joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413e00
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, 0x413bc0
cmp dword [0x4b0810], 0
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, 0x4139d0
cmovne ebx, eax
push edi
cmp dword [esi + 4], 0
ja 0x413ece
lea eax, [esi + 0x10]
cmp eax, dword [eax]
jne 0x413ece
cmp dword [esi + 0x2c], 0
jne 0x413ece
movsd xmm0, qword [0x4b0368]
xor edi, edi
ucomisd xmm0, qword [0x499c90]
lahf
test ah, 0x44
jp 0x413e76
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
jmp 0x413ff5
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x413ea1
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
jmp 0x413ff5
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
call fcn.00482850
mulsd xmm0, qword [0x4b0368]
mulsd xmm0, qword [0x499cc8]
call fcn.004826f0
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
jmp 0x413ff5
mov ebp, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, 1
xorps xmm1, xmm1
nop dword [eax]
cmp dword [esi + 0x18], 0
jne 0x413ffb
movsd xmm0, qword [0x4b0368]
ucomisd xmm0, xmm1
lahf
test ah, 0x44
jp 0x413f0f
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
jmp 0x413f4f
lea eax, [esp + 0x18]
push eax
call ebp
test eax, eax
jne 0x413f2d
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
jmp 0x413f4f
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
call fcn.00482850
mulsd xmm0, qword [0x4b0368]
mulsd xmm0, qword [0x499cc8]
call fcn.004826f0
mov ecx, esi
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
call fcn.0041c3b0
mov ecx, esi
call fcn.00412eb0
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x48], eax
test eax, eax
je 0x413f88
nop dword [eax]
mov ecx, dword [esi + 0x48]
push ecx
mov eax, dword [ecx + 0x34]
mov dword [esi + 0x48], eax
mov eax, dword [ecx + 0x38]
call eax
add esp, 4
cmp dword [esi + 0x48], 0
jne 0x413f70
mov eax, dword [esi + 0x34]
mov dword [esi + 0x40], eax
test eax, eax
je 0x413faa
mov ecx, dword [esi + 0x40]
push ecx
mov eax, dword [ecx + 0x34]
mov dword [esi + 0x40], eax
mov eax, dword [ecx + 0x38]
call eax
add esp, 4
cmp dword [esi + 0x40], 0
jne 0x413f92
mov ecx, esi
call fcn.00413960
push eax
push esi
call ebx
mov eax, dword [esi + 0x38]
add esp, 8
mov dword [esi + 0x44], eax
test eax, eax
je 0x413fda
mov ecx, dword [esi + 0x44]
push ecx
mov eax, dword [ecx + 0x34]
mov dword [esi + 0x44], eax
mov eax, dword [ecx + 0x38]
call eax
add esp, 4
cmp dword [esi + 0x44], 0
jne 0x413fc2
mov ecx, esi
call fcn.00412ca0
mov ecx, esi
call fcn.00413de0
mov edi, eax
xorps xmm1, xmm1
test edi, edi
jne 0x413ee0
cmp dword [esi + 0x18], 0
je 0x414002
mov dword [esi + 0x18], 0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415650
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
sub esp, 0x34
mov eax, dword [0x4a206c]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov esi, ecx
and dword [esi + 0x2c], 0xfffffeff
add dword [esi + 0x40], 0xffffffff
mov eax, dword [esi + 0x2c]
jne 0x415689
test al, 1
jne 0x415689
test al, 0x40
je 0x415689
and eax, 0xffffffbf
mov dword [esi + 0x2c], eax
test al, 0x20
je 0x415689
mov eax, dword [esi + 4]
dec dword [eax + 4]
mov eax, dword [esi + 0x2c]
test eax, 0x20000
jne 0x4156a5
xor eax, eax
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0042b571
add esp, 0x34
ret
push ebx
test eax, 0x2000000
je 0x4156f4
lea eax, [esp + 8]
mov dword [esp + 0x34], 0
push eax
push 1
lea eax, [esp + 0x2c]
xorps xmm0, xmm0
push eax
push dword [esi + 0x90]
movups xmmword [esp + 0x34], xmm0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x415804
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0042b571
add esp, 0x34
ret
test eax, 0x400000
