joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bdf0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x52efc0]
xor eax, ebp
mov dword [esp + 0x44], eax
mov eax, esp
mov dword [esp], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x45be3f
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov esi, 0x7fffffff
mov edi, 0xffffffff
cmp eax, 0xffffffff
mov edx, ecx
sbb edx, 0x7fffffff
cmovb esi, ecx
cmovb edi, eax
jmp 0x45be43
xor edi, edi
xor esi, esi
mov ecx, dword [esp + 0x44]
xor ecx, ebp
call fcn.004aeb01
mov eax, edi
mov edx, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret

Function at 0x45c310
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x52efc0]
xorpd xmm0, xmm0
xor eax, ebp
mov dword [esp + 0x30], eax
movsd xmm1, qword [0x537e30]
ucomisd xmm1, xmm0
jne 0x45c46a
jp 0x45c46a
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [0x537e40]
test cl, 1
je 0x45c48f
test cl, 2
je 0x45c4ae
rdtsc
lea esi, [esp + 0x28]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 8], eax
mov dword [esp + 4], edx
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub edi, dword [0x537e48]
movsd xmm2, qword [0x4edf60]
sbb ebx, dword [0x537e4c]
movd xmm1, edi
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movd xmm0, ebx
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x4e38c0]
subpd xmm1, xmmword [0x4e38d0]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
xorpd xmm1, xmm1
divsd xmm0, qword [esp + 0x20]
ucomisd xmm2, xmm0
ja 0x45c46a
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub eax, dword [0x537e38]
sbb ecx, dword [0x537e3c]
movd xmm2, eax
movd xmm1, ecx
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x4e38c0]
subpd xmm2, xmmword [0x4e38d0]
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addsd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x537e30], xmm1
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.004aeb01
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
or ecx, 1
mov dword [0x537e40], ecx
rdtsc
mov dword [0x537e38], eax
mov dword [0x537e3c], edx
test cl, 2
jne 0x45c379
or ecx, 2
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [0x537e40], ecx
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [0x537e4c], ecx
mov dword [0x537e48], eax
jmp 0x45c379
Function at 0x45d780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x52efc0]
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push 7
call fcn.0043fe00
add esp, 8
test al, al
je 0x45d83a
lea edi, [ebp - 0x1c]
mov ecx, esi
push edi
call fcn.00431a10
mov ecx, esi
push edi
call fcn.00431280
mov ecx, edi
call fcn.0042cba0
cmp word [str.User_Data], 0
je 0x45d7df
xor ebx, ebx
cmp word [ebx + ebx + 0x4eea4c], 0
lea ebx, [ebx + 1]
jne 0x45d7d1
mov ecx, esi
push ebx
push str.User_Data
push edi
call fcn.00431b50
mov ecx, esi
push edi
call fcn.00431280
mov ecx, edi
call fcn.0042cba0
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x45d806
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45d819
and eax, 0x10
mov bl, 1
jne 0x45d83a
cmp byte [esi + 0xb], 0
js 0x45d82a
mov word [esi], 0
mov byte [esi + 0xb], 0
jmp 0x45d838
mov eax, dword [esi]
mov word [eax], 0
mov dword [esi + 4], 0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aeb01
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x45de91
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x52efc0]
mov esi, 0x10dd
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x537ecc], 0
jne 0x45df0d
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor eax, eax
xor edx, edx
lock cmpxchg dword [0x537ecc], ecx
jne 0x45df0d
mov esi, dword [0x537ee0]
mov dword [0x537ec8], edx
mov dword [0x537ed0], edx
mov dword [0x537ed4], edx
mov dword [0x537ed8], edx
mov dword [0x537edc], edx
test esi, esi
je 0x45df0b
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edi, [ebp - 0x14]
push edi
push 0x40
push 0x10000
push esi
call ebx
mov esi, dword [esi + 4]
test esi, esi
jne 0x45def9
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aeb01
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45df21
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x52efc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [0x537ecc]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, 0x10dd
cmp edi, eax
jne 0x45dffd
mov edi, dword [0x537ed0]
test edi, edi
je 0x45dfba
xor esi, esi
mov eax, dword [edi + 0x10]
lea ecx, [ebp - 0x14]
movzx eax, byte [eax + 0x17]
push ecx
push dword [edi + 0x14]
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [edi + 4], 0
jne 0x45dfa9
mov eax, dword [edi + 0x10]
test eax, eax
je 0x45dfa9
mov ecx, eax
mov dword [eax + 4], esi
mov dword [eax], esi
mov dword [eax + 0xc], esi
mov dword [eax + 8], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], esi
mov dword [eax + 0x18], esi
and ecx, 0xffff0000
mov edx, dword [ecx + 8]
mov dword [eax + 0x18], edx
mov dword [ecx + 8], eax
mov dword [edi + 0x10], esi
mov ebx, dword [edi]
push edi
call fcn.004aeac6
add esp, 4
test ebx, ebx
mov edi, ebx
jne 0x45df59
mov dword [0x537ed0], 0
call fcn.0045e011
mov edi, dword [0x537ed4]
test edi, edi
je 0x45dfef
mov esi, dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [edi + 4]
call esi
mov ebx, dword [edi]
push edi
call fcn.004aeac6
add esp, 4
test ebx, ebx
mov edi, ebx
jne 0x45dfd9
xor esi, esi
mov dword [0x537ed4], esi
mov dword [0x537ecc], esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aeb01
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45e329
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [0x537ed8]
test esi, esi
je 0x45e342
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ebx, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor esi, esi
cmp eax, ebx
je 0x45e339
push 8
call fcn.004aea96
add esp, 4
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x45e37b
mov eax, dword [0x537ed4]
mov dword [edi + 4], ebx
mov dword [0x537ed4], edi
mov dword [edi], eax
jmp 0x45e339
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
call fcn.004aeac6
add esp, 4
mov dword [0x537ed8], esi
mov dword [0x537edc], 0
jmp 0x45e339
Function at 0x45e876
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [0x52efc0]
mov esi, edx
lea edi, [ebp - 0x2c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x1c
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov eax, dword [edi + 4]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x45e8cc
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x45e8cc
mov edx, dword [eax + ecx + 0xd8]
add edx, eax
cmp edx, esi
ja 0x45e8cc
add edx, dword [eax + ecx + 0xdc]
mov bl, 1
cmp edx, esi
ja 0x45e8ce
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aeb01
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x45e956
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + 0x3c]
movzx edx, word [ecx + eax + 6]
test edx, edx
je 0x45e9a1
add eax, ecx
xor ebx, ebx
movzx esi, word [eax + 0x14]
lea edi, [eax + esi + 0x18]
xor esi, esi
test edi, edi
je 0x45e9a1
mov eax, dword [edi + ebx + 0xc]
test eax, eax
je 0x45e98e
add eax, ecx
cmp eax, dword [ebp + 8]
jbe 0x45e990
jmp 0x45e999
xor eax, eax
add eax, dword [edi + ebx + 8]
cmp eax, dword [ebp + 8]
ja 0x45e9aa
inc esi
add ebx, 0x28
cmp esi, edx
jb 0x45e979
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
add edi, ebx
mov eax, edi
jmp 0x45e9a3
Function at 0x45ea4a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x45eb29
mov eax, dword [ecx + 4]
mov ebx, ecx
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx + 0x74], 0
je 0x45eb29
cmp word [eax + edx + 0x14], 0x68
jb 0x45eb29
mov esi, dword [ebx]
mov ecx, ebx
push dword [eax + edx + 0x78]
call dword [esi + 4]
test eax, eax
je 0x45eb29
mov esi, eax
mov eax, dword [ebp + 8]
cmp eax, 0xffff
ja 0x45eaa4
mov word [edi], ax
jmp 0x45eb56
mov eax, dword [ebx]
mov ecx, ebx
push dword [esi + 0x20]
call dword [eax + 4]
mov edx, eax
mov eax, dword [esi + 0x18]
lea ecx, [eax*4]
test ecx, ecx
je 0x45eb29
mov dword [ebp - 0x18], esi
lea esi, [edx + eax*4]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ebx
mov ebx, edx
mov dword [ebp - 0x14], edx
inc eax
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ecx, dword [ebp - 0x10]
sub edi, ebx
mov eax, edi
shr edi, 0x1f
sar eax, 2
add edi, eax
mov eax, dword [ecx]
and edi, 0xfffffffe
push dword [ebx + edi*2]
call dword [eax + 4]
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x45eb07
mov edx, dword [ebp - 0x1c]
cmp cl, byte [eax]
jne 0x45eb09
mov cl, byte [edx]
inc eax
inc edx
test cl, cl
jne 0x45eafb
xor ecx, ecx
movzx eax, byte [eax]
movzx ecx, cl
lea edi, [ebx + edi*2]
sub ecx, eax
je 0x45eb35
test ecx, ecx
lea eax, [edi + 4]
cmovle esi, edi
cmovg ebx, eax
xor eax, eax
cmp ebx, esi
jne 0x45ead3
jmp 0x45eb2b
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
mov eax, dword [ecx]
push dword [esi + 0x24]
call dword [eax + 4]
sub edi, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
sar edi, 1
movzx eax, word [eax + edi]
add ax, word [esi + 0x10]
mov word [ecx], ax
mov al, 1
jmp 0x45eb2b

Function at 0x45ec30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x45ec3f
test eax, eax
jne 0x45ec6f
cmp byte [0x539f0c], 1
jne 0x45ec6f
push dword [0x539f10]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45ec6f
push eax
call fcn.004104f0
add esp, 4
push 0
push dword [0x539f10]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop ebp
ret 0xc

Function at 0x460a4c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x14
mov edx, dword [0x52efc0]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea esi, [ebp - 0x18]
xor edi, edi
xor edx, ebp
mov dword [ebp - 0xc], edx
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [esi + 8], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x1c]
push ecx
push edi
push esi
push 0x460ac0
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x460aa2
mov esi, eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004aeb01
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebp
ret
Function at 0x466060
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [0x52efc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0x2c], 0
je 0x466173
mov esi, ecx
lea edx, [ecx + 0x24]
lea eax, [ebp - 0x6c]
lea edi, [ebp - 0x64]
mov ecx, edi
push eax
push 2
call fcn.0046619a
add esp, 8
mov edx, dword [edi]
test edx, edx
je 0x46617a
cmp dword [edx], 0
mov dword [ebp - 0x5c], esi
je 0x46615f
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], edx
add eax, 0x18
mov dword [ebp - 0x68], eax
xor eax, eax
test dword [edx + eax*8 + 8], 0xc0000020
mov dword [ebp - 0x58], eax
jne 0x466153
cmp dword [ebp + 8], 0
je 0x466116
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [eax + 4], ecx
je 0x466116
xor ebx, ebx
xor edi, edi
mov eax, dword [ebp - 0x58]
add ecx, ebx
mov esi, dword [edx + eax*8 + 4]
call fcn.00466a28
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov edx, dword [ebp - 0x60]
test eax, eax
jne 0x466153
mov eax, dword [ebp + 8]
inc edi
add ebx, 0x44
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
sar eax, 2
imul eax, eax, 0xf0f0f0f1
cmp edi, eax
jb 0x4660de
mov eax, dword [ebp - 0x58]
lea edi, [ebp - 0x54]
mov ecx, edi
push dword [edx + eax*8 + 4]
call fcn.0046676c
mov esi, dword [ebp - 0x5c]
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
jae 0x466147
mov ebx, 0x44
push ebx
push edi
push eax
call fcn.004b76d0
add esp, 0xc
add dword [esi + 0x1c], ebx
jmp 0x466150
mov ecx, dword [ebp - 0x68]
push edi
call fcn.0046075c
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x58]
inc eax
cmp eax, dword [edx]
jb 0x4660b9
mov dword [ebp - 0x64], 0
push edx
call fcn.004aeafc
add esp, 4
xor esi, esi
jmp 0x466184
mov esi, 0x3f0
jmp 0x466184
mov esi, dword [ebp - 0x6c]
mov dword [ebp - 0x64], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aeb01
mov eax, esi
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4719d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov ecx, dword [0x52efc0]
mov eax, dword [ebp + 0xc]
xor ecx, ebp
cmp eax, 3
mov dword [ebp - 0xc], ecx
jne 0x471a64
push 0x471a80
push 0x53a800
call fcn.0047197c
add esp, 8
cmp dword [0x53a804], 0
jne 0x471a64
push dword [0x53a808]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x471a64
mov esi, eax
mov edi, 0x53a80c
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x53a82c]
movsd xmm0, qword [0x53a824]
mov dword [ebp - 0x10], eax
movsd qword [ebp - 0x18], xmm0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, 0xfffffff4
mov eax, dword [ebp + edi - 0xc]
test eax, eax
je 0x471a56
push dword [esi + edi + 0xc]
call eax
add esp, 4
add edi, 4
jne 0x471a45
push esi
call fcn.004709ec
add esp, 4
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004aeb01
add esp, 0x10
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x481574
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
call fcn.00457f20
test al, al
je 0x481598
push 0x32
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea edi, [esi + 0x20]
mov ecx, edi
push 0
call fcn.004815f8
mov eax, dword [esi + 0x30]
test eax, eax
je 0x4815b7
mov dword [esi + 0x34], eax
push eax
call fcn.004aeac6
add esp, 4
mov eax, dword [esi + 0x2c]
xor ecx, ecx
mov dword [esi + 0x2c], ecx
test eax, eax
je 0x4815cc
push eax
call fcn.00459fc0
add esp, 4
mov ecx, edi
push 0
call fcn.004815f8
lea ecx, [esi + 0x18]
call fcn.0040e9a0
lea ecx, [esi + 0x14]
call fcn.0040e9a0
lea ecx, [esi + 0x10]
call fcn.0040e9a0
mov ecx, esi
pop esi
pop edi
pop ebp
jmp fcn.00457e30
Function at 0x4819ce
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x52efc0]
mov esi, ecx
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
lea edi, [esi + 0x18]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [edx + ecx]
push ebx
push eax
push ebx
push 0x8000004
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, edi
push eax
call fcn.0040e94a
mov ecx, esi
mov esi, dword [esi + 0x18]
lea eax, [esi + 1]
cmp eax, 1
ja 0x481a3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov ebx, 0x19
mov dword [ecx], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aeb01
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
mov eax, dword [ecx]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ebx
push ebx
push 7
push ecx
push dword [ebp - 0x18]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x481b65
xor eax, eax
push eax
push eax
push eax
push 6
push dword [edi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, dword [ebp + 0x18]
test eax, eax
je 0x481b78
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
test ebx, ebx
je 0x481ac3
test ecx, ecx
je 0x481ac3
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x18]
lea edi, [edx + eax]
push ecx
push ebx
push edi
call fcn.004b76d0
add esp, 0xc
mov eax, 0xffffff00
mov ecx, dword [edi + eax + 0x100]
test ecx, ecx
je 0x481abe
sub ecx, ebx
mov dword [edi + eax + 0x100], ecx
add eax, 4
jne 0x481aaa
mov eax, dword [ebp - 0x14]
mov dword [0x53a3c8], eax
sub esp, 0xc
mov edi, dword [ebp - 0x20]
mov dword [esp + 8], 4
mov dword [esp + 4], 0x53a3c8
mov ecx, edi
call fcn.0048196e
test eax, eax
mov dword [0x53a3c8], 0
jne 0x481b56
mov eax, dword [ebp + 0x10]
mov dword [0x53a8b0], eax
sub esp, 0xc
mov ecx, edi
mov dword [esp + 8], 4
mov dword [esp + 4], 0x53a8b0
call fcn.0048196e
test eax, eax
mov dword [0x53a8b0], 0
jne 0x481b56
mov eax, dword [ebp + 0x14]
mov dword [0x53a8b4], eax
sub esp, 0xc
mov ecx, edi
mov dword [esp + 8], 4
mov dword [esp + 4], 0x53a8b4
call fcn.0048196e
test eax, eax
mov dword [0x53a8b4], 0
je 0x481b8a
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x481a27
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x18]
mov ebx, 0x1a
jmp 0x481a25
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov ebx, 0x1b
jmp 0x481a27
mov esi, dword [ebp + 8]
mov eax, 0x20
lea ecx, [edi + eax]
mov dword [ebp - 0x1c], ecx
push eax
call fcn.004aea96
add esp, 4
mov ebx, eax
mov ecx, eax
push esi
push dword [edi + 0x24]
push dword [edi + 8]
push dword [edi]
call fcn.0048a3d0
mov ecx, dword [ebp - 0x1c]
push ebx
call fcn.004815f8
mov ecx, dword [edi + 0x20]
push 0x400
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call fcn.0048a462
mov ebx, 4
test al, al
je 0x481a27
mov ecx, edi
call fcn.00458100
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x481a27
Function at 0x4870a6
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [0x52efc0]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x2c]
mov esi, 5
xor ecx, ebp
cmp eax, 3
mov dword [ebp - 0x10], ecx
mov dword [edx], 0xffffffff
jne 0x48713e
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x28]
mov edx, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
cmp byte [edi + 0xb], 0
jns 0x4870ea
mov edi, dword [edi]
mov ebx, dword [ebx]
push 0
push esi
push edx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
je 0x48712b
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edi, edi
lea ecx, [ebp - 0x14]
push 3
push edi
push edi
push ecx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
lea eax, [ebp - 0x14]
sbb edi, edi
or edi, dword [eax]
jmp 0x48712e
xor edi, edi
dec edi
mov eax, dword [ebp + 0x2c]
mov dword [eax], edi
xor eax, eax
cmp edi, 0xffffffff
sete al
lea esi, [eax + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aeb01
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x487468
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov ecx, dword [ebp + 8]
mov eax, dword [0x52efc0]
mov edi, 5
add ecx, 0xfffffffb
xor eax, ebp
cmp ecx, 1
mov dword [ebp - 0x10], eax
ja 0x4875b0
mov eax, dword [ebp + 0x14]
xor ebx, ebx
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x54], 0x44
cmp byte [eax + 0xb], bl
jns 0x4874d5
mov eax, dword [eax]
mov esi, dword [ebp + 0x10]
push eax
call fcn.004cb8b6
add esp, 4
movzx ecx, byte [edi + 0xb]
test cl, cl
jns 0x4874ee
mov ecx, dword [edi + 4]
mov edi, dword [edi]
test ecx, ecx
mov edx, dword [ebp + 0x1c]
cmove edi, ecx
mov ecx, dword [ebp + 0xc]
cmp byte [esi + 0xb], bl
jns 0x487500
mov esi, dword [esi]
mov ecx, dword [ecx]
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x54]
push edx
push ecx
push edi
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x58], eax
push eax
push esi
mov esi, edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, 5
test eax, eax
je 0x4875a0
mov eax, dword [ebp + 8]
mov ebx, 0x101c01
cmp eax, 6
mov eax, 0x1fffff
cmove ebx, eax
mov eax, dword [esi]
mov dword [ebp - 0x60], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
push 0
push ebx
push esi
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ebx, dword [esi + 4]
test eax, eax
je 0x487599
mov eax, esi
mov esi, 0x100c43
mov ecx, 0x1fffff
add eax, 4
cmp dword [ebp + 8], 6
mov edi, eax
cmove esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
push 0
push esi
push edi
push dword [ebp - 0x5c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea edi, [ecx + ecx*4]
jmp 0x4875a0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x4875b0
push eax
call fcn.00459fc0
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004aeb01
mov eax, edi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret