joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10026290
Capabilities:
Create service
Get common file path
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x1003cce4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], 0
cmp dword [ebp - 0x214], 0
je 0x100262df
push 0x1003cd00
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
je 0x100262f0
push 0
call dword [ebp - 0x218]
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x21c], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002643e
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
movzx ecx, word [ebp + eax*2 - 0x212]
cmp ecx, 0x5c
je 0x10026396
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
movzx eax, word [ebp + eax*2 - 0x212]
cmp eax, 0x2f
je 0x10026396
push 0x1003cd20
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.ntdll.dll_wcscat]
add esp, 8
push 0x1003cd24
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.ntdll.dll_wcscat]
add esp, 8
push 0xf01ff
push 0x1003cd50
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x1002641e
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0
push 2
push 1
push 0xf01ff
push 0x1003cd64
push 0x1003cd78
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x1002641e
push 0
push 0
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp dword [ebp - 0x21c], 0
je 0x10026434
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x218], 0
je 0x1002644f
push 1
call dword [ebp - 0x218]
cmp dword [ebp - 0x214], 0
je 0x10026465
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret

Function at 0x10026ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebx
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.10026626
dec edi
xchg ebx, eax
invalid
Function at 0x10029ee0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1030
call fcn.10010620
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
call fcn.10028f50
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10029fcc
mov byte [ebp - 0x102c], 0
xor ecx, ecx
mov dword [ebp - 0x102b], ecx
mov dword [ebp - 0x1027], ecx
mov dword [ebp - 0x1023], ecx
mov dword [ebp - 0x101f], ecx
mov dword [ebp - 0x101b], ecx
mov dword [ebp - 0x1017], ecx
mov dword [ebp - 0x1013], ecx
mov word [ebp - 0x100f], cx
mov byte [ebp - 0x100d], cl
mov edx, dword [ebp + 8]
push edx
push 0x1003cf5c
lea eax, [ebp - 0x102c]
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
lea ecx, [ebp - 0x102c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10029fcc
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x1030], eax
push 0x77
push 0x1003cfb0
call fcn.10026ad0
add esp, 8
push eax
push str._s:_Failed_to_get_disk_signature
mov edx, dword [ebp - 0x1030]
push edx
mov eax, dword [ebp - 0x1030]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0xc
xor eax, eax
jmp 0x1002a03e
mov byte [ebp - 0x1008], 0
push 0xfff
push 0
lea eax, [ebp - 0x1007]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x100c], 0
push 0
lea ecx, [ebp - 0x100c]
push ecx
push 0x1000
lea edx, [ebp - 0x1008]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1002a024
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1002a03e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xe50]
mov dword [eax], ecx
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret
Function at 0x1002a520
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x1002a533
xor eax, eax
jmp 0x1002a5b9
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jae 0x1002a5b0
mov dword [ebp - 0xc], 0
push 0
lea ecx, [ebp - 0xc]
push ecx
push 1
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002a581
cmp dword [ebp - 0xc], 0
jne 0x1002a58f
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov byte [ecx], 0
mov eax, dword [ebp - 8]
jmp 0x1002a5b9
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp ecx, 0xa
jne 0x1002a5ae
jmp 0x1002a5b0
jmp 0x1002a552
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x1002a5c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x1002a5d3
xor eax, eax
jmp 0x1002a660
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x10]
shr eax, 1
cmp dword [ebp - 8], eax
jae 0x1002a655
mov dword [ebp - 0xc], 0
push 0
lea ecx, [ebp - 0xc]
push ecx
push 2
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002a623
cmp dword [ebp - 0xc], 0
jne 0x1002a634
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov word [edx + ecx*2], 0
mov eax, dword [ebp - 8]
jmp 0x1002a660
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
cmp edx, 0xa
jne 0x1002a653
jmp 0x1002a655
jmp 0x1002a5f2
mov ecx, dword [ebp - 4]
mov word [ecx], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1002bf60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push str.SystemCurrentControlSetControl
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002bf9e
xor eax, eax
jmp 0x1002c05b
mov word [ebp - 0x810], 0
push 0x7fe
push 0
lea ecx, [ebp - 0x80e]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 8], 0x400
mov dword [ebp - 0x814], 0
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x814]
push ecx
push 0
push str.SystemStartOptions
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002c008
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1002c05b
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x810]
push edx
call dword [sym.imp.ntdll.dll__wcslwr]
add esp, 4
push str.winpe
lea eax, [ebp - 0x810]
push eax
call fcn.10002cc0
add esp, 8
test eax, eax
jne 0x1002c052
push str..wim
lea ecx, [ebp - 0x810]
push ecx
call fcn.10002cc0
add esp, 8
test eax, eax
je 0x1002c059
mov eax, 1
jmp 0x1002c05b
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret
Function at 0x1002c4a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov dword [ebp - 0x484], ecx
mov eax, dword [ebp - 0x484]
cmp dword [eax + 8], 0
je 0x1002c4d5
mov ecx, dword [ebp - 0x484]
mov eax, dword [ecx + 4]
jmp 0x1002c5c4
mov word [ebp - 0x480], 0
push 0x3fe
push 0
lea edx, [ebp - 0x47e]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x200
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov cx, word [ebp - 0x480]
mov word [ebp - 4], cx
mov ecx, 0xf
mov esi, str.C:WindowsSystem32_ntdll.dll
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xe
mov esi, str.C:WinNTSystem32_ntdll.dll
lea edi, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
mov dx, word [ebp - 4]
mov word [ebp - 0x44], dx
mov ax, word [ebp - 4]
mov word [ebp - 0x7c], ax
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1002c57e
lea edx, [ebp - 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1002c57e
mov eax, dword [ebp - 0x484]
mov dword [eax + 8], 1
mov ecx, dword [ebp - 0x484]
mov dword [ecx + 4], 1
mov eax, 1
jmp 0x1002c5c4
call fcn.1002bf60
test eax, eax
je 0x1002c5a8
mov edx, dword [ebp - 0x484]
mov dword [edx + 8], 1
mov eax, dword [ebp - 0x484]
mov dword [eax + 4], 1
mov eax, 1
jmp 0x1002c5c4
mov ecx, dword [ebp - 0x484]
mov dword [ecx + 8], 1
mov edx, dword [ebp - 0x484]
mov dword [edx + 4], 0
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret
Function at 0x1002d120
Capabilities:
Unload driver

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
push str.RegistryMachineSystemCurrentControlSetServicesddmdrv
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea ecx, [ebp - 8]
push ecx
call sub.ntdll.dll_NtUnloadDriver
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x1002d17f
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x14], eax
push 0xb0
push 0x1003e670
call fcn.1002c2f0
add esp, 8
push eax
push str._s:_Failed_to_NtUnloadDriver.
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
call edx
add esp, 0xc
xor eax, eax
jmp 0x1002d184
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x1002d190
Capabilities:
Install driver

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
push 0x1003e500
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0xa
call fcn.1002bd70
add esp, 4
test eax, eax
jge 0x1002d1eb
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x14], eax
push 0x94
push 0x1003e578
call fcn.1002c2f0
add esp, 8
push eax
push str._s:_Failed_to_EnablePrivilege_SE_LOAD_DRIVER_PRIVILEGE__in_LoadDrive.
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
xor eax, eax
jmp 0x1002d247
lea edx, [ebp - 8]
push edx
call sub.ntdll.dll_NtLoadDriver
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xc000010e
jne 0x1002d207
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
jge 0x1002d242
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x18], eax
push 0xa0
push 0x1003e5d0
call fcn.1002c2f0
add esp, 8
push eax
push str._s:_Failed_to_NtLoadDriver.
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
add esp, 0xc
xor eax, eax
jmp 0x1002d247
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x1002d250
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x1002d2d5
push 0x383
push 0x1003edb8
call fcn.1002c2f0
add esp, 8
push eax
push str.GetFileAttributesW_pFile__INVALID_FILE_ATTRIBUTES
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10002580
add esp, 0xc
jmp 0x1002d379
lea edx, [ebp - 0x10]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1002d329
push 0x385
push 0x1003edf8
call fcn.1002c2f0
add esp, 8
push eax
push str.AllocateAndInitializeSid_SIDAuthWorld__1__SECURITY_WORLD_RID__0__0__0__0__0__0__0__pSIDEveryone_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10002580
add esp, 0xc
jmp 0x1002d379
push 0
push 2
push 0x10000000
push 0
mov ecx, dword [ebp - 0x10]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.1002bdd0
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x14], eax
jne 0x1002d379
push 0x38c
push str..._sys.cpp
call fcn.1002c2f0
add esp, 8
push eax
push str.AddAceToObjectsSecurityDescriptor_pFile___SE_FILE_OBJECT____LPTSTR_pSIDEveryone___TRUSTEE_IS_SID___GENERIC_ALL___SET_ACCESS___NO_INHERITANCE_ERROR_SUCCESS
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10002580
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret 4
Function at 0x1002db00
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 4], 0
mov word [ebp - 0x220], 0
push 0x206
push 0
lea eax, [ebp - 0x21e]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x14]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x44
push 0
lea edx, [ebp - 0x268]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x268], 0x44
mov eax, dword [ebp + 8]
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x22c], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x230], edx
mov eax, dword [ebp - 0x23c]
or eax, 0x101
mov dword [ebp - 0x23c], eax
mov cx, word [ebp - 0x238]
mov word [ebp - 0x238], cx
push str.cmd.exe__k
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.ntdll.dll_wcscpy]
add esp, 8
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x268]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [ebp - 0x220]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002dbec
jmp 0x1002dc05
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
jmp 0x1002dc08
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret 8
Function at 0x1002dc20
Capabilities:
Read file on windows
Read pipe
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8001c
call fcn.10010620
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x8001c], ecx
mov dword [ebp - 0x80014], 0
mov dword [ebp - 0x80018], 0
mov dword [ebp - 0x80010], 0
mov dword [ebp - 0x8000c], 0
lea eax, [ebp - 0x8000c]
push eax
lea ecx, [ebp - 0x80010]
push ecx
lea edx, [ebp - 0x80014]
push edx
push 0x80000
lea eax, [ebp - 0x80008]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1002dd3b
cmp dword [ebp - 0x80014], 0
je 0x1002dd37
push 0
lea edx, [ebp - 0x80014]
push edx
push 0x80000
lea eax, [ebp - 0x80008]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002dcd1
cmp dword [ebp - 0x80014], 0
jne 0x1002dcd3
jmp 0x1002dd4b
mov edx, dword [ebp - 0x80014]
push edx
lea eax, [ebp - 0x80008]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.ntdll.dll_memcpy
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x80014]
mov dword [edx], eax
mov ecