joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4786f9
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x547f03
call fcn.0054565c
sub esp, 0x214
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x13
ja 0x47891c
invalid
xor ebx, ebx
mov dword [ebp - 0x14], vtable.RegKey.0
mov dword [ebp - 0x10], ebx
push 0xf003f
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push dword [edi + 4]
lea ecx, [ebp - 0x14]
call fcn.0047bbcb
mov esi, eax
cmp esi, 0x80070002
je 0x4789ba
cmp esi, 0x80070003
je 0x4789ba
test esi, esi
jne 0x4789ba
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x478996
lea eax, [ebp - 0x220]
push eax
call fcn.004786f9
mov esi, eax
test esi, esi
jne 0x4789ba
lea eax, [ebp - 0x20]
push eax
xor ecx, ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x220]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 0x18], pe_nt_image_headers32
call ebx
lea ecx, [ebp - 0x14]
test eax, eax
je 0x47896f
call fcn.0047b994
push dword [ebp + 8]
mov ecx, edi
call fcn.0040ba6f
mov esi, eax
lea ecx, [ebp - 0x14]
Function at 0x478c9e
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov bh, 0x30
stc
dec dword [ebx - 0x13b27210]
mov dword [ebp - 0x14], vtable.RegKey.0
call fcn.0047b994
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
mov eax, 0x547f25
call fcn.0054565c
sub esp, 0x14
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x47
ja 0x478bfb
mov ecx, 0x1a6e8e2a
fbld tbyte [esi]
mov esi, 0x88792621
mov al, 0xec
adc eax, dword [eax + 0x43]
dec edx
int1
cmc
jne 0x478a12
sub eax, 0xdd1fc66d
ja 0x4789b4
add eax, 0x8e867d38
cli
pop ecx
enter 0xa89, 0x69
adc al, 0x69
pop edx
out 0x96, al
cmp eax, 0xe334710f
jecxz 0x478a1f
adc al, 0x78
invalid
push esi
lea ecx, [ebp - 0x14]
call fcn.00401a3b
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00478383
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov esi, eax
call int.004780a0
and dword [ebp - 0x1c], 0
mov edi, vtable.RegKey.0
mov dword [ebp - 0x20], edi
push 0xf003f
mov byte [ebp - 4], 2
push dword [ebp - 0x18]
lea ecx, [ebp - 0x20]
push esi
call fcn.0047bbcb
mov esi, eax
test esi, esi
jne 0x478c53
push dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
call fcn.004786f9
mov esi, eax
jmp 0x478c65
cmp esi, 0x80070002
je 0x478c63
cmp esi, 0x80070003
jne 0x478c65
xor esi, esi
lea ecx, [ebp - 0x20]
call fcn.0047b994
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], edi
call fcn.0047b994
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.004013c0
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004013c0
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
leave
ret
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x3c
ja 0x478eaf
pop edi
jecxz 0x478d27
pop eax
push ss
or dword [eax - 0x1d], ebx
push cs
cwde
mov bl, bh
or edx, dword [ecx]
adc ebx, ecx
sahf
invalid
sti
xor esp, eax
lea ebx, [ebx - 0x5a]
adc dword [ecx - 0xeb50f64], ebx
retf
mov ecx, esi
pop esi
jmp 0x4789dc

Function at 0x4795f1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0xf
ja 0x479805
add byte [ebx - 0x78f0f008], al
