joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b710
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [eax + 0x28]
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [esi + 0x60]
and byte [eax], 0
add ebx, 0x14
mov eax, dword [edi + 0x18]
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x47], 0
je 0x40b8ad
cmp dword [ebx + 0x8c], 2
jne 0x40b8a6
push dword [eax]
push ebx
call fcn.0040b070
xor ecx, ecx
cmp eax, ecx
je 0x40b8a6
cmp word [eax + 0x18], cx
ja 0x40b775
test byte [ebx + 0xf8], 1
jne 0x40b775
mov edi, 0xc0000010
jmp 0x40b8b2
mov eax, dword [ebp + 0x10]
sub eax, 0xb0191
je 0x40b7b1
dec eax
jne 0x40b7ac
mov eax, dword [esi + 4]
cmp eax, ecx
je 0x40b7a9
test byte [eax + 6], 5
je 0x40b797
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
jmp 0x40b7a4
push ecx
push eax
call dword [0x13268]
mov dword [ebp - 8], eax
xor ecx, ecx
mov eax, dword [edi + 4]
jmp 0x40b7ba
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
jmp 0x40b7bd
mov eax, dword [esi + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [edi + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 8], ecx
je 0x40b89f
cmp dword [ebp - 4], ecx
je 0x40b89f
mov eax, dword [ebp - 8]
mov ecx, dword [ebx + 0x48]
mov al, byte [eax]
cmp byte [ecx], 0
mov byte [ebp + 8], al
jne 0x40b7e5
inc dword [ebp - 8]
dec dword [ebp - 4]
movzx eax, al
push eax
push ebx
call fcn.0040b039
test eax, eax
je 0x40b81c
mov cx, word [eax + 6]
test cx, cx
je 0x40b816
mov edx, dword [ebp + 0x10]
sub edx, 0xb0191
je 0x40b8bb
dec edx
jne 0x40b818
movzx ecx, cx
cmp dword [ebp - 4], ecx
jae 0x40b818
xor eax, eax
test eax, eax
jne 0x40b82f
test byte [ebx + 0xf8], 1
jne 0x40b82f
mov edi, 0xc000003e
jmp 0x40b8b2
push 0x43646948
push 0xc
push 0
call dword [0x13280]
mov esi, eax
test esi, esi
je 0x40b898
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov dword [esi], eax
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov al, byte [ebp + 8]
mov byte [esi + 8], al
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0x3c], esi
mov dword [edi - 0x18], eax
sub eax, 0xb0191
mov byte [edi - 0x24], 0xf
je 0x40b878
dec eax
jne 0x40b87f
mov dword [edi - 0x20], 0xc
jmp 0x40b87f
mov dword [edi - 0x1c], 0xc
push ecx
push dword [ebx]
call fcn.0040cfaa
push esi
mov edi, eax
call dword [0x13288]
mov eax, dword [ebp + 0x14]
and byte [eax], 0
jmp 0x40b8b2
mov edi, 0xc000009a
jmp 0x40b8b2
mov edi, 0xc0000206
jmp 0x40b8b2
mov edi, 0xc000009d
jmp 0x40b8b2
mov edi, 0xc0000061
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10
movzx ecx, cx
cmp dword [ebp - 4], ecx
jb 0x40b816
mov dword [ebp - 4], ecx
jmp 0x40b818
Function at 0x40ba46
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [eax + 0x14]
mov eax, dword [esi + 0x5c]
add esi, 0x14
push edi
mov dword [ebp - 0xc], esi
dec dword [esi + 0x88]
cmp byte [eax], 0
jne 0x40ba7e
dec dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
and byte [eax], 0
cmp dword [ebx + 0x18], 0
jl 0x40ba7e
inc dword [ebx + 0x1c]
mov eax, dword [ebx + 0x3c]
movzx eax, byte [eax]
push eax
push esi
call fcn.0040b039
test eax, eax
je 0x40bb21
movzx eax, byte [eax + 1]
push eax
push esi
mov dword [ebp + 0xc], eax
call fcn.0040b0ac
push dword [ebp + 0xc]
mov edi, eax
mov dword [ebp - 4], edi
push esi
call fcn.0040b070
test edi, edi
je 0x40bb21
test eax, eax
je 0x40bb21
mov eax, dword [ebx + 0x1c]
cmp dword [ebx + 0x18], 0
mov dword [ebp + 0x10], eax
jl 0x40bb0f
push eax
push dword [ebx + 0x3c]
push edi
push esi
call fcn.0040b2f1
lea ecx, [edi + 0x78]
mov dword [ebp - 8], ecx
call dword [0x13224]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebx + 0x3c]
mov edi, dword [edi + 0x7c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 4]
and byte [ecx + 0x84], 0
mov dword [ecx + 0x80], edx
mov ecx, dword [ebp - 8]
mov dl, al
call dword [0x13228]
mov esi, dword [ebp - 0xc]
push dword [ebx + 0x18]
push dword [ebp + 0x10]
push dword [ebx + 0x3c]
push dword [ebp + 0xc]
push esi
call fcn.0040b931
push dword [ebx + 0x3c]
call dword [0x13288]
push ebx
call dword [0x13290]
pop edi
pop esi
mov eax, 0xc0000016
pop ebx
leave
ret 0xc
Function at 0x40d504
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov ebp, dword [0x13280]
mov eax, dword [esi]
push edi
push 0x43646948
mov dword [esp + 0x14], ebx
mov al, byte [eax + 0x30]
dec al
mov byte [esp + 0x1c], al
mov eax, dword [esi + 0x78]
shl eax, 7
push eax
push ebx
call ebp
mov edi, eax
cmp edi, ebx
mov dword [esi + 0x7c], edi
je 0x40d62d
mov ecx, dword [esi + 0x78]
mov eax, dword [esi + 0x74]
shl ecx, 7
mov edx, ecx
mov dword [esp + 0x14], eax
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esi + 0x80]
push eax
call dword [0x1327c]
cmp dword [esi + 0x78], ebx
mov dword [esp + 0x20], ebx
jbe 0x40d635
xor edi, edi
mov eax, dword [esi + 0x7c]
mov dword [edi + eax + 0x24], esi
mov eax, dword [esi + 0x7c]
mov byte [edi + eax + 0x10], bl
mov eax, dword [esi + 0x7c]
mov dword [edi + eax], 0x676e6f50
mov eax, dword [esi + 0x7c]
mov byte [edi + eax + 0x28], bl
mov eax, dword [esi + 0x7c]
or dword [edi + eax + 0x7c], 0xffffffff
mov eax, dword [esi + 0x7c]
mov dword [edi + eax + 0x78], 0xff676980
mov eax, dword [esi + 0x7c]
lea eax, [edi + eax + 0x30]
push eax
call dword [0x132dc]
mov eax, dword [esi + 0x7c]
add eax, edi
push eax
add eax, 0x58
push 0x1120d
push eax
call dword [0x13278]
push 0x43646948
push dword [esp + 0x18]
push ebx
call ebp
mov ecx, dword [esi + 0x7c]
mov dword [edi + ecx + 0xc], eax
mov eax, dword [esi + 0x7c]
cmp dword [edi + eax + 0xc], ebx
je 0x40d62d
push ebx
push dword [esp + 0x1c]
call dword [0x13274]
cmp eax, ebx
je 0x40d62d
mov ecx, dword [esi + 0x7c]
inc dword [esp + 0x20]
mov ecx, dword [edi + ecx + 0xc]
add edi, 0x80
mov dword [eax + 0x3c], ecx
mov ecx, dword [esi + 0x7c]
mov dword [edi + ecx - 0x7c], eax
mov eax, dword [esi + 0x7c]
mov byte [edi + eax - 0x78], 1
mov eax, dword [esp + 0x20]
cmp eax, dword [esi + 0x78]
jb 0x40d57b
jmp 0x40d635
mov dword [esp + 0x10], 0xc000009a
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4

Function at 0x421a91
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [eax]
mov dword [ebp + 8], 0xc6ef3720
mov edx, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x10], edi
mov edi, dword [eax + 4]
mov dword [ebp - 0xc], edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], edi
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], 0x20
mov eax, edx
mov edi, edx
shr eax, 5
add eax, dword [ebp - 4]
shl edi, 4
add edi, dword [ebp - 8]
xor eax, edi
mov edi, dword [ebp + 8]
add edi, edx
xor eax, edi
sub ecx, eax
mov eax, ecx
mov edi, ecx
shr eax, 5
add eax, dword [ebp - 0xc]
shl edi, 4
add edi, dword [ebp - 0x10]
xor eax, edi
mov edi, dword [ebp + 8]
add dword [ebp + 8], 0x61c88647
add edi, ecx
xor eax, edi
sub edx, eax
dec dword [ebp + 0xc]
jne 0x421ac9
mov dword [esi], edx
mov dword [esi + 4], ecx
pop edi
pop esi
leave
ret 8
