax, eax
je 0x40f7e7
mov eax, dword [0x465330]
test eax, eax
je 0x40f7c5
push str.GetTokenInformation
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x465340], eax
test eax, eax
je 0x40f7e7
mov eax, dword [0x465330]
test eax, eax
je 0x40f7d1
push 0x458a22
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x465344], eax
test eax, eax
je 0x40f7e7
mov eax, dword [0x465330]
test eax, eax
je 0x40f7dd
push 0x458adc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov dword [0x465348], eax
xor eax, eax
test ecx, ecx
je 0x40f7e9
mov ecx, dword [0x465330]
test ecx, ecx
je 0x40f7a1
push str.SetEntriesInAclA
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46534c], eax
test eax, eax
setne al
jmp 0x40f7e9
mov dword [0x465338], 0
jmp 0x40f7e7
mov dword [0x46533c], 0
jmp 0x40f7e7
mov dword [0x465340], 0
jmp 0x40f7e7
mov dword [0x465344], 0
jmp 0x40f7e7
mov dword [0x465348], 0
xor eax, eax
mov byte [0x46532d], al
ret

Function at 0x413420
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
cmp eax, dword [esi]
je 0x41344d
push 0xa6
push 0x45d03a
push 0x45c510
call fcn.0043bf69
add esp, 0xc
and ebx, 1
neg ebx
mov dword [esp], ebx
cmp dword [edi], 0
je 0x413484
xor eax, eax
nop
nop
nop
nop
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [esp]
and ecx, edx
mov edx, dword [edi + 4]
xor dword [edx + eax*4], ecx
mov edx, dword [esi + 4]
xor dword [edx + eax*4], ecx
add eax, 1
cmp eax, dword [edi]
jb 0x413460
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x413d00
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov edx, 0x27
jmp 0x413d10
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, edx
mov dword [esp], ecx
mov edi, dword [ecx]
lea esi, [edi*8]
lea eax, [edi*8 + 1]
push 0
push 1
mov dword [esp + 0x10], eax
push eax
call fcn.0040e430
add esp, 0xc
mov ebp, eax
mov byte [eax + edi*8], 0
mov dword [esp + 4], esi
test esi, esi
mov dword [esp + 0xc], eax
je 0x413d96
movzx esi, bl
xor eax, eax
mov ebx, dword [esp + 4]
xor edx, edx
mov ebp, dword [esp + 0xc]
nop
nop
mov ecx, edx
shr ecx, 3
mov edi, dword [esp]
mov edi, dword [edi + 4]
mov edi, dword [edi + ecx*4]
mov ecx, eax
and cl, 0x1c
shr edi, cl
and edi, 0xf
lea ecx, [edi + 6]
shr ecx, 4
neg ecx
and ecx, esi
add ecx, edi
add cl, 0x30
mov byte [ebp + ebx - 1], cl
add edx, 1
add eax, 4
add ebx, 0xffffffff
jne 0x413d60
mov ecx, dword [esp + 4]
lea edi, [ecx - 1]
lea esi, [ecx - 2]
mov ecx, 3
mov eax, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi], 0x30
cmovne edi, esi
add esi, 0xffffffff
add ecx, 0xffffffff
jne 0x413db0
add esi, 0xfffffffd
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + esi + 3], 0x30
lea ecx, [esi + 3]
cmove ecx, edi
lea edx, [esi + 2]
cmp byte [eax + esi + 2], 0x30
cmove edx, ecx
lea edi, [esi + 1]
cmp byte [eax + esi + 1], 0x30
cmove edi, edx
cmp byte [eax + esi], 0x30
cmovne edi, esi
add esi, 0xfffffffc
cmp esi, 0xfffffffc
jne 0x413dd0
mov ecx, eax
add ecx, 1
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov esi, dword [esp + 8]
mov dword [esp + 0x14], edi
jmp 0x413e2f
add ecx, 1
mov edx, esi
shr edx, cl
test edx, edx
je 0x413ef0
mov ebx, 1
shl ebx, cl
mov edx, esi
sub edx, ebx
jbe 0x413e20
mov dword [esp], edx
mov edx, edi
mov dword [esp + 0x1c], ecx
shr edx, cl
and dl, 1