jne 0x415804
push 0xffffffffffffffff
push dword [0x4b061c]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x415817
mov eax, 2
mov ecx, 0x4b0380
xchg dword [ecx], eax
cmp eax, 1
je 0x415744
push ebx
push 1
push dword [0x4b061c]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test eax, eax
jne 0x4157fd
jmp 0x41581c
push ebp
push edi
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push str.conout_
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov ebp, 1
cmp edi, 0xffffffff
je 0x415787
push 0x4b0600
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x415787
mov eax, 0x4b0618
lock or dword [eax], ebp
mov word [esp + 0x18], bp
mov dword [esp + 0x1c], ebp
mov ebp, 0xd
push 0
push ebp
mov dword [esp + 0x28], 0xd0001
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [esp + 0x24], ax
lea eax, [esp + 0x14]
push eax
push 1
lea eax, [esp + 0x20]
mov word [esp + 0x2e], bp
push eax
push dword [esi + 0x90]
mov dword [esp + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x4157d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp edi, 0xffffffff
je 0x4157e4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
test ebx, ebx
je 0x4157fd
mov eax, ebx
pop ebx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0042b571
add esp, 0x34
ret
or dword [esi + 0x2c], 0x400000
mov ecx, dword [esp + 0x38]
xor eax, eax
pop ebx
pop esi
xor ecx, esp
call fcn.0042b571
add esp, 0x34
ret
call fcn.0044ca25
call fcn.0044ca25
int3
Function at 0x415990
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 0x2c
mov eax, dword [0x4a206c]
xor eax, esp
mov dword [esp + 0x28], eax
push ebp
push esi
mov esi, dword [esp + 0x44]
mov ebp, edx
mov eax, ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], esi
cmp dword [esi], 0
je 0x4159cd
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0042b571
add esp, 0x2c
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
lea ecx, [esp + 0x20]
push ecx
push dword [eax + 0x90]
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x4159ee
call ebx
mov dword [esi], eax
movsx eax, word [esp + 0x2c]
mov edx, ebp
movsx esi, word [esp + 0x30]
movsx ebp, word [esp + 0x20]
sub esi, eax
mov eax, dword [0x4a2e44]
inc esi
movsx edi, word [esp + 0x26]
mov dword [0x4a2e34], ebp
mov dword [0x4a2e40], esi
cmp eax, 0xffffffff
jne 0x415a21
mov eax, edi
jmp 0x415a2b
mov ecx, edi
sub ecx, esi
inc ecx
cmp eax, ecx
cmovl eax, ecx
movsx ebx, word [esp + 0x22]
lea ecx, [esi + eax]
cmp ecx, ebx
jle 0x415a3b
mov eax, ebx
sub eax, esi
xor ecx, ecx
test eax, eax
cmovs eax, ecx
cmp byte [esp + 0x48], cl
mov ecx, dword [esp + 0x44]
mov dword [0x4a2e44], eax
je 0x415a55
add ecx, edi
jmp 0x415a57
add ecx, eax
cmp ecx, eax
jge 0x415a5f
mov ecx, eax
jmp 0x415a68
add eax, esi
cmp ecx, eax
jl 0x415a68
lea ecx, [eax - 1]
cmp byte [esp + 0x40], 0
je 0x415a78
movsx edx, word [esp + 0x24]
add edx, dword [esp + 0x18]
test edx, edx
jns 0x415a80
xor edx, edx
jmp 0x415a87
cmp edx, ebp
jl 0x415a87
lea edx, [ebp - 1]
mov eax, dword [esp + 0x14]
mov word [esp + 0x10], dx
mov word [esp + 0x12], cx
push dword [esp + 0x10]
push dword [eax + 0x90]
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x415ae2
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov esi, dword [esp + 0x1c]
cmp eax, 0x57
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
je 0x4159d5
call ebx
pop edi
mov ecx, esi
pop ebx
pop esi
pop ebp
mov dword [ecx], eax
or eax, 0xffffffff
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0042b571
add esp, 0x2c
ret
mov ecx, dword [esp + 0x38]
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
xor ecx, esp
call fcn.0042b571
add esp, 0x2c
ret
Function at 0x418050
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov eax, dword [ecx + 0x2c]
push esi
mov esi, edx
test al, 1
je 0x418063
mov eax, 0xfffff00d
pop esi
pop ecx
ret
test eax, 0x10000
jne 0x418072
mov eax, 0xfffff031
pop esi
pop ecx
ret
mov eax, dword [ecx + 8]
sub eax, 7
je 0x4180f9
sub eax, 5
je 0x4180b9
sub eax, 2
je 0x41808c
mov eax, 0xfffff02a
pop esi
pop ecx
ret
cmp dword [ecx + 0x88], 0
ja 0x4180f9
lea eax, [esp + 4]
push eax
push ecx
call fcn.004161d0
add esp, 8
test eax, eax
je 0x4180b4
mov ecx, dword [esp + 4]
pop esi
add esp, 4
jmp fcn.0041c770
mov eax, dword [esi]
pop esi
pop ecx
ret
cmp dword [ecx + 0x88], 0
ja 0x4180f9
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 1
push esi
push dword [ecx + 0x90]
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x4180f2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
pop esi
add esp, 4
jmp fcn.0041c770
mov eax, dword [esp + 4]
pop esi
pop ecx
ret
mov eax, 0xfffff008
pop esi
pop ecx
ret
Function at 0x4187b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x114]
mov ebp, dword [esi + 0x110]
mov dword [esp + 0x14], eax
cmp ecx, 0xffffffff
jne 0x4187ed
mov dword [esi + 0x48], 0xfffff00d
mov dword [esi + 0xf0], 6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
xorps xmm0, xmm0
mov dword [esp + 0x1c], 0
push ecx
movlpd qword [esp + 0x2c], xmm0
call fcn.0044d065
mov ecx, eax
add esp, 4
mov dword [esp + 0x20], ecx
cmp ecx, 0xffffffff
jne 0x418831
mov ecx, 6
mov dword [esi + 0xf0], 6
call fcn.0041c770
mov dword [esi + 0x48], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
mov edx, dword [esp + 0x14]
mov eax, ebp
and eax, edx
cmp eax, 0xffffffff
je 0x41887e
lea eax, [esp + 0x3c]
mov dword [esp + 0x4c], 0
push 1
mov dword [esp + 0x1c], eax
xorps xmm0, xmm0
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x34]
movups xmmword [esp + 0x48], xmm0
push dword [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov edx, dword [esp + 0x14]
test eax, eax
je 0x418886
mov dword [esp + 0x1c], 1
jmp 0x418886
mov dword [esp + 0x18], 0
xor ebx, ebx
xor edi, edi
nop word [eax + eax]
mov eax, ebp
and eax, edx
cmp eax, 0xffffffff
je 0x4188a9
mov eax, edi
xor ecx, ecx
add eax, ebp
mov dword [esp + 0x44], eax
adc ecx, edx
mov dword [esp + 0x48], ecx
push dword [esp + 0x18]
mov eax, dword [esi + 0x10c]
lea ecx, [esp + 0x28]
push ecx
push dword [eax + ebx*8]
push dword [eax + ebx*8 + 4]
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
add edi, dword [esp + 0x24]
inc ebx
mov dword [esp + 0x28], eax
test eax, eax
je 0x4188e2
mov edx, dword [esp + 0x14]
cmp ebx, dword [esi + 0x108]
jb 0x418890
cmp dword [esp + 0x1c], 0
je 0x418903
push 0
push 0
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x41892e
test edi, edi
jne 0x41892e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x41892e
mov ecx, eax
mov dword [esi + 0xf0], eax
call fcn.0041c770
mov dword [esi + 0x48], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
mov dword [esi + 0x48], edi
cmp edi, 0xffffffff
jne 0x41894b
call fcn.0044c2ba
mov ecx, dword [eax]
mov dword [esi + 0xf0], ecx
call fcn.0041c770
mov dword [esi + 0x48], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
Function at 0x41abe0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, edx
mov dword [esp + 0xc], 1
mov ebx, ecx
cmp dword [esi + 0x90], 0xffffffff
je 0x41ac05
pop esi
mov eax, 0xfffff00e
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push 0x8004667e
push edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x41ac2d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
pop ebx
add esp, 8
ret
push 0
push 1
push edi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x41ac4d
push 0
push edi
push dword [ebx + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
jne 0x41ac5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp dword [esp + 0x1c], 0x17
mov eax, dword [0x4b07e0]
cmove eax, dword [0x4b07dc]
mov ecx, dword [0x4b07f0]
test ecx, ecx
je 0x41ac92
test dword [esi + 0x2c], 0x100000
jne 0x41ac92
test eax, eax
jne 0x41ac92
push 3
push edi
call ecx
test eax, eax
je 0x41acdd
or dword [esi + 0x2c], 0x40000
test dword [esi + 0x2c], 0x2000000
je 0x41acaa
push ecx
mov edx, edi
call fcn.0041ab80
add esp, 4
test eax, eax
jne 0x41ad18
test dword [esi + 0x2c], 0x4000000
je 0x41ad02
push 4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x41acf3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x41acfe
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 1
je 0x41ac92
call ebx
pop edi
pop esi
pop ebx
add esp, 8
ret
lea edx, [esp + 0xc]
mov ecx, edi
call fcn.0041abb0
test eax, eax
jne 0x41ad18
cmp dword [esp + 0x1c], 0x17
mov dword [esi + 0x90], edi
jne 0x41ad16
or dword [esi + 0x2c], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x41af90
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, edx
cmp dword [esi + 0x90], 0xffffffff
jne 0x41afec
movzx eax, word [edi]
push 0
push 1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41afc4
pop edi
pop esi
pop ebp
pop ebx
add esp, 4
jmp dword [sym.imp.WS2_32.dll_WSAGetLastError]
movzx eax, word [edi]
mov edx, esi
push ecx
mov ecx, dword [esi + 4]
push eax
push ebx
call fcn.0041abe0
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x41afec
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
cmp word [edi], 0x17
jne 0x41b011
push 4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0x1b
push 0x29
push dword [esi + 0x90]
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [esp + 0x18]
push edi
push dword [esi + 0x90]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x41b03a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2740
jne 0x41b043
mov dword [esi + 0x94], eax
or dword [esi + 0x2c], 0x200
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x41b2c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, edx
mov dword [esp + 0x1c], 0x4b037f
mov ebx, ecx
mov dword [esp + 0x18], 0
xorps xmm0, xmm0
lea esi, [edi + 0x44]
lea ecx, [esi + 0x20]
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
or dword [edi + 0x2c], 0x80000
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
test dword [edi + 0x2c], 0x100000
je 0x41b311
mov eax, dword [esi + 0x3c]
or eax, 1
mov dword [esi + 0x30], eax
push 0
push ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x20]
push eax
push 1
lea eax, [esp + 0x2c]
push eax
push dword [edi + 0x90]
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41b396
mov eax, dword [edi + 0x2c]
test eax, 0x40000
je 0x41b3f5
or eax, 0x20000
mov dword [edi + 0x2c], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x24], eax
inc dword [edi + 0x3c]
mov dword [esi + 0x38], 0
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x41b388
mov eax, dword [eax + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [ebx + 0x28]
mov dword [eax + 0x38], esi
mov dword [ebx + 0x28], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov dword [esi + 0x38], esi
mov dword [ebx + 0x28], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
call ebp
cmp eax, 0x3e5
je 0x41b3f5
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebp
test eax, eax
jg 0x41b3af
call ebp
jmp 0x41b3b9
call ebp
movzx eax, ax
or eax, 0x80070000
mov dword [esi + 0x20], eax
mov dword [esi + 0x38], 0
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x41b3e4
mov eax, dword [eax + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [ebx + 0x28]
mov dword [eax + 0x38], esi
mov dword [ebx + 0x28], esi
inc dword [edi + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov dword [esi + 0x38], esi
mov dword [ebx + 0x28], esi
inc dword [edi + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
or dword [edi + 0x2c], 0x20000
inc dword [edi + 0x3c]
test dword [edi + 0x2c], 0x100000
je 0x41b45b
cmp dword [esi + 0x40], 0xffffffff
lea eax, [esi + 0x40]
jne 0x41b45b
push 4
push 0xffffffffffffffff
push esi
push 0x41b050
push dword [esi + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x41b45b
call ebp
test eax, eax
jg 0x41b445
call ebp
mov edx, esi
mov dword [esi + 0x20], eax
mov ecx, ebx
call fcn.0041ab50
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
call ebp
movzx eax, ax
mov edx, esi
or eax, 0x80070000
mov ecx, ebx
mov dword [esi + 0x20], eax
call fcn.0041ab50
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x41cd90
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0xa0
mov eax, dword [0x4a206c]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
mov esi, edx
mov dword [esp + 0x18], ecx
push edi
mov edi, dword [esi + 0x2c]
and edi, 0xfffdffff
mov dword [esi + 0x2c], edi
mov ebx, dword [ebp + 0x20]
test ebx, ebx
jns 0x41ce41
mov ecx, ebx
call fcn.0041fcd0
mov edx, eax
cmp edx, 0x2738
je 0x41ce41
cmp edx, 0x2746
je 0x41ce35
cmp edx, 0x2744
je 0x41ce35
test edi, 0x100
je 0x41cf7e
mov ecx, esi
call fcn.00412270
test dword [esi + 0x2c], 0x80000
je 0x41ce0b
xor ecx, ecx
xor eax, eax
jmp 0x41ce17
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 0x84]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
push 0
lea eax, [esp + 0x14]
mov ecx, edx
push 0
push eax
call fcn.0041c770
push eax
jmp 0x41cf72
test edi, 0x80000
je 0x41cf7e
test edi, 0x80000
jne 0x41ce66
sar ebx, 0x1f
lea eax, [esi + 0x88]
and ebx, 2
push ebx
push eax
lea eax, [esi + 0x80]
push eax
push dword [ebp + 0x24]
jmp 0x41cf72
test edi, 0x100
je 0x41cf7e
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov eax, dword [esi + 0x110]
push 0x10000
push esi
mov dword [esp + 0x20], 0
call eax
add esp, 0xc
cmp dword [esp + 0x14], 0
je 0x41cf64
cmp dword [esp + 0x10], 0
je 0x41cf64
push 0x80
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.00443980
add esp, 0xc
mov dword [esp + 0x20], 0x80
lea eax, [esp + 0x20]
mov dword [esp + 0x24], 0
push 0
push 0
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x2c]
push eax
push 1
lea eax, [esp + 0x2c]
push eax
push dword [esi + 0x38]
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
je 0x41cf11
push 0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x24]
jmp 0x41cf72
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
cmp edx, 0x2738
jne 0x41cf33
push 2
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x24]
jmp 0x41cf72
cmp edx, 0x2733
jne 0x41cf48
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0
jmp 0x41cf72
cmp edx, 0x2746
je 0x41cf3b
cmp edx, 0x2744
je 0x41cf3b
mov ecx, esi
call fcn.00412270
jmp 0x41ce1f
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0xfffff024
mov eax, dword [esi + 0x10c]
push esi
call eax
add esp, 0x14
mov eax, dword [esi + 0x2c]
mov ebx, dword [esp + 0x1c]
and eax, 0x20100
cmp eax, 0x100
jne 0x41cf9a
mov edx, esi
mov ecx, ebx
call fcn.0041cc60
mov ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0x2c]
dec ecx
mov dword [esi + 0x3c], ecx
test al, 1
je 0x41cfbf
test ecx, ecx
jne 0x41cfbf
test al, 8
jne 0x41cfbf
or eax, 8
mov dword [esi + 0x2c], eax
mov eax, dword [ebx + 0x2c]
mov dword [esi + 0x28], eax
mov dword [ebx + 0x2c], esi
mov ecx, dword [esp + 0xac]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042b571
add esp, 0xa0
ret
Function at 0x41de00
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebx
push ebp
push esi
push edi
push 0
push 0
push 0x10000
push 0x10000
push 0xff
mov edi, edx
mov ebx, ecx
push 0
push 0x40040003
push dword [edi + 0x98]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, dword [esp + 0x14]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
jne 0x41de51
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
test eax, eax
jg 0x41ded0
call ebp
jmp 0x41deda
push 0
push ecx
push eax
mov edx, edi
mov ecx, ebx
call fcn.0041d7e0
add esp, 0xc
test eax, eax
je 0x41de77
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x3c], 0xffffffff
jmp 0x41de3a
lea eax, [esi + 0x20]
xorps xmm0, xmm0
movups xmmword [eax], xmm0
push eax
mov dword [eax + 0x10], 0
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x41df08
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x3e5
je 0x41df08
call ebp
cmp eax, 0x217
jne 0x41deb6
mov dword [esi + 0x20], 0
jmp 0x41dedd
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x3c], 0xffffffff
call ebp
test eax, eax
jg 0x41ded0
call ebp
jmp 0x41deda
call ebp
movzx eax, ax
or eax, 0x80070000
mov dword [esi + 0x20], eax
mov dword [esi + 0x38], 0
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x41df02
mov eax, dword [eax + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [ebx + 0x28]
mov dword [eax + 0x38], esi
mov dword [ebx + 0x28], esi
inc dword [edi + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x38], esi
mov dword [ebx + 0x28], esi
inc dword [edi + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x41e100
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, edx
mov dword [esp + 0xc], ecx
push edi
test dword [esi + 0x2c], 0x1000000
lea edi, [esi + 0x44]
je 0x41e155
push 0x10
push edi
push 0x41df10
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
test eax, eax
jne 0x41e256
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test eax, eax
jg 0x41e143
call ebx
mov dword [edi + 0x20], eax
jmp 0x41e20f
call ebx
movzx eax, ax
or eax, 0x80070000
mov dword [edi + 0x20], eax
jmp 0x41e20f
lea ebp, [edi + 0x20]
xorps xmm0, xmm0
movups xmmword [ebp], xmm0
mov dword [ebp + 0x10], 0
test dword [esi + 0x2c], 0x100000
je 0x41e178
mov eax, dword [edi + 0x3c]
or eax, 1
mov dword [edi + 0x30], eax
push ebp
push 0
push 0
push 0x4b0389
push dword [esi + 0x94]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41e1ab
call ebx
cmp eax, 0x3e5
je 0x41e1ab
call ebx
test eax, eax
jg 0x41e202
call ebx
jmp 0x41e20c
test dword [esi + 0x2c], 0x100000
je 0x41e256
cmp dword [edi + 0x3c], 0
jne 0x41e1d7
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0x3c], eax
test eax, eax
je 0x41e26d
cmp dword [edi + 0x40], 0xffffffff
lea eax, [edi + 0x40]
jne 0x41e256
push 4
push 0xffffffffffffffff
push edi
push 0x41b050
push dword [edi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x41e256
call ebx
test eax, eax
jg 0x41e202
call ebx
jmp 0x41e20c
call ebx
movzx eax, ax
or eax, 0x80070000
mov dword [ebp], eax
mov ecx, dword [esp + 0x10]
mov dword [edi + 0x38], 0
mov eax, dword [ecx + 0x28]
test eax, eax
je 0x41e240
mov eax, dword [eax + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [ecx + 0x28]
mov dword [eax + 0x38], edi
mov dword [ecx + 0x28], edi
or dword [esi + 0x2c], 0x20000
inc dword [esi + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [edi + 0x38], edi
mov dword [ecx + 0x28], edi
or dword [esi + 0x2c], 0x20000
inc dword [esi + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, esi
call fcn.0041e920
or dword [esi + 0x2c], 0x20000
inc dword [esi + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call ebx
mov edx, str.CreateEvent
mov ecx, eax
call fcn.0041c6e0
int3