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4068a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 0x24], 0xe4d8
mov dword [ebp - 0x50], 0x413c
mov dword [ebp - 0x54], 0x13433
mov dword [ebp - 0x3c], 0x867c
mov dword [ebp - 0x18], 0x7322
mov dword [ebp - 0x14], 0x152ed
mov dword [ebp - 0x34], 0x6e6a
mov dword [ebp - 0x58], 0x10ceb
mov dword [ebp - 0x5c], 0xca45
mov dword [ebp - 0x30], 0x80dc
mov dword [ebp - 0x28], 0x1ec4
mov dword [ebp - 0x44], 0xf703
mov dword [ebp - 0x60], 0xeeaf
mov dword [ebp - 0x4c], 0x43ab
mov dword [ebp - 0x64], 0x7b9f
mov dword [ebp - 0x68], 0xbad7
mov dword [ebp - 0x38], 0x508f
mov dword [ebp - 0x48], 0xeb55
mov dword [ebp - 0x6c], 0x10045
mov dword [ebp - 0x2c], 0x1265b
mov dword [ebp - 0x40], 0x5479
mov dword [ebp - 0x70], 0x3b9e
mov dword [ebp - 0x74], 0xeca9
mov dword [ebp - 4], 0
jmp 0x406959
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0x1ec3
cmp dword [ebp - 4], ecx
jge 0x406a2c
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x14]
jge 0x40697c
mov dword [ebp - 0x10], 1
jmp 0x406983
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x10]
je 0x406a27
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp + 0x10]
jne 0x406a27
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp + 0x1c]
jne 0x406a27
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x38]
jne 0x406a27
push 0xf766
push 0x104c9
push 0x1594
push 0x8c9f
push 0x5b8a
push 0xc58
push 0xc8be
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
add esp, 0x1c
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp + 0x1c]
jge 0x4069ec
mov dword [ebp - 0x1c], 1
jmp 0x4069f3
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp + 0x14]
sub edx, dword [ebp - 0x3c]
and edx, dword [ebp - 0x1c]
je 0x406a27
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x44]
jge 0x406a0f
mov dword [ebp - 0x20], 1
jmp 0x406a16
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x48]
or ecx, dword [ebp - 0x20]
je 0x406a27
mov edx, dword [ebp + 0x14]
add edx, 1
mov dword [ebp + 0x14], edx
jmp 0x406950
mov dword [ebp - 8], 0
jmp 0x406a3e
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x4c]
sub ecx, 0x43aa
cmp dword [ebp - 8], ecx
jge 0x406a57
mov edx, dword [ebp - 0x24]
sub edx, 1
mov dword [ebp - 0x24], edx
jmp 0x406a35
mov dword [ebp - 0xc], 0
jmp 0x406a69
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x50]
sub ecx, 0x413b
cmp dword [ebp - 0xc], ecx
jge 0x406a82
mov edx, dword [ebp + 8]
sub edx, 1
mov dword [ebp + 8], edx
jmp 0x406a60
mov esp, ebp
pop ebp
ret
Function at 0x40ada0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 0x34], 0x2545
mov dword [ebp - 0x48], 0xc6ff
mov dword [ebp - 0x50], 0x76e5
mov dword [ebp - 0x54], 0x2a9e
mov dword [ebp - 4], 0x9ce9
mov dword [ebp - 0xc], 0x13650
mov dword [ebp - 0x58], 0x15c45
mov dword [ebp - 0x38], 0x42b4
mov dword [ebp - 0x5c], 0x171e1
mov dword [ebp - 0x3c], 0x4b40
mov dword [ebp - 0x60], 0x71d5
mov dword [ebp - 0x64], 0x10114
mov dword [ebp - 0x68], 0x13333
mov dword [ebp - 0x6c], 0x12d2a
mov dword [ebp - 0x44], 0x1266
mov dword [ebp - 0x70], 0x10abb
mov dword [ebp - 8], 0xb96c
mov dword [ebp - 0x40], 0xbbe1
mov dword [ebp - 0x4c], 0x4bbb
mov dword [ebp - 0x2c], 0x9efa
mov dword [ebp - 0x74], 0x114b8
mov dword [ebp - 0x30], 0x11af6
mov dword [ebp - 0x10], 0xdb14
mov dword [ebp - 0x24], 0x1229d
mov eax, dword [ebp - 0x34]
add eax, 0x14281
push eax
mov ecx, dword [ebp - 4]
sub ecx, 0x47e2
push ecx
mov edx, dword [ebp + 0xc]
sub edx, 0x96bf
push edx
call fcn.00405710
add esp, 0xc
mov dword [ebp - 0x14], 0
jmp 0x40ae85
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x9ce8
cmp dword [ebp - 0x14], ecx
jge 0x40ae9e
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
jmp 0x40ae7c
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0xc]
jge 0x40aeaf
mov dword [ebp - 0x1c], 1
jmp 0x40aeb6
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 8]
jge 0x40aed0
mov dword [ebp - 0x20], 1
jmp 0x40aed7
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
and ecx, dword [ebp - 0x20]
or eax, ecx
je 0x40aef1
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov dword [ebp - 0x18], 0
jmp 0x40af03
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x4b3f
cmp dword [ebp - 0x18], ecx
jge 0x40afac
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0xc]
jge 0x40af26
mov dword [ebp - 0x28], 1
jmp 0x40af2d
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
imul ecx, dword [ebp - 0x2c]
or ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x40]
xor edx, dword [ebp - 4]
or ecx, edx
je 0x40afa7
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x2c]
je 0x40afa7
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0x48]
jne 0x40afa7
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x10]
jne 0x40afa7
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x34]
jne 0x40afa7
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0xc]
jne 0x40afa7
push 0xd7f4
push 0xe28f
push 0xcdf
push 0x4182
push 0xd084
push 0x14c23
push 0x7c9c
call dword [sym.imp.KERNEL32.dll_CreatePipe]
add esp, 0x1c
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x40aefa
mov esp, ebp
pop ebp
ret
Function at 0x40c4c0
Capabilities:
Check for debugger via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 8], 0x10ad6
mov dword [ebp - 0x3c], 0x904e
mov dword [ebp - 0x14], 0x13c0f
mov dword [ebp - 0x38], 0xfb8a
mov dword [ebp - 0x40], 0xcd4c
mov dword [ebp - 0x24], 0x170ab
mov dword [ebp - 0x44], 0x17ebd
mov dword [ebp - 4], 0x173e7
mov dword [ebp - 0x48], 0x1e11
mov dword [ebp - 0x10], 0xf2fd
mov dword [ebp - 0x28], 0x17b73
mov dword [ebp - 0x4c], 0x4534
mov dword [ebp - 0x50], 0x1128e
mov dword [ebp - 0x54], 0xf85b
mov dword [ebp - 0x34], 0x3a72
mov dword [ebp - 0x58], 0x14863
mov dword [ebp - 0x1c], 0x26c5
mov dword [ebp - 0x5c], 0xf838
mov dword [ebp - 0x60], 0xc769
mov dword [ebp - 0x2c], 0x60da
mov dword [ebp - 0x30], 0x9374
mov dword [ebp - 0x64], 0xd48a
mov dword [ebp - 0x68], 0x10a5
mov dword [ebp - 0xc], 0
jmp 0x40c579
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 0x885e
cmp dword [ebp - 0xc], ecx
jge 0x40c64c
mov edx, dword [ebp + 0x14]
sub edx, 1
mov dword [ebp + 0x14], edx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x28]
or ecx, dword [ebp + 0x14]
and ecx, dword [ebp - 4]
xor ecx, dword [ebp - 0x30]
je 0x40c647
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x34]
jne 0x40c647
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x40c647
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x1c]
jne 0x40c647
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x24]
jne 0x40c647
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x40c647
push 0xc689
push 0xad2f
push 0xcbb8
push 0xb326
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeTransactedW]
add esp, 0x10
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x1c]
jge 0x40c60d
mov dword [ebp - 0x20], 1
jmp 0x40c614
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 4]
imul edx, dword [ebp + 0x18]
and edx, dword [ebp - 0x20]
je 0x40c639
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x24]
jne 0x40c639
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x28]
jne 0x40c639
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
push 0x13bf8
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
add esp, 4
jmp 0x40c570
mov eax, dword [ebp - 4]
sub eax, 0xb5a8
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x8262
push ecx
call fcn.00417790
add esp, 8
mov dword [ebp - 0x18], 0
jmp 0x40c679
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x2c]
sub eax, 0x60d9
cmp dword [ebp - 0x18], eax
jge 0x40c691
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
jmp 0x40c670
mov esp, ebp
pop ebp
ret
Function at 0x40d0a0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 0x5c], 0x1170b
mov dword [ebp - 0x60], 0x12034
mov dword [ebp - 8], 0x109c8
mov dword [ebp - 0x64], 0x14371
mov dword [ebp - 0x44], 0x16788
mov dword [ebp - 0x4c], 0xb241
mov dword [ebp - 4], 0xd398
mov dword [ebp - 0x20], 0xad30
mov dword [ebp - 0x68], 0xe6b0
mov dword [ebp - 0x58], 0x2455
mov dword [ebp - 0x34], 0xa517
mov dword [ebp - 0x50], 0xafdc
mov dword [ebp - 0x6c], 0x680f
mov dword [ebp - 0x70], 0x2aed
mov dword [ebp - 0x2c], 0x179f1
mov dword [ebp - 0x74], 0xfd1a
mov dword [ebp - 0x40], 0xc7b
mov dword [ebp - 0x10], 0xf84d
mov dword [ebp - 0x18], 0x6609
mov dword [ebp - 0x30], 0x141b
mov dword [ebp - 0x48], 0xa7fb
mov dword [ebp - 0x14], 0x18125
mov dword [ebp - 0x78], 0x1d5a
mov dword [ebp - 0x54], 0x12b67
mov dword [ebp - 0x7c], 0x1058f
mov eax, dword [ebp + 0x18]
add eax, 1
mov dword [ebp + 0x18], eax
call fcn.00410880
mov dword [ebp - 0xc], 0
jmp 0x40d175
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x30]
sub edx, 0x141a
cmp dword [ebp - 0xc], edx
jge 0x40d240
mov eax, dword [ebp + 0x28]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp + 0x28]
add edx, 1
mov dword [ebp + 0x28], edx
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x3c]
jge 0x40d1b0
mov dword [ebp - 0x1c], 1
jmp 0x40d1b7
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
or edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x40]
or eax, dword [ebp - 0x1c]
or eax, edx
je 0x40d23b
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0x48]
jne 0x40d23b
mov edx, dword [ebp - 0x4c]
cmp edx, dword [ebp - 4]
jne 0x40d23b
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 8]
jne 0x40d23b
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0xc]
jne 0x40d23b
mov edx, dword [ebp + 0x14]
cmp edx, dword [ebp - 0x50]
jne 0x40d23b
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x54]
jge 0x40d20c
mov dword [ebp - 0x24], 1
jmp 0x40d213
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 4]
imul ecx, dword [ebp - 8]
or ecx, dword [ebp - 0x24]
je 0x40d23b
push 0x46a9
push 0xd85
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
add esp, 8
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x40d16c
mov eax, dword [ebp - 0x58]
add eax, 0x1b13
push eax
mov ecx, dword [ebp - 0x5c]
sub ecx, 0x3c4c
push ecx
mov edx, dword [ebp + 0x28]
sub edx, 0xfb48
push edx
call fcn.0040a6c0
add esp, 0xc
mov eax, dword [ebp + 0x28]
sub eax, 1
mov dword [ebp + 0x28], eax
mov ecx, dword [ebp + 0x28]
and ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 8]
jge 0x40d282
mov dword [ebp - 0x28], 1
jmp 0x40d289
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x60]
or eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x28]
je 0x40d2a6
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40d2b0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x34], 0xb80a
mov dword [ebp - 0x40], 0x8214
mov dword [ebp - 0x30], 0xabf2
mov dword [ebp - 0x24], 0xae69
mov dword [ebp - 0x48], 0x12293
mov dword [ebp - 0xc], 0x52f2
mov dword [ebp - 0x28], 0x3839
mov dword [ebp - 0x10], 0x868f
mov dword [ebp - 0x4c], 0x8594
mov dword [ebp - 0x2c], 0xcd5f
mov dword [ebp - 0x20], 0xb286
mov dword [ebp - 0x50], 0xda5d
mov dword [ebp - 0x54], 0x16ac5
mov dword [ebp - 0x58], 0x1250e
mov dword [ebp - 0x5c], 0x26e4
mov dword [ebp - 0x3c], 0x7fa5
mov dword [ebp - 0x60], 0xb333
mov dword [ebp - 0x64], 0x26b
mov dword [ebp - 8], 0x176e1
mov dword [ebp - 0x14], 0xee3a
mov dword [ebp - 0x38], 0x15729
mov dword [ebp - 0x68], 0xa6be
mov dword [ebp - 4], 0
jmp 0x40d362
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0xb285
cmp dword [ebp - 4], ecx
jge 0x40d37b
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x40d359
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x14]
jge 0x40d402
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x2c]
jne 0x40d402
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x34]
jne 0x40d402
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x38]
jge 0x40d3a7
mov dword [ebp - 0x18], 1
jmp 0x40d3ae
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x40]
jge 0x40d3bf
mov dword [ebp - 0x1c], 1
jmp 0x40d3c6
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x18]
or edx, dword [ebp - 8]
or edx, dword [ebp - 0x1c]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 0x44], 0
je 0x40d3ea
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
push 0xe833
push 0x68f5
push 0x16c74
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x40dc50
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x34], 0x12d41
mov dword [ebp - 0x1c], 0x17624
mov dword [ebp - 0x38], 0x2188
mov dword [ebp - 0x3c], 0x7f48
mov dword [ebp - 0x40], 0xb994
mov dword [ebp - 0x20], 0x16996
mov dword [ebp - 4], 0x12275
mov dword [ebp - 0x44], 0x1443a
mov dword [ebp - 0x18], 0x3cd3
mov dword [ebp - 0x48], 0x6ff
mov dword [ebp - 0x24], 0x51ba
mov dword [ebp - 8], 0xba51
mov dword [ebp - 0x14], 0x15009
mov dword [ebp - 0x28], 0x14def
mov dword [ebp - 0x30], 0x12124
mov dword [ebp - 0x4c], 0x17c45
mov dword [ebp - 0x50], 0xa105
mov dword [ebp - 0x2c], 0x1513e
mov dword [ebp - 0x54], 0x1831
mov dword [ebp - 0x58], 0xfc6b
mov dword [ebp - 0x5c], 0x5ba
mov dword [ebp - 0x60], 0x16544
mov dword [ebp - 0xc], 0x17281
mov dword [ebp - 0x64], 0xc968
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x10]
add edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
or ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0x10]
jge 0x40dd36
mov dword [ebp - 0x10], 1
jmp 0x40dd3d
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x18]
or edx, dword [ebp - 0x1c]
or edx, dword [ebp - 0x10]
je 0x40dd9d
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x20]
jne 0x40dd9d
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x24]
jne 0x40dd9d
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x2c]
jne 0x40dd9d
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp + 0x10]
jne 0x40dd9d
push 0x6eb
push 0x2169
push 0xf05a
push 0x12ef1
push 0x1786a
push 0xc72a
push 0xefe1
call dword [sym.imp.KERNEL32.dll_SuspendThread]
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
mov esp, ebp
pop ebp
ret