joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10049540
Capabilities:
Get graphical window text

Disassembly:
push 0x20
mov eax, 0x100a0667
call fcn.1009220a
mov edi, ecx
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [ebp - 0x14]
je 0x10049687
mov eax, dword [0x100b8f90]
mov ecx, 0x100b8f90
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x10], ebx
and dword [ebp - 4], 0
mov eax, dword [ebx - 8]
xor ecx, ecx
inc ecx
sub ecx, dword [ebx - 4]
mov esi, 0x200
sub eax, esi
or eax, ecx
jge 0x100495a6
mov eax, esi
lea ecx, [ebp - 0x10]
call fcn.10082950
mov ebx, dword [ebp - 0x10]
cmp dword [ebx - 8], esi
jge 0x100495b5
push 0x80070057
call fcn.10082a7c
mov dword [ebx - 0xc], esi
xor eax, eax
mov word [ebx + 0x400], ax
cmp dword [ebx - 4], 1
mov esi, dword [ebx - 8]
jle 0x100495d9
push dword [ebx - 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.100828c0
mov ebx, dword [ebp - 0x10]
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
or eax, 0xffffffff
lea esi, [ebp - 0x10]
call fcn.10082749
push dword [edi + 0xc]
lea eax, [ebp - 0x18]
push dword [ebp - 0x14]
push eax
call fcn.10048fdc
push dword [ebp + 8]
mov byte [ebp - 4], 1
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
setne al
mov byte [ebp + 8], al
push dword [ebp + 8]
mov eax, esi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
push eax
call fcn.100491f5
mov byte [ebp - 4], 2
mov eax, dword [edi + 4]
xor ecx, ecx
mov dword [ebp + 8], ecx
cmp eax, ecx
jle 0x10049661
mov edx, dword [ebp - 0x2c]
cmp dword [ebp + 8], 0
jl 0x100496d0
cmp dword [ebp + 8], eax
jge 0x100496d0
mov esi, dword [edi]
cmp edx, dword [ecx + esi]
je 0x10049692
inc dword [ebp + 8]
add ecx, 0x14
cmp dword [ebp + 8], eax
jl 0x1004963c
lea eax, [ebp - 0x2c]
push eax
mov esi, edi
call fcn.10061800
lea esi, [ebp - 0x2c]
call fcn.100496db
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.10082afb
lea eax, [ebx - 0x10]
call fcn.10082afb
xor eax, eax
inc eax
call fcn.100922e2
ret 4
mov esi, dword [ebp + 8]
cmp esi, eax
jge 0x100496d0
imul esi, esi, 0x14
add esi, dword [edi]
mov eax, dword [esi]
sub eax, edx
jne 0x100496c2
cmp byte [esi + 0xc], al
setne al
xor ecx, ecx
cmp byte [ebp - 0x20], cl
setne cl
sub eax, ecx
jne 0x100496c2
push dword [ebp - 0x24]
add esi, 8
push esi
call fcn.1005e562
test eax, eax
jns 0x1004966c
push dword [ebp + 8]
call fcn.1006188c
jmp 0x10049661
call fcn.1008132d
int3
Function at 0x1004abd1
Capabilities:
Accept command line arguments

Disassembly:
push 0x1c
mov eax, 0x1009e8a7
call fcn.1009220a
mov edi, dword [ebp + 8]
mov dword [edi], 0x1001c0c4
mov eax, dword [0x100b8f90]
mov ecx, 0x100b8f90
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
lea ebx, [edi + 4]
push ebx
call fcn.10048a6b
lea eax, [esi - 0x10]
call fcn.10082afb
and dword [edi + 0x10], 0
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.100270b4
push 0
push 0x1000365c
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 4
call fcn.10026c64
test al, al
je 0x1004ac88
cmp byte [ebp + 0x10], 0
jne 0x1004ac88
push dword [ebp + 0xc]
mov esi, ebx
call fcn.10048b1c
push 0xc
call fcn.10085d33
mov esi, eax
pop ecx
mov dword [ebp + 0x10], esi
mov byte [ebp - 4], 5
test esi, esi
je 0x1004acb8
mov dword [esi], 0x1001c030
and dword [esi + 4], 0
mov byte [ebp - 4], 7
call fcn.10026acc
mov ecx, ebx
mov dword [esi + 8], eax
call fcn.100730bf
call eax
jmp 0x1004acb3
lea eax, [ebp - 0x28]
call fcn.10027430
test al, al
je 0x1004acbf
cmp byte [ebp + 0x10], 0
jne 0x1004acbf
push 8
call fcn.10085d33
mov esi, eax
pop ecx
test esi, esi
je 0x1004acb8
mov dword [esi], 0x1001bf64
call fcn.10026acc
mov dword [esi + 4], eax
jmp 0x1004acba
xor esi, esi
mov dword [edi + 0x10], esi
jmp 0x1004acd5
push dword [ebp + 0xc]
mov esi, ebx
call fcn.10048b1c
mov ecx, ebx
call fcn.100730bf
call eax
mov dword [edi + 0x10], eax
lea ecx, [ebp - 0x28]
call fcn.1002740a
mov eax, edi
call fcn.100922e2
ret 0xc

Function at 0x1004b05a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esi + 8], eax
xor eax, eax
push eax
push eax
push esi
push 0x1004b02c
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x1004c123
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebx]
push 0x20
push dword [ebp + 0xc]
mov ecx, ebx
push dword [ebp + 8]
mov dword [ebp - 0x14], 0x80091007
call dword [eax]
test al, al
je 0x1004c233
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
test al, al
je 0x1004c233
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x1004c22b
push esi
mov esi, 0x100000
push esi
call fcn.100855a7
pop ecx
mov dword [ebp - 8], eax
cmp eax, edi
je 0x1004c221
push edi
lea ecx, [ebp + 8]
push ecx
push esi
mov dword [ebp + 8], edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
jmp 0x1004c1d0
cmp dword [ebp + 8], esi
ja 0x1004c218
push dword [ebp + 8]
mov eax, dword [ebx]
push dword [ebp - 8]
mov ecx, ebx
call dword [eax + 8]
test al, al
je 0x1004c218
cmp dword [ebp + 8], esi
jne 0x1004c1db
and dword [ebp + 8], 0
push 0
lea eax, [ebp + 8]
push eax
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call edi
test eax, eax
jne 0x1004c1a7
jmp 0x1004c218
mov eax, dword [ebx]
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 4]
push ecx
mov ecx, ebx
call dword [eax + 0xc]
test al, al
je 0x1004c218
cmp dword [ebp - 0x10], 0x20
jne 0x1004c20e
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp - 4]
push 8
pop ecx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x1004c20e
and dword [ebp - 0x14], eax
push dword [ebp - 4]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x10]
push dword [ebp - 8]
call fcn.100855b2
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
pop edi
mov eax, dword [ebp - 0x14]
leave
ret 8
Function at 0x1004d7e8
Capabilities:
Check if file exists

Disassembly:
push 4
mov eax, 0x1009e7b2
call fcn.1009220a
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp byte [ebp + 0xc], bl
jne 0x1004d812
mov eax, dword [ebp + 8]
mov eax, dword [eax]
sub eax, 0x10
call fcn.10082a9f
add eax, 0x10
mov dword [esi], eax
jmp 0x1004d880
mov eax, dword [0x100b8f90]
mov ecx, 0x100b8f90
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], ebx
push eax
mov eax, dword [ebp + 0x10]
call fcn.1003a6d8
mov byte [ebp - 4], 1
mov eax, dword [eax]
mov ecx, dword [edi]
push eax
push ecx
lea eax, [ebp + 0xc]
call fcn.1005edc7
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
call fcn.10082afb
mov ebx, dword [ebp + 0xc]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1004d866
mov eax, dword [edi]
jmp 0x1004d86b
mov eax, dword [ebp + 8]
mov eax, dword [eax]
sub eax, 0x10
call fcn.10082a9f
add eax, 0x10
mov dword [esi], eax
lea eax, [ebx - 0x10]
call fcn.10082afb
mov eax, esi
call fcn.100922e2
ret 0xc

Function at 0x1004d8d0
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x1009e787
call fcn.1009220a
mov esi, ecx
and dword [ebp - 4], 0
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.1005e2c8
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x1004d92d
lea eax, [ebp - 0x14]
push eax
call fcn.1002903c
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.1005e434
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.10082afb
push dword [ebp + 8]
mov eax, edi
call fcn.1005ed8d
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1004d950
push dword [ebp + 8]
mov esi, dword [esi + 4]
push 0x1000da18
push eax
call fcn.10026c05
add esp, 0xc
jmp 0x1004d9a6
mov ebx, dword [ebp - 0x10]
mov ecx, esi
call fcn.1004d9c4
push 5
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
xor ebx, ebx
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], ebx
rep stosd dword es:[edi], eax
jmp 0x1004d999
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x30]
push eax
call esi
test eax, eax
jne 0x1004d985
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.10082afb
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.10082afb
call fcn.100922e2
ret 4
Function at 0x10050763
Capabilities:
Accept command line arguments

Disassembly:
push 0x24
mov eax, 0x100a05f6
call fcn.1009220a
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0x1c]
xor ebx, ebx
mov dword [esi + 0x1c], eax
mov edi, 0x1001d82c
push edi
lea eax, [esi + 0x28]
push eax
mov dword [esi], 0x1001c564
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov byte [esi + 0x14], bl
mov dword [esi + 0x20], ebx
mov byte [esi + 0x24], bl
call fcn.1005e2c8
push edi
lea eax, [esi + 0x2c]
push eax
mov dword [ebp - 4], ebx
call fcn.1005e2c8
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.1005070f
mov ecx, dword [ebp + 0x10]
push eax
lea eax, [esi + 0x30]
push eax
mov byte [ebp - 4], 2
call fcn.1004dfee
cmp dword [ebp - 0x18], ebx
je 0x100507e6
push dword [ebp - 0x18]
call fcn.10085ac4
pop ecx
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], 0xa
or dword [esi + 0x84], 0xffffffff
mov byte [esi + 0x70], bl
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x88], ebx
mov byte [ebp - 4], 6
cmp byte [0x100c0672], 1
mov edi, dword [sym.imp.msi.dll_MsiSetPropertyW]
jne 0x1005083f
push ebx
push 3
call edi
mov byte [0x100c0672], bl
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100270b4
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 7
mov dword [ebp + 0xc], 0x102
call fcn.1002745f
test al, al
jne 0x1005086d
mov dword [ebp + 0xc], 2
push ebx
push dword [ebp + 0xc]
call edi
push ebx
push esi
push 0x932
push 0x10050978
call dword [sym.imp.msi.dll_MsiBeginTransactionW]
push esi
push 0x7fdf
push 0x10050961
call dword [sym.imp.msi.dll_MsiSetInternalUI]
lea ecx, [ebp - 0x30]
mov dword [esi + 0x88], eax
call fcn.1002740a
mov eax, esi
call fcn.100922e2
ret 0x18
Function at 0x10051f82
Capabilities:
Acquire debug privileges

Disassembly:
push 0x14
mov eax, 0x1009c4da
call fcn.1009220a
mov ebx, ecx
call fcn.100519f1
push ecx
mov dword [ebp - 0x14], eax
mov eax, esp
mov dword [ebp - 0x18], esp
push 0x1000f730
push eax
call fcn.1005e2c8
mov cl, 1
mov edx, ebx
call fcn.1005252f
mov ecx, dword [ebx + 0x2c]
mov esi, eax
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x20]
xor edi, edi
cmp eax, edi
jne 0x10051ff6
push 0x1000f694
lea eax, [ebp - 0x10]
push eax
call fcn.1005e2c8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 4], edi
call fcn.1002b63a
push 0x100a7570
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x1001b354
call fcn.1008bda4
push edi
push edi
push ecx
call eax
mov ecx, eax
mov dword [ebp - 0x10], ecx
cmp ecx, edi
je 0x10052013
mov edi, dword [ebx + 0x34]
push 0x1000f754
push 1
call fcn.1002a862
mov byte [ebx + 0x38], 1
test esi, esi
je 0x1005202a
push esi
xor eax, eax
call fcn.100525a6
push esi
call fcn.10084b4d
pop ecx
call fcn.100519a7
mov eax, dword [eax + 4]
test eax, eax
je 0x1005203b
push dword [ebp - 0x14]
call eax
mov eax, dword [ebp - 0x10]
call fcn.100922e2
ret

Function at 0x100520b6
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
mov ebx, eax
mov esi, ecx
call fcn.10073e64
call fcn.10051d95
test eax, eax
jne 0x1005215a
call fcn.100519f1
push ecx
mov dword [ebp - 8], eax
mov eax, esp
mov dword [ebp - 4], esp
push 0x1000f730
push eax
call fcn.1005e2c8
mov cl, 1
mov edx, esi
call fcn.1005252f
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
call fcn.1005249b
mov dword [ebp + 8], eax
test eax, eax
jne 0x1005212b
cmp dword [ebp + 0xc], eax
je 0x1005212b
test byte [edi], 2
je 0x1005212b
push ebx
mov ecx, esi
call fcn.10052161
test al, al
je 0x1005212b
push edi
call fcn.1005249b
mov dword [ebp + 8], eax
cmp dword [ebp - 4], 0
je 0x10052146
push dword [ebp - 4]
xor eax, eax
mov ebx, esi
call fcn.100525a6
push dword [ebp - 4]
call fcn.10084b4d
pop ecx
call fcn.100519a7
mov eax, dword [eax + 4]
test eax, eax
je 0x10052157
push dword [ebp - 8]
call eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100529bc
Capabilities:
Query service status

Disassembly:
push 0x34
mov eax, 0x100995b6
call fcn.10092273
mov eax, dword [0x100b8f90]
xor ebx, ebx
mov ecx, 0x100b8f90
mov byte [ebp - 0x35], bl
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x3c], eax
push 5
push 0x10007464
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
je 0x10052a5f
push 4
push 0x1000fdc8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edx, eax
cmp edx, ebx
je 0x10052a51
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x40]
push eax
push 0x24
lea eax, [ebp - 0x34]
push eax
push ebx
push edx
mov dword [ebp - 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x10052a43
cmp dword [ebp - 0x30], 1
je 0x10052a3e
test byte [ebp - 0x2c], 1
jne 0x10052a3e
mov byte [ebp - 0x35], 1
jmp 0x10052a83
mov byte [ebp - 0x35], bl
jmp 0x10052a83
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1000fde0
jmp 0x10052a6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1000fe28
jmp 0x10052a6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1000fe60
lea eax, [ebp - 0x3c]
push eax
call fcn.100827bb
mov eax, dword [esi]
add esp, 0xc
push dword [ebp - 0x3c]
mov ecx, esi
push 5
call dword [eax + 4]
mov eax, dword [ebp - 0x3c]
add eax, 0xfffffff0
call fcn.10082afb
mov al, byte [ebp - 0x35]
call fcn.100922f6
ret
Function at 0x10052a97
Capabilities:
Accept command line arguments

Disassembly:
push 0x20
mov eax, 0x100a0527
call fcn.1009220a
mov ebx, ecx
cmp byte [0x100c2b64], 0
jne 0x10052c0a
mov esi, edi
call fcn.100529bc
test al, al
je 0x10052c0a
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push 0x1001d82c
push eax
call fcn.1005e2c8
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
push 0xd
call dword [eax + 8]
mov dword [ebp - 0x10], 0x3c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.100270b4
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
call fcn.1002745f
test al, al
jne 0x10052b0a
mov dword [ebp - 0x10], 0x258
push dword [ebp - 0x10]
mov esi, edi
push 0x1000fea0
push 2
call fcn.10026c05
and dword [ebp - 0x14], 0
add esp, 0xc
cmp dword [ebp - 0x10], 0
jle 0x10052b58
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
push 0
call dword [eax]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [ebx + 4], 0
jne 0x10052b85
mov esi, edi
call fcn.100529bc
test al, al
je 0x10052ba1
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
jl 0x10052b28
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 8]
cmp eax, 2
je 0x10052bb3
cmp eax, 5
mov eax, dword [edi]
mov ecx, edi
je 0x10052bf7
push 0x10010180
push 2
call dword [eax + 4]
mov dword [ebp - 0x10], 1
jmp 0x10052b0a
mov eax, dword [edi]
push 0x1000ff48
push 2
mov ecx, edi
call dword [eax + 4]
xor bl, bl
lea ecx, [ebp - 0x2c]
call fcn.1002740a
mov al, bl
jmp 0x10052c0c
mov eax, dword [edi]
push 0x1000ffac
push 2
mov ecx, edi
call dword [eax + 4]
mov bl, 1
jmp 0x10052b95
push 0x1000ffdc
lea eax, [ebp + 0xc]
push eax
call fcn.1005e2c8
mov esi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
mov byte [ebp - 4], 1
call fcn.10060ede
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.10082afb
mov eax, dword [edi]
push 0x1000fff0
push 2
mov ecx, edi
call dword [eax + 4]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
jmp 0x10052b93
push 0x100100a8
push 2
call dword [eax + 4]
mov byte [0x100c2b64], 1
jmp 0x10052baf
mov al, 1
call fcn.100922e2
ret 0xc
Function at 0x10052e84
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp byte [esi + 4], bl
je 0x10052f29
cmp dword [esi + 0x18], ebx
jne 0x10052f29
push ebx
push ebx
push 1
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x18], eax
cmp eax, ebx
jne 0x10052ebd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x10052f24
push edi
push 0x10
call fcn.100855a7
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x10052ed5
mov dword [ebp - 4], 0xe
jmp 0x10052f23
mov eax, dword [ebp + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [edi], esi
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x10052ef7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push edi
push 0x10052f33
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x14], eax
cmp eax, ebx
jne 0x10052f23
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi + 0x18]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], ebx
pop edi
mov eax, dword [ebp - 4]
jmp 0x10052f2e
mov eax, 0x10dd
pop ebx
leave
ret 0xc

Function at 0x10053192
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [esi + 0x2c]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ebx, [esi + 0x1c]
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10053231
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x3e5
jne 0x10053217
mov eax, dword [esi + 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x18]
push 0xffffffffffffffff
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edi, eax
test edi, edi
jne 0x10053203
push eax
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x10053231
jmp 0x10053208
cmp edi, 0xffffffff
jne 0x10053212
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x10053217
mov edi, 0x3e3
test edi, edi
je 0x10053231
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov byte [esi + 0x39], 0
mov eax, edi
pop edi
pop ebx
leave
ret 8
Function at 0x100532db
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
mov esi, eax
mov dword [ebp - 0xc], edi
cmp dword [ebp + 0xc], edi
je 0x100532fd
push dword [ebp + 0xc]
call dword [sym.imp.msi.dll_MsiRecordIsNull]
inc eax
mov dword [ebp - 0xc], eax
xor eax, eax
push 0xc
pop ebx
mov word [ebp - 4], ax
cmp dword [ebp - 0xc], eax
jbe 0x10053335
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
call dword [sym.imp.msi.dll_MsiRecordSetStreamA]
cmp eax, 0xea
jne 0x1005332f
mov eax, dword [ebp - 8]
lea ebx, [ebx + eax*2 + 2]
inc edi
cmp edi, dword [ebp - 0xc]
jb 0x1005330b
mov edi, ebx
call fcn.1005354f
test eax, eax
jne 0x10053348
push 0xe
pop eax
jmp 0x10053442
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp + 8]
and dword [ebp - 8], 0
mov dword [eax], ebx
mov eax, dword [esi + 0x30]
mov dword [eax + 4], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov eax, dword [esi + 0x30]
lea edi, [eax + 0xc]
add eax, ebx
mov dword [ebp - 0x10], eax
test ecx, ecx
je 0x100533d5
cmp edi, dword [ebp - 0x10]
jae 0x100533d5
xor eax, eax
mov word [edi], ax
and dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push dword [ebp + 0xc]
call dword [sym.imp.msi.dll_MsiRecordSetStreamA]
cmp eax, 0xea
jne 0x100533ba
mov eax, dword [ebp - 0x10]
sub eax, edi
sar eax, 1
cmp dword [ebp + 8], eax
jge 0x100533ba
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push edi
push dword [ebp - 8]
push dword [ebp + 0xc]
call dword [sym.imp.msi.dll_MsiRecordSetStreamA]
mov ecx, dword [ebp + 8]
xor eax, eax
inc dword [ebp - 8]
mov word [edi + ecx*2], ax
mov eax, dword [ebp + 8]
lea edi, [edi + eax*2 + 2]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jb 0x10053372
push dword [esi + 0x2c]
and dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea edi, [esi + 0x1c]
push edi
push 0
push ebx
push dword [esi + 0x30]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1005343f
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov dword [ebp + 0xc], eax
cmp eax, 0x3e5
jne 0x10053428
and dword [ebp + 0xc], 0
push 1
lea eax, [ebp + 8]
push eax
push edi
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1005343f
call ebx
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
je 0x1005343f
push dword [esi + 0x10]
mov byte [esi + 0x39], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x10], 0
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10053449
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [esi + 0x2c]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea edi, [esi + 0x1c]
push edi
push ebx
push 4
push dword [ebp + 8]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100534c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x3e5
jne 0x100534ad
push dword [esi + 0x3c]
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
test ebx, ebx
jne 0x100534b1
push eax
lea eax, [ebp + 8]
push eax
push edi
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x100534c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x100534c2
push dword [esi + 0x10]
mov byte [esi + 0x39], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x10], 0
pop edi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x100534ca
Capabilities:
Connect pipe
Create pipe

Disassembly:
push edi
xor edi, edi
push edi
push edi
mov eax, 0x400
push eax
push eax
push 1
push edi
push 0x40080003
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [esi + 0x10], eax
cmp eax, 0xffffffff
jne 0x100534fc
and dword [esi + 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1005354b
lea ecx, [esi + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x10053511
mov byte [esi + 0x39], 1
jmp 0x1005354b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xe7
jne 0x1005353d
push 0x4e20
push dword [esi + 0xc]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x1005350b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x3e5
jne 0x1005354b
xor edi, edi
mov byte [esi + 0x38], 1
mov eax, edi
pop edi
ret