inc dword [ecx]
add byte [eax], al
jnp 0x4795df
or al, 0x43
or dword [ebx + 0x2c239c80], esp
test al, 0x1c
div ecx
aad 0x63
imul dword [esi + 0x303b2fa2]
jp 0x4795ee
and byte [edi + 0x5a], ah
fdiv qword [esi]
mov ebp, 0xa65923d8
in eax, 0x1d
js 0x4795fc
inc ebx
jo 0x4796ae
or dh, ah
jp 0x47967b
das
cmp eax, ecx
inc esp
lds edx, [ebx]
stosb byte es:[edi], al
xchg ebx, eax
inc eax
mov bl, 0xd9
adc eax, 0xc65d32c7
cmp al, byte [edx - 0x5a8bb152]
sbb dl, bl
int 0x1c
adc ah, bl
mov dword [0x1b9baeb8], eax
mov ch, 0xc7
invalid
invalid
push ss
out dx, al
xchg ebx, eax
retf 0xcea3
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, ecx
pop esi
pop ebp
ret 8
Function at 0x479f3a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x2f
ja 0x47a153
add byte [eax + 0x7c], al
cld
inc eax
jl 0x479f53
xchg ebp, eax
jno 0x479f6f
mov al, 0x62
mov edx, 0xc3a6a6dc
sub dword [edx - 0x2148cf14], 0x27
xchg edx, eax
jle 0x479f5a
cmp byte [ecx], al
pop ebx
sbb eax, 0xc58c7f90
and al, 0x60
inc ebx
or bh, bl
xchg edi, eax
stosb byte es:[edi], al
add cl, dl
mov eax, 0x6b2446f9
mov eax, 0xa649f8ec
nop
call [edx + 0xe24ac3]
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0x8cc3da1c]
aam 0x82
lcall 0xf1d1, 0x2ed2b1da
out 0xb9, eax
push ss
mov ch, 0x24
sahf
int 0x9f
jp 0x479f4b
add byte [edi + 0xa4550e7], bl
cmp eax, 0x25ed9bcb
cmpsb byte [esi], byte es:[edi]
xchg esi, eax
mov al, byte [0x9ebc2263]
pop esp
movsd dword es:[edi], dword [esi]
xchg ebx, eax
aad 0x6b
mov esi, dword [edi + 0x5b1178fd]
scasb al, byte es:[edi]
rol dword [0x55ebf0c1], 1
xor dword [edi + 0xe497d64], edi
int1
cmpsd dword [esi], dword es:[edi]
xchg ebp, eax
or ebx, dword [eax + 0x1fa56016]
invalid
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.004ae8cf
lea ecx, [ebp - 4]
push ecx
push ebx
lea ecx, [ebp - 8]
push ecx
push ebx
push str.Debug
push dword [edi + 4]
call dword [eax + 0x2ec]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x47a1ed
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00417f6a
mov ebx, dword [ebp + 0xc]
pop ecx
mov dword [ebx], eax
test eax, eax
je 0x47a1e8
cmp dword [ebp - 4], esi
je 0x47a1e1
call fcn.004ae8cf
lea ecx, [ebp - 4]
push ecx
push dword [ebx]
lea ecx, [ebp - 8]
push ecx
push esi
push str.Debug
push dword [edi + 4]
call dword [eax + 0x2ec]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x47a1ed
xor ecx, ecx
mov word [eax], cx
jmp 0x47a1ed
mov esi, 0x8007000e
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x47a6a4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0
push str.Debug
push dword [esi + 4]
jbe 0x47a68d
call dword [eax + 0x2ec]
add byte [eax], al
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, ecx
pop esi
leave
ret 8
add byte [ebp - 0x37b1f040], 0x8b
rcr dword [esi - 0x37], 0xc2
or byte [eax], al
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x2d
ja 0x47a8bb
clc
sub eax, 0x1ff870f
add byte [eax], al
cmp byte [eax - 0x4231d292], cl
daa
xor ch, byte [ebx + 0x27]
push 0x2c
jb 0x47a734
aad 0x90
pushfd
xor ch, bh
in eax, dx
dec eax
sub byte [edx + 0x13], ah
adc cl, byte [edi - 0x5e]
jnp 0x47a67f
outsb dx, byte [esi]
in al, dx
jecxz 0x47a6b4
jecxz 0x47a697
cmp ebx, ebp
movsd dword es:[edi], dword [esi]
mov ch, 0xba
cmp dword [ebx - 0x5308a4fd], eax
mov dword [0x2c744d68], eax
imul ebp, dword [ebp + 0x674fbf55], 0x34
cmp al, 0xc5
js 0x47a6e0
jmp 0x47a687
mov dh, 0xe7
mov dword [0xc41b25f3], eax
lcall 0xf33a, 0x15603b5b
sbb byte [esi], 0x23
push 0xffffffffffffffc0
mov cl, 0xb1
and al, 0xa3
adc al, 0xa8
daa
sub dword [0x93a45c28], edx
daa
cmp edi, eax
aas
push ds
popfd
add byte [ecx + eax + 0x756508fb], ah
mov ebx, 0xdd3ec6b8
push ds
outsb dx, byte [esi]
mul al
shr byte [ebp + eax - 0x1e], 1
xor byte [edi - 0x33], 8
sar dword [edx + 0x25], 1
and byte [ecx + 0x50], ch
or dword [ebp + 0x438fcb47], eax
push edi
cld
sbb eax, 0xdaae447c
or ecx, dword [esi - 0x23999dcc]
mov esi, 0x93e493c9
xchg ecx, eax
cmpsd dword [esi], dword es:[edi]
movsd dword es:[edi], dword [esi]
cdq
out 0xb2, al
lodsb al, byte [esi]
dec edi
pushfd
inc ebx
sbb dh, ch
pop ebx
js 0x47a7c7
wait
dec bh
fsubrp st(0)
cmp bh, byte [ecx]
mov bl, byte [ebp - 0x80]
jo 0x47a779
mov ebx, 0xe2e38b24
mov esi, 0xd16c1bd0
leave
sbb ebp, dword [ecx + edx*8 - 0x37]
fstp qword [ecx - 0x56]
lcall 0x551c, 0x918b0492
or edi, edi
pop esp
cmp dword [ebx - 0xbb007ba], esi
xor al, 0x5b
in eax, 0x3b
invalid
invalid
mov ebx, dword [ebp + 0x10]
and dword [ebx], 0
call fcn.004ae8cf
mov esi, dword [ebp + 0x14]
push esi
push 0
push dword [ebp + 0xc]
push 0
push str.Debug
push dword [edi + 4]
call dword [eax + 0x2ec]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jne 0x47a928
cmp dword [esi], ecx
je 0x47a928
push dword [esi]
call fcn.00417f6a
pop ecx
mov dword [ebx], eax
Function at 0x47b4bc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x5e
ja 0x47b6d5
mov dword [0x4dab4ffd], eax
xor eax, 0xf774540
in al, dx
fdivr dword [edx + ecx*4]
pushal
or eax, 0xa8f43a2f
xchg esp, eax
movsd dword es:[edi], dword [esi]
and ecx, dword [0x399ecd1]
pop ds
scasb al, byte es:[edi]
invalid
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.004ae8cf
lea ecx, [ebp - 4]
push ecx
push ebx
lea ecx, [ebp - 8]
push ecx
push ebx
push dword [ebp + 8]
push dword [edi + 4]
call dword [eax + 0x2ec]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x47b763
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
test eax, eax
je 0x47b75e
shr eax, 1
inc eax
push eax
call fcn.00402558
mov esi, eax
test esi, esi
jne 0x47b72a
call fcn.004ae8cf
lea ecx, [ebp - 4]
push ecx
push esi
lea ecx, [ebp - 8]
push ecx
push ebx
push dword [ebp + 8]
push dword [edi + 4]
call dword [eax + 0x2ec]
movzx esi, ax
call fcn.00402511
Function at 0x47e372
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x39
ja 0x47e58b
mov ecx, 0x67bb326
sub ebx, dword [0xee8fec17]
ljmp 0xb383
xor esi, esi
mov ebx, esi
call fcn.004ae8cf
cmp dword [eax + 0x27c], esi
je 0x47e741
call fcn.004ae8cf
cmp dword [eax + 0x280], esi
je 0x47e741
call fcn.004ae8cf
cmp dword [eax + 0x2a4], esi
je 0x47e741
call fcn.004ae8cf
cmp dword [eax + 0x2ac], esi
je 0x47e741
mov eax, dword [ebp + 0x1c]
push 0x14
mov esi, dword [eax + 0x10]
push ebx
push eax
call fcn.0041b930
mov eax, dword [ebp + 0x1c]
add esp, 0xc
mov dword [eax + 0x10], esi
mov eax, dword [edi + 0x201c]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x2020]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], esi
and dword [eax], ebx
call fcn.004ae8cf
push dword [ebp + 0x1c]
mov esi, dword [ebp + 0x18]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
cmp byte [ebp + 8], bl
je 0x47e627
call dword [eax + 0x280]
jmp 0x47e62d
call dword [eax + 0x27c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x18], eax
test eax, eax
jne 0x47e660
xor ebx, ebx
inc ebx
call fcn.004ae8cf
push ebx
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0xc]
call dword [eax + 0x2a4]
test eax, eax
mov eax, dword [ebp + 0x18]
je fcn.0047e6ae
xor ebx, ebx
cmp dword [esi], ebx
setne bl
jmp fcn.0047e6ae
cmp eax, 0x3e5
jne 0x47e6fb
cmp byte [ebp + 0x24], bl
push 0x64
pop ecx
mov eax, 0x7530
cmovne eax, ecx
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 3
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x47e6db
call fcn.004ae8cf
push 1
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0xc]
call dword [eax + 0x2a4]
test eax, eax
je 0x47e6ce
xor ebx, ebx
cmp dword [esi], ebx
setne bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne fcn.0047e6ab
jmp 0x47e700
cmp eax, 0x102
jne fcn.0047e6ab
call fcn.004ae8cf
push dword [ebp + 0xc]
call dword [eax + 0x2ac]
mov eax, dword [ebp + 0x20]
mov dword [eax], 1
cmp eax, 0x6d
jne 0x47e70b
push 1
mov ecx, edi
call fcn.0047ef90
jmp fcn.0047e6ab
call fcn.004ae8cf
push 0
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0xc]
call dword [eax + 0x2a4]
test eax, eax
je 0x47e72a
xor ebx, ebx
cmp dword [esi], ebx
setne bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp fcn.0047e6ae
xor eax, eax
Function at 0x47f706
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x20
ja 0x47f91f
jecxz 0x47f777
xchg ecx, eax
push esp
sbb byte [ecx + edi*8 + 0x2b], dl
test eax, 0xd5eb42a4
pop ss
inc eax
sub ch, byte [esi + 0x1d353309]
dec ebp
out dx, eax
movsb byte es:[edi], byte [esi]
daa
push 0xfd6e323a
jbe 0x47f70c
sti
mov dword [eax - 0x28aec518], eax
sbb byte [esi - 0x68], al
add edi, ebx
adc al, 0x2a
ret
inc ebx
cwde
sub al, 0xa3
xlatb
fcomp qword [esi + 0x4e4cd5d8]
push es
xlatb
in al, dx
invalid
and dword [ebp - 4], 0
mov dword [ebp - 8], 1
xor bl, bl
call fcn.004ae8cf
xor esi, esi
cmp dword [eax + 0x27c], esi
je 0x47fa24
call fcn.004ae8cf
cmp dword [eax + 0x280], esi
je 0x47fa24
cmp byte [edi + 4], 0
je 0x47f9a4
call fcn.004ae8cf
push esi
lea ecx, [ebp - 0x10]
push ecx
push 4
pop esi
push esi
lea ecx, [ebp - 8]
push ecx
push dword [edi + 0x200c]
call dword [eax + 0x27c]
test eax, eax
je 0x47f97d
cmp dword [ebp - 0x10], esi
je 0x47f97f
mov bl, 1
call fcn.004ae8cf
push 0
lea ecx, [ebp - 0xc]
push ecx
push esi
lea ecx, [ebp - 4]
push ecx
push dword [edi + 0x200c]
call dword [eax + 0x280]
test eax, eax
je 0x47f9f2
cmp dword [ebp - 0xc], esi
jmp 0x47f9f0
call fcn.004ae8cf
push esi
lea ecx, [ebp - 0xc]
push ecx
push 4
pop esi
push esi
lea ecx, [ebp - 4]
push ecx
push dword [edi + 0x200c]
call dword [eax + 0x280]
test eax, eax
je 0x47f9cb
cmp dword [ebp - 0xc], esi
je 0x47f9cd
mov bl, 1
call fcn.004ae8cf
push 0
lea ecx, [ebp - 0x10]
push ecx
push esi
lea ecx, [ebp - 8]
push ecx
push dword [edi + 0x200c]
call dword [eax + 0x27c]
test eax, eax
je 0x47f9f2
cmp dword [ebp - 0x10], esi
je 0x47f9f4
mov bl, 1
mov ecx, dword [edi + 0x208c]
push dword [ebp - 4]
push dword [ebp - 8]
test ecx, ecx
je 0x47fa14
test bl, bl
sete al
movzx eax, al
push eax
call ecx
add esp, 0xc
jmp 0x47fa26
test bl, bl
sete al
movzx eax, al
push eax
call fcn.0047fa2b
jmp 0x47fa26
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x47fc55
Capabilities:
Create thread

Disassembly:
jge 0x47fc47
add byte [ebp + 4], dh
xor al, al
jmp 0x47fc51
dec ebp
or al, 0x33
sar byte [ebx], 0x4d
adc byte [edi], cl
xchg esp, eax
rcr byte [ebp - 0x3e], 0xc
add byte [esi - 0x75], dl
push esi
mov esi, ecx
pop ebp
ret 0xc
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x53
ja 0x47fe66
xchg ebp, eax
mov dword [eax + eax*4], 0x36fcf860
movsd dword es:[edi], dword [esi]
push ebp
das
out dx, eax
mov word [ecx - 0x3a0afdae], es
dec edi
int1
mov bh, 0x10
clc
cdq
sbb byte [0xe8fbf354], ah
add eax, 0x2816a62e
dec cl
xor al, 0x7d
mov esp, 0x999c8c5
sal byte [edi - 0x13], 0x2a
inc ecx
test byte [edx - 0x6c], dl
jg 0x47fc3d
sal ah, cl
inc byte [ebx - 0x4ff947c7]
daa
rcl dword [ebx + 0x3c]
arpl word [edi - 0x518dfef2], si
cld
invalid
xor eax, eax
push eax
push eax
push esi
push 0x4803f0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [esi + 0x2018]
mov dword [esi + 0x2030], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, 1
pop esi
ret
Function at 0x480786
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x547fdf
call fcn.0054565c
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x53
ja 0x4809a6
pushal
bound eax, qword [edx]
fild word [eax]
cmpsb byte [esi], byte es:[edi]
or byte [esi - 0x47790043], dl
mov ebp, 0xa066d0e
ret
push 0x2000
or ebx, 0xffffffff
call fcn.00417f6a
mov esi, eax
mov dword [esp], 0x2000
push 0
push esi
mov dword [ebp - 0x10], esi
call fcn.0041b930
sub esp, 0xc
mov ecx, esp
push str..pipe_
call fcn.004018f6
push 0x34c
push 9
push ecx
push 0x3f
pop edx
lea ecx, [ebp - 0x2c]
call fcn.004aeee4
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
push 0x1000
push esi
call fcn.0041c503
push dword [ebp + 8]
push 0x1000
push esi
call fcn.0041d425
mov esi, dword [sym.imp.KERNEL32.dll_ResetEvent]
add esp, 0x3c
push dword [edi + 0x201c]
call esi
push dword [edi + 0x2020]
call esi
cmp byte [edi + 4], 0
je 0x480ad2
lea esi, [edi + 0x20c4]
push esi
call fcn.00480da3
test eax, eax
jne 0x480a7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x2010], eax
mov esi, dword [ebp - 0x10]
call fcn.004ae8cf
cmp dword [eax + 0x290], 0
je 0x480ab6
call fcn.004ae8cf
push dword [esi]
mov esi, dword [ebp - 0x10]
push 0x7d0
mov ecx, 0x2800
push ecx
push ecx
push 1
push 0
push 0x40040003
push esi
call dword [eax + 0x290]
mov ebx, eax
jmp 0x480ab9
mov esi, dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x2010], eax
cmp ebx, 0xffffffff
je fcn.00480a54
push ebx
call fcn.00481089
jmp fcn.00480a54
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [ebp + 8], eax
call esi
sub eax, dword [ebp + 8]
cmp eax, 0x7530
jae 0x480a51
mov esi, dword [ebp - 0x10]

Function at 0x480b6f
Capabilities:
Check for time delay via gettickcount

Disassembly:
call fcn.004ae8cf
cmp dword [eax + 0x278], 0
je 0x480b1e
call fcn.004ae8cf
push 0
push 0x40000000
push 3
push 0
push 3
add byte [edx + 3], ch
push 0xc0000000
push esi
call dword [eax + 0x278]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x2010], eax
cmp ebx, 0xffffffff
jne fcn.00480a54
cmp eax, 0xe7
jne fcn.00480a54
call fcn.004ae8cf
cmp dword [eax + 0x298], 0
je 0x480b5a
call fcn.004ae8cf
push 0
push esi
call dword [eax + 0x298]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 8]
cmp eax, 0x7530
jb 0x480af0
jmp fcn.00480a54
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x42
ja 0x480d80
rcr dword [eax], cl
inc ecx
dec ebx
dec ebx
loop 0x480b0d
rol byte [esp + ebx], 1
jmp 0x2cd38d41
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x480d9e
cmp dword [esi + 4], 0
je 0x480d97
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
pop ebp
ret 4
Function at 0x480da3
Capabilities:
Check for time delay via gettickcount

Disassembly:
fld dword [esi - 0x80]
test ebp, ecx
popfd
and al, dh
call 0xe7656bcf
and eax, 0x3d203588
cmp al, 0x6c
ret
mov eax, 0x547ff1
call fcn.0054565c
sub esp, 0x20
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x5e
ja 0x480fc1
js 0x480d4c
mov al, byte [0x95c7e4b1]
cmc
jmp 0x2bab5a50
sub esp, 0x18
mov ecx, esp
xor esi, esi
xor ebx, ebx
push str.dpp_dddjRQjdxrlrdpjdddkjRmcQjdxrlr_
inc esi
mov dword [ebp - 0x10], ebx
call fcn.004018f6
push 0x910
push 0x24
push ecx
push 9
pop edx
lea ecx, [ebp - 0x2c]
call fcn.004aeee4
add esp, 0x24
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 8
lea edi, [ebp - 0x2c]
cmovae edi, dword [ebp - 0x2c]
call fcn.004ae8cf
cmp dword [eax + 0x294], ebx
jne 0x48100d
mov esi, ebx
jmp 0x48106b
call fcn.004ae8cf
push ebx
lea ecx, [ebp - 0x10]
push ecx
push 1
push edi
call dword [eax + 0x294]
test eax, eax
je 0x481036
push 0xc
pop edi
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, eax
test ecx, ecx
jne 0x48105b
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x10], 0
mov edi, eax
je 0x481052
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x10], ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x48106b
mov dword [ecx], edi
mov eax, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 8], ebx
mov dword [eax], ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004023ba
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x481089
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x38
ja 0x48129d
sbb esp, dword [ecx*2 + 0x54cdb0f8]
sbb ch, dh
push edx
cmovnp ebp, dword [ebp - 0xa]
inc edx
xchg edi, eax
sbb byte [edi - 0x19b719f0], al
imul ebp, dword [ebx - 0x37303b50], 0xffffffbe
stosb byte es:[edi], al
xor byte [eax - 0x37cec3d5], dh
sar byte [esi - 0x2844eb6a], 1
cld
jb 0xd822d864
mov dl, 0x5d
cdq
pop ebp
push ss
xchg edx, eax
sbb edi, dword [edx - 0x11469d64]
sbb esi, esp
and bl, 0x9b
adc dword [edx - 0x36a411bc], 0x9e106593
jbe 0x4810c2
test eax, 0xcbe75249
sub bl, byte [ebx]
mov byte [esi], ch
push 0xd851c16b
shr dword [esi - 0x3794df94], 1
cmpsd dword [esi], dword es:[edi]
sbb al, 0xb7
mov dword gs:[eax - 0x404c7c5a], eax
ror esi, 0x2c
mov dl, 0xae
ret 0x2c5f
push esi
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.004ae8cf
cmp dword [eax + 0x2f0], esi
je 0x481372
call fcn.004ae8cf
cmp dword [eax + 0x2f4], esi
je 0x481372
call fcn.004ae8cf
cmp dword [eax + 0x2f8], esi
je 0x481372
push ebx
push edi
call fcn.004ae8cf
push esi
push esi
lea ecx, [ebp - 8]
push ecx
push esi
push esi
push 4
push 6
push dword [ebp + 8]
call dword [eax + 0x2f0]
push 0x20
xor ebx, ebx
lea eax, [ebp - 0x3c]
push esi
inc ebx
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 2
mov dword [ebp - 0xc], 0x5591a0
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
call fcn.0041b930
add esp, 0xc
mov dword [ebp - 0x34], esi
push 5
pop ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], pe_nt_image_headers32
lea esi, [ebp - 0x1c]
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
call fcn.004ae8cf
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 8]
lea ecx, [ebp - 0x3c]
push ecx
push ebx
call dword [eax + 0x2f4]
call fcn.004ae8cf
xor ecx, ecx
push ecx
push dword [ebp - 4]
push ecx
push ecx
push 4
push 6
push dword [ebp + 8]
call dword [eax + 0x2f8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop ebx
pop esi
leave
ret 4

Function at 0x481377
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
mov dword [esi], vtable.PipeClientServer.0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x68
ja 0x48158e
pop ss
xchg ebp, eax
pop ds
and esp, dword [eax]
inc eax
pop es
invalid
mov ecx, esi
call fcn.0047ec79
lea ecx, [esi + 0x2058]
call fcn.00481c9f
lea ecx, [esi + 0x2034]
pop esi
jmp fcn.00481c9f
Function at 0x4817d1
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 3
ja 0x481808
or ah, dh
cmp byte [esi], al
std
loopne 0x4817f6
imul ebx, dword [ecx - 0x80], 0x29186c54
ljmp 0xa972
fsubr st(1), st(0)
push edx
outsd dx, dword [esi]
std
push ss
xor dword [edx - 0x1a64869f], ebx
and cl, byte [esi + 0x79799893]
cmp byte [esi + 0x1c], 0
je 0x48181a
mov ecx, dword [esi + 0x20]
mov byte [esi], 1
pop esi
jmp 0x48278b
pop esi
ret
lea ecx, [ebx + 0x1c]
xor eax, eax
push eax
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
leave
ret
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x5d
ja 0x48299c
and ch, bl
or eax, 0x99d0ae39
movsd dword es:[edi], dword [esi]
ja 0x482734
pop esp
scasd eax, dword es:[edi]
movsd dword es:[edi], dword [esi]
invalid
test esi, esi
je 0x4829b3
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x4829b3
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret