joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413b8c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x413bc3
cmp dword [eax + 0x10], ebx
jne 0x413bdd
mov edx, dword [eax + 0x28]
test edx, edx
je 0x413bcc
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x413bd8
mov dword [ecx + 0x28], edx
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 4]
mov al, 1
add esp, 0x14
pop ebx
leave
ret
mov ecx, dword [eax + 0x24]
mov dword [ebx + 0x1c], ecx
test ecx, ecx
jne 0x413bb6
nop
mov dword [ebx + 0x18], edx
jmp 0x413bb9
mov dword [esp + 8], 0x153
mov dword [esp + 4], str...CommonTinyXML_tinyxml.cpp
mov dword [esp], 0x487dc2
call sub.msvcrt.dll__assert
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
test edi, edi
jle 0x413c3d
xor ebx, ebx
nop
mov dword [esp + 0xc], esi
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], str.
call sub.msvcrt.dll_fwrite
inc ebx
cmp edi, ebx
jg 0x413c18
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x20]
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], str.__s_
mov dword [ebp + 8], esi
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
jmp sub.msvcrt.dll_fprintf
Function at 0x414600
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4146aa
mov dword [esp], esi
call fcn.0041320c
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
mov dword [ebp - 0x1c], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jle 0x414764
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [esp], eax
call fcn.004774a8
mov edi, eax
mov byte [eax], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_fread
dec eax
je 0x4146dc
mov dword [esp], edi
call fcn.00477484
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], esi
call fcn.00410de4
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebp - 0x1c]
lea ebx, [edi + eax]
mov byte [ebx], 0
mov cl, byte [edi]
mov edx, edi
mov eax, edi
test cl, cl
je 0x414717
nop
cmp eax, ebx
jae 0x4147b2
cmp ebx, edx
jb 0x4147ce
cmp eax, edx
jb 0x414796
cmp cl, 0xd
je 0x414754
mov byte [edx], cl
inc eax
mov cl, byte [eax]
inc edx
test cl, cl
jne 0x4146f0
cmp ebx, edx
jb 0x4147ea
mov byte [edx], 0
mov eax, dword [esi]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [eax + 0xc]
mov dword [esp], edi
call fcn.00477484
mov al, byte [esi + 0x2c]
xor eax, 1
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
mov byte [edx], 0xa
inc eax
mov cl, byte [eax]
cmp cl, 0xa
je 0x41470f
inc edx
jmp 0x414713
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov dword [esp], esi
call fcn.00410de4
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 8], 0x3f8
mov dword [esp + 4], str...CommonTinyXML_tinyxml.cpp
mov dword [esp], str.q___p
call sub.msvcrt.dll__assert
mov dword [esp + 8], 0x3f6
mov dword [esp + 4], str...CommonTinyXML_tinyxml.cpp
mov dword [esp], str.p____buflength_
call sub.msvcrt.dll__assert
mov dword [esp + 8], 0x3f7
mov dword [esp + 4], str...CommonTinyXML_tinyxml.cpp
mov dword [esp], str.q____buflength_
call sub.msvcrt.dll__assert
mov dword [esp + 8], 0x405
mov dword [esp + 4], str...CommonTinyXML_tinyxml.cpp
mov dword [esp], str.q____buflength_
call sub.msvcrt.dll__assert
nop

Function at 0x419610
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
leave
ret
Function at 0x41fb90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
mov dword [esp], ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 4], esi
mov esi, dword [esp + 0x10]
test ebx, ebx
mov dword [esp + 8], edi
sete al
cmp esi, ecx
sete dl
or eax, edx
xor edi, edi
test al, 1
jne 0x41fbf0
test esi, esi
setne al
test ecx, ecx
setne dl
xor eax, edx
test al, 1
jne 0x41fc01
test ebx, ebx
je 0x41fbe4
movzx eax, word [esi]
movzx edx, word [ecx]
cmp ax, dx
jne 0x41fc1d
add esi, 2
add ecx, 2
dec ebx
jne 0x41fbd0
xor edi, edi
lea esi, [esi]
lea edi, [edi]
mov eax, edi
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0xc
ret
cmp ecx, 1
mov ebx, dword [esp]
sbb eax, eax
and eax, 2
mov esi, dword [esp + 4]
lea edi, [eax - 1]
mov eax, edi
mov edi, dword [esp + 8]
add esp, 0xc
ret
movzx edi, ax
movzx eax, dx
sub edi, eax
jmp 0x41fbf0
Function at 0x454b74
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebx, eax
cmp eax, 0xffffffff
je 0x454bac
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x454b83
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret

Function at 0x40147b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0x114]
sub esp, 0x134
mov dword [esp], eax
lea ebx, [ebp - 0x10c]
call dword [sym.imp.USER32.dll_GetCursorPos]
push eax
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push eax
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp - 4]
leave
sub eax, 3
ret

Function at 0x4014f8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0xa0
mov dword [ebp - 0x88], 0
call fcn.0040147b
mov dword [esp], 0x4015cc
mov dword [ebp - 0x8c], 0
mov ebx, eax
lea eax, [ebp - 0x8c]
mov dword [esp + 0xc], eax
mov eax, ebx
or eax, 0x40
mov dword [esp + 8], eax
mov eax, 0x40202e
sub eax, 0x4015cc
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x401593
lea esi, [ebp - 0x88]
mov dword [esp], ebx
call fcn.00401382
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.004013f5
mov cl, bl
mov dword [esp + 8], esi
lea eax, [ebx + 0x1b600]
shl eax, cl
mov dword [esp + 4], eax
mov eax, str.daae
shr eax, cl
mov dword [esp], eax
call fcn.00401d31
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x40bfc8
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
cmp eax, ebx
je 0x40c08b
cmp word [eax], bx
je 0x40c08b
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
cmp edi, ebx
jne 0x40c046
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x40c019
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x40c024
mov esi, 0x80004005
push esi
push 0x1f4
push 0x43b762
call fcn.004315c0
push 0x43b746
push esi
call fcn.00430a6a
pop ecx
pop ecx
jmp 0x40c0e8
xor esi, esi
cmp dword [ebp - 0x10], ebx
jle 0x40c08b
mov eax, dword [edi + esi*4]
movzx ecx, word [eax]
cmp ecx, 0x2d
je 0x40c05d
cmp ecx, 0x2f
jne 0x40c079
push 0xffffffffffffffff
push 0x40268c
push 0xffffffffffffffff
add eax, 2
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x40c085
push dword [edi + esi*4]
lea eax, [ebp - 0xc]
push eax
call fcn.00430a7e
inc esi
cmp esi, dword [ebp - 0x10]
jl 0x40c04d
push ebx
lea eax, [ebp - 4]
push eax
call fcn.00430fde
mov esi, eax
cmp esi, ebx
jge 0x40c0aa
push 0x43b722
push esi
call fcn.00430a6a
pop ecx
pop ecx
jmp 0x40c0dd
mov eax, dword [ebp - 0xc]
cmp eax, ebx
ja 0x40c0b6
mov eax, 0x43b720
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 8]
push eax
push dword [ebp - 4]
call fcn.0042e8bc
mov esi, eax
cmp esi, ebx
jge 0x40c0dd
push dword [ebp - 4]
push 0x43b6ea
push esi
call fcn.00430a6a
add esp, 0xc
cmp edi, ebx
je 0x40c0e8
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 8], ebx
je 0x40c0f9
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], ebx
cmp dword [ebp - 0xc], ebx
je 0x40c106
push dword [ebp - 0xc]
call fcn.0042eb62
cmp dword [ebp - 4], ebx
je 0x40c113
push dword [ebp - 4]
call fcn.0042eb62
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x40c4a6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push edi
push dword [esi + 0x144]
lea ebx, [esi + 0x78]
push dword [esi + 0x20]
lea eax, [esi + 0x1f0]
push ebx
push eax
mov dword [ebp - 8], 1
call fcn.00419534
mov edi, eax
test edi, edi
jns 0x40c4e3
push 0x43ba92
jmp 0x40c663
lea eax, [esi + 0xe8]
push ebx
push eax
call fcn.0041eab0
mov edi, eax
test edi, edi
jns 0x40c500
push 0x43ba5e
jmp 0x40c663
cmp dword [esi + 0x268], 1
jne 0x40c554
lea eax, [ebp - 4]
push eax
push 1
lea ebx, [esi + 0x274]
push ebx
call fcn.0040d47c
mov edi, eax
test edi, edi
jns 0x40c52b
push 0x43ba20
jmp 0x40c663
push ebx
call fcn.0040d698
mov edi, eax
test edi, edi
jns 0x40c541
push 0x43b9f2
jmp 0x40c663
cmp dword [ebp - 4], 0
je 0x40c554
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0xe4]
push eax
push dword [esi + 0x144]
lea eax, [esi + 0x9c]
push dword [esi + 0x20]
lea ebx, [esi + 0x78]
push eax
push ebx
call fcn.0041dd10
mov edi, eax
xor eax, eax
cmp edi, eax
jge 0x40c58a
push 0x43b9d0
jmp 0x40c663
cmp dword [ebp - 8], eax
jne 0x40c5a2
push 0xe0000035
push 1
call fcn.0040bfb2
xor edi, edi
jmp 0x40c669
cmp dword [esi + 0xa8], eax
je 0x40c5bd
cmp dword [esi + 0x20], 2
jle 0x40c5bd
lea ecx, [esi + 0x34]
push ecx
push eax
push dword [ebp + 8]
call fcn.0041ccf4
push esi
push dword [ebp + 8]
call fcn.0041a9f4
mov edi, eax
test edi, edi
jns 0x40c5d6
push 0x43b9aa
jmp 0x40c663
push esi
call fcn.004170fe
mov edi, eax
test edi, edi
jns 0x40c5e9
push 0x43b98c
jmp 0x40c663
push ebx
push dword [esi + 0x1c]
call fcn.0041ab9a
mov edi, eax
test edi, edi
jns 0x40c5ff
push 0x43b96c
jmp 0x40c663
push ebx
lea eax, [esi + 0xe8]
push eax
call fcn.00411bce
mov edi, eax
test edi, edi
jns 0x40c619
push 0x43b946
jmp 0x40c663
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x40c641
cmp word [eax], 0
je 0x40c641
push 0
push eax
push 0x402658
push ebx
call fcn.00415a3a
mov edi, eax
test edi, edi
jns 0x40c641
push 0x43b8f8
jmp 0x40c663
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
mov eax, esi
call fcn.0040c11c
mov edi, eax
test edi, edi
js 0x40c65e
cmp dword [ebp + 8], 0
jne 0x40c641
jmp 0x40c66b
push 0x43b8e2
push edi
call fcn.00430a6a
pop ecx
pop ecx
push esi
call fcn.0041a71c
lea eax, [esi + 0x78]
push eax
call fcn.00416842
cmp dword [esi + 0x284], 0xffffffff
je 0x40c6a6
cmp dword [esi + 0x268], 1
jne 0x40c691
mov eax, dword [esi + 0x18]
jmp 0x40c693
xor eax, eax
push eax
push dword [esi + 0xe4]
lea eax, [esi + 0x274]
push eax
call fcn.0040de1a
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40c6c2
push 0
push 0
push 0x10
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [ebp - 4], 0
je 0x40c6d1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebx
leave
ret 4
Function at 0x40c6da
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
and dword [ebp - 8], 0
cmp dword [esi + 0x268], 2
push ebx
push edi
jne 0x40c740
lea ebx, [esi + 0x278]
lea eax, [esi + 0x274]
push ebx
push eax
call fcn.0040cd62
mov edi, eax
test edi, edi
jns 0x40c717
push 0x43bb9e
jmp 0x40c886
push dword [esi + 0x2a8]
push dword [ebx]
push dword [esi + 0x274]
push dword [esi + 0x2c]
push dword [ebp + 0xc]
call fcn.0040cea2
mov edi, eax
test edi, edi
jns 0x40c740
push 0x43bb78
jmp 0x40c886
push 1
lea eax, [esi + 0x274]
push eax
call fcn.0040d986
mov edi, eax
test edi, edi
jns 0x40c75e
push 0x43bb4e
jmp 0x40c886
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 0x26c], eax
cmp eax, 0xffffffff
jne 0x40c7a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40c783
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
js 0x40c78e
mov edi, 0x80004005
push edi
push 0x1a7
push 0x43b762
call fcn.004315c0
push 0x43bb18
jmp 0x40c886
push dword [esi + 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x40c7f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40c7cd
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
js 0x40c7d8
mov edi, 0x80004005
push edi
push 0x1ac
push 0x43b762
call fcn.004315c0
push 0x43bad4
jmp 0x40c886
push esi
push dword [ebp + 8]
call fcn.0041a9f4
mov edi, eax
test edi, edi
jns 0x40c808
push 0x43b9aa
jmp 0x40c886
push 1
call fcn.0043225c
push esi
push 0x40c272
call fcn.0043013a
lea eax, [esi + 0x18]
push eax
lea eax, [esi + 0xe4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0xa8]
push eax
lea eax, [esi + 0xe8]
push eax
lea eax, [esi + 0x78]
push eax
lea eax, [esi + 0x1b0]
push eax
lea eax, [esi + 0x198]
push eax
lea eax, [esi + 0x1b8]
push eax
lea eax, [esi + 0x1a0]
push eax
push dword [esi + 0x288]
push dword [esi + 0x284]
push dword [esi + 0x26c]
call fcn.00422ad4
push 0
push 0
mov edi, eax
call fcn.0043013a
test edi, edi
jns 0x40c88e
push 0x43baa6
push edi
call fcn.00430a6a
pop ecx
pop ecx
xor ebx, ebx
push ebx
push ebx
call fcn.0043013a
push esi
call fcn.0041a71c
cmp dword [ebp - 8], ebx
je 0x40c8a7
call fcn.004207c2
cmp dword [ebp - 4], ebx
je 0x40c8be
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebx
leave
ret 8
Function at 0x40d0ea
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor esi, esi
mov ebx, eax
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
push 0
lea eax, [ebp - 8]
push eax
push 8
pop eax
sub eax, esi
push eax
lea eax, [ebp + esi - 0x10]
push eax
push dword [ebp + 8]
call edi
test eax, eax
jne 0x40d153
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x40d139
and dword [ebp - 4], 0
jmp 0x40d153
cmp eax, 0x6d
je 0x40d1a1
test eax, eax
jle 0x40d14c
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
test eax, eax
jl 0x40d1ba
add esi, dword [ebp - 8]
cmp esi, 8
jb 0x40d10c
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
mov eax, dword [ebp - 0xc]
xor esi, esi
mov dword [ebx + 4], eax
cmp eax, esi
je 0x40d231
push esi
push eax
call fcn.0043176e
mov dword [ebx + 0xc], eax
cmp eax, esi
jne 0x40d1d3
mov esi, 0x8007000e
push esi
push 0x32b
push 0x43be0c
mov dword [ebp - 4], esi
call fcn.004315c0
push 0x43bfe8
push esi
jmp 0x40d221
push 8
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00408720
add esp, 0xc
mov dword [ebp - 4], 1
jmp 0x40d15b
push dword [ebp - 4]
push 0x320
push 0x43be0c
call fcn.004315c0
push 0x43bfc6
jmp 0x40d21e
push esi
lea ecx, [ebp - 8]
push ecx
push dword [ebx + 4]
push eax
push dword [ebp + 8]
call edi
test eax, eax
jne 0x40d22a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x40d1f9
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, esi
jl 0x40d207
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x32f
push 0x43be0c
call fcn.004315c0
push 0x43bfa4
push dword [ebp - 4]
call fcn.00430a6a
pop ecx
pop ecx
jmp 0x40d231
mov dword [ebx + 8], 1
cmp dword [ebx + 8], 0
jne 0x40d244
mov ebx, dword [ebx + 0xc]
test ebx, ebx
je 0x40d244
push ebx
call fcn.004318fe
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40d24e
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x14], ebx
call esi
test eax, eax
jne 0x40d2c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x40d2a1
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x40d2ac
mov edi, 0x80004005
push edi
push 0x34f
push 0x43be0c
call fcn.004315c0
push 0x43c17a
jmp 0x40d438
mov eax, dword [ebp - 8]
shr eax, 1
cmp eax, 0xff
jbe 0x40d2f4
mov esi, 0x8007000d
push esi
push 0x355
push 0x43be0c
mov edi, esi
call fcn.004315c0
push 0x43c14e
push esi
jmp 0x40d439
inc eax
push eax
lea eax, [ebp - 4]
push eax
call fcn.0042ea4e
mov edi, eax
cmp edi, ebx
jge 0x40d30f
push 0x43c11a
jmp 0x40d438
push ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x40d35c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x40d337
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x40d342
mov edi, 0x80004005
push edi
push 0x35d
push 0x43be0c
call fcn.004315c0
push 0x43c0e4
jmp 0x40d438
push 0xffffffffffffffff
push dword [ebp + 0xc]
push 0xffffffffffffffff
push dword [ebp - 4]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x40d394
mov esi, 0x8007000d
push esi
push 0x364
push 0x43be0c
mov edi, esi
call fcn.004315c0
push 0x43c0b4
jmp 0x40d2ee
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call esi
test eax, eax
jne 0x40d3de
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x40d3bc
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x40d3c7
mov edi, 0x80004005
push edi
push 0x36a
push 0x43be0c
call fcn.004315c0
push 0x43c07a
jmp 0x40d438
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
cmp eax, ebx
jne 0x40d456
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
push ebx
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40d440
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x40d418
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x40d423
mov edi, 0x80004005
push edi
push 0x37b
push 0x43be0c
call fcn.004315c0
push 0x43c042
push edi
call fcn.00430a6a
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
je 0x40d44d
push dword [ebp - 4]
call fcn.0042eb62
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp eax, dword [ebp - 0x10]
je 0x40d3ec
mov esi, 0x8007000d
push esi
push 0x375
push 0x43be0c
mov edi, esi
call fcn.004315c0
push 0x43c00e
jmp 0x40d2ee
Function at 0x40d47c
Capabilities:
Create pipe

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
or dword [ebp - 0x14], 0xffffffff
push ebx
push edi
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
xor ebx, ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xc], ebx
stosd dword es:[edi], eax
mov dword [ebp - 8], ebx
cmp dword [ebp + 0xc], ebx
jne 0x40d50c
push ebx
lea eax, [ebp - 0xc]
push eax
push 1
push 0x43c27a
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x40d4fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x40d4c8
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp eax, ebx
jl 0x40d4d6
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x121
push 0x43be0c
call fcn.004315c0
push 0x43c22e
push dword [ebp - 4]
call fcn.00430a6a
pop ecx
pop ecx
jmp 0x40d600
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
push esi
mov esi, dword [ebp + 8]
push dword [esi]
lea eax, [ebp - 8]
push 0x402744
push eax
call fcn.0043007e
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ebx
jge 0x40d53f
push dword [esi]
push 0x43c204
push eax
call fcn.00430a6a
add esp, 0xc
jmp 0x40d5ff
mov eax, dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
neg eax
sbb eax, eax
lea ecx, [ebp - 0x20]
and eax, ecx
push eax
push 1
mov esi, 0x10000
push esi
push esi
push 1
push ebx
mov ebx, 0x80003
push ebx
push dword [ebp - 8]
call edi
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x40d5ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40d585
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
test eax, eax
jl 0x40d593
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x131
push 0x43be0c
call fcn.004315c0
push dword [ebp - 8]
push 0x43c1e8
push dword [ebp - 4]
call fcn.00430a6a
add esp, 0xc
jmp 0x40d5fd
cmp dword [ebp + 0xc], 0
je 0x40d67d
mov eax, dword [ebp + 8]
push dword [eax]
lea eax, [ebp - 8]
push 0x40271c
push eax
call fcn.0043007e
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
jns 0x40d624
mov ecx, dword [ebp + 8]
push dword [ecx]
push 0x43c1b8
push eax
call fcn.00430a6a
add esp, 0xc
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
pop esi
cmp dword [ebp - 8], ebx
je 0x40d60d
push dword [ebp - 8]
call fcn.0042eb62
cmp dword [ebp - 0xc], ebx
pop edi
pop ebx
je 0x40d61d
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
leave
ret 0xc
push 0
push 1
push esi
push esi
push 1
push 0
push ebx
push dword [ebp - 8]
call edi
cmp eax, 0xffffffff
jne 0x40d680
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40d64d
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
test eax, eax
jl 0x40d65b
mov dword [ebp - 4], 0x80004005
push dword [ebp - 4]
push 0x13d
push 0x43be0c
call fcn.004315c0
push dword [ebp - 8]
push 0x43c1e8
push dword [ebp - 4]
jmp 0x40d5ec
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp + 0x10]
and dword [eax], 0
jmp 0x40d5fd
Function at 0x40db66
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
xor edi, edi
push dword [ebp + 0x10]
mov dword [ebp - 8], edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
call fcn.0040d04c
mov ebx, eax
cmp ebx, edi
jge 0x40dba2
push 0x43c4ce
push ebx
call fcn.00430a6a
pop ecx
pop ecx
jmp 0x40dc0f
push esi
xor esi, esi
mov dword [ebp + 0x14], edi
cmp dword [ebp - 4], edi
jbe 0x40dc0e
push edi
lea eax, [ebp + 0x14]
push eax
mov eax, dword [ebp - 4]
sub eax, esi
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40dbd2
add esi, dword [ebp + 0x14]
cmp esi, dword [ebp - 4]
jb 0x40dbad
jmp 0x40dc0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x40dbe6
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp ebx, edi
jl 0x40dbf1
mov ebx, 0x80004005
push ebx
push 0x2f8
push 0x43be0c
call fcn.004315c0
push 0x43c4a8
push ebx
call fcn.00430a6a
pop ecx
pop ecx
pop esi
cmp dword [ebp - 8], edi
je 0x40dc1c
push dword [ebp - 8]
call fcn.004318fe
pop edi
mov eax, ebx
pop ebx
leave
ret 0x10