neg dl
xor ebp, ebp
cmp dword [esp + 4], ebx
je 0x413ebc
mov esi, dword [esp]
and esi, 0xfffffffe
neg esi
xor ebp, ebp
mov edi, dword [esp + 0x10]
mov ecx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [edi - 1]
movzx edx, byte [edi + ebx - 1]
mov ah, dl
xor ah, al
and ah, cl
xor al, ah
mov byte [edi - 1], al
xor ah, dl
mov byte [edi + ebx - 1], ah
movzx eax, byte [edi]
movzx edx, byte [edi + ebx]
mov ah, dl
xor ah, al
and ah, cl
xor al, ah
mov byte [edi], al
xor ah, dl
mov byte [edi + ebx], ah
add edi, 2
add ebp, 0xfffffffe
cmp esi, ebp
jne 0x413e70
sub ebx, ebp
neg ebp
mov esi, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x14]
mov edx, ecx
test byte [esp], 1
mov ecx, dword [esp + 0x1c]
je 0x413e20
mov dword [esp + 0x18], edx
mov dl, byte [eax + ebp]
mov dh, byte [eax + ebx]
mov byte [esp], dh
mov dh, byte [esp]
xor dh, dl
and dh, byte [esp + 0x18]
xor dl, dh
mov byte [eax + ebp], dl
xor dh, byte [esp]
mov byte [eax + ebx], dh
jmp 0x413e20
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x420980
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x54]
imul eax, dword [esp + 0x24], 0x3e8
mov ecx, 0x10624dd3
mul ecx
shr edx, 6
mov dword [esp], edx
mov edi, 1
mov ebx, 1
nop
nop
nop
nop
nop
nop
mov dword [esp + 4], ebx
mov ebx, edi
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov edi, eax
mov ebp, esi
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push ebx
push dword [esp + 0x50]
push dword [esp + 0x50]
call fcn.0041fd70
add esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
mov edi, dword [esp + 4]
add edi, ebx
setb cl
cmp eax, dword [esp]
jae 0x420a24
test cl, cl
jne 0x420a24
push 0
mov esi, ebp
push ebp
call fcn.0040e8b0
add esp, 8
jmp 0x4209b0
mov eax, dword [esp + 0x28]
mov dword [eax], ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x420a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc08
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x464010]
xor ecx, ebp
mov dword [esp + 0xc00], ecx
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [eax + ecx*8]
mov ebx, dword [eax + ecx*8 + 4]
xor edi, dword [edx + ecx*8]
xor ebx, dword [edx + ecx*8 + 4]
mov dword [esp + ecx*8 + 0x804], ebx
mov dword [esp + ecx*8 + 0x800], edi
add ecx, 1
cmp ecx, 0x80
jne 0x420a70
lea eax, [esp + 0x800]
lea edi, [esp + 0x400]
mov ecx, edi
mov edx, 2
push 2
push eax
call fcn.00420cd0
add esp, 8
lea eax, [esp + 0x880]
lea ecx, [esp + 0x480]
mov edx, 2
push 2
push eax
call fcn.00420cd0
add esp, 8
lea eax, [esp + 0x900]
lea ecx, [esp + 0x500]
mov edx, 2
push 2
push eax
call fcn.00420cd0
add esp, 8
lea eax, [esp + 0x980]
lea ecx, [esp + 0x580]
mov edx, 2
push 2
push eax
call fcn.00420cd0
add esp, 8
lea eax, [esp + 0xa00]
lea ecx, [esp + 0x600]
mov edx, 2
push 2
push eax
call fcn.00420cd0
add esp, 8
lea eax, [esp + 0xa80]
lea ecx, [esp + 0x680]
mov edx, 2
push 2
push eax
call fcn.00420cd0
add esp, 8
lea eax, [esp + 0xb00]
lea ecx, [esp + 0x700]
mov edx, 2
push 2
push eax
call fcn.00420cd0
add esp, 8
lea eax, [esp + 0xb80]
lea ecx, [esp + 0x780]
mov edx, 2
push 2
push eax
call fcn.00420cd0
add esp, 8
mov ebx, esp
mov ecx, ebx
mov edx, 0x10
push 0x10
push edi
call fcn.00420cd0
add esp, 8
lea eax, [esp + 0x410]
lea ecx, [esp + 0x10]
mov edx, 0x10
push 0x10
push eax
call fcn.00420cd0
add esp, 8
lea eax, [esp + 0x420]
lea ecx, [esp + 0x20]
mov edx, 0x10
push 0x10
push eax
call fcn.00420cd0
add esp, 8
lea eax, [esp + 0x430]
lea ecx, [esp + 0x30]
mov edx, 0x10
push 0x10
push eax
call fcn.00420cd0
add esp, 8
lea eax, [esp + 0x440]
lea ecx, [esp + 0x40]
mov edx, 0x10
push 0x10
push eax
call fcn.00420cd0
add esp, 8
lea eax, [esp + 0x450]
lea ecx, [esp + 0x50]
mov edx, 0x10
push 0x10
push eax
call fcn.00420cd0
add esp, 8
lea eax, [esp + 0x460]
lea ecx, [esp + 0x60]
mov edx, 0x10
push 0x10
push eax
call fcn.00420cd0
add esp, 8
lea eax, [esp + 0x470]
lea ecx, [esp + 0x70]
mov edx, 0x10
push 0x10
push eax
call fcn.00420cd0
add esp, 8
xor eax, eax
nop
nop
nop
nop
mov ecx, dword [esp + eax*8]
mov edx, dword [esp + eax*8 + 4]
xor edx, dword [esp + eax*8 + 0x804]
xor ecx, dword [esp + eax*8 + 0x800]
xor dword [esi + eax*8], ecx
xor dword [esi + eax*8 + 4], edx
add eax, 1
cmp eax, 0x80
jne 0x420c60
push 0x400
lea eax, [esp + 0x804]
push eax
call fcn.004116e0
add esp, 8
push 0x400
push edi
call fcn.004116e0
add esp, 8
push 0x400
push ebx
call fcn.004116e0
add esp, 8
mov ecx, dword [esp + 0xc00]
xor ecx, ebp
call fcn.0043208f
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4218d0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x20]
mov eax, dword [0x464010]
xor eax, esp
mov dword [esp + 8], eax
push 9
push str..pipe_
push esi
call fcn.0043df90
add esp, 0xc
test eax, eax
je 0x42190e
push 0x16
push 0x45d0be
push str.strncmp_pipename___.pipe___9___0
call fcn.0043bf69
add esp, 0xc
lea eax, [esi + 9]
push 0x5c
push eax
call fcn.00434e10
add esp, 8
test eax, eax
je 0x421934
push 0x17
push 0x45d0be
push 0x45e424
call fcn.0043bf69
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
mov ebp, esi
push esi
call edi
cmp eax, 0xffffffff
jne 0x42198c
call ebx
cmp eax, 0xe7
jne 0x4219d4
push 0
mov esi, ebp
push ebp
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
test eax, eax
jne 0x421940
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00410050
add esp, 4
push eax
push esi
push str.Error_waiting_for_named_pipe__s:__s
jmp 0x4219ea
mov esi, eax
call fcn.0040f7f0
test eax, eax
je 0x4219f4
mov edi, eax
mov eax, esp
lea ecx, [esp + 4]
push eax
push 0
push 0
push 0
push ecx
push 1
push 6
push esi
call dword [0x465334]
test eax, eax
je 0x421a12
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00410050
add esp, 4
push eax
push str.Unable_to_get_named_pipe_security_information:__s
jmp 0x421a42
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00410050
add esp, 4
push eax
push ebp
push str.Unable_to_open_named_pipe__s:__s
call fcn.0040dd70
add esp, 0xc
jmp 0x421a4a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00410050
add esp, 4
push eax
push str.Unable_to_get_user_SID:__s
jmp 0x421a42
push edi
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x421a2c
push dword [esp]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x421a55
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebp
push str.Owner_of_named_pipe__s_is_not_us
call fcn.0040dd70
add esp, 8
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov esi, 0xffffffff
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0043208f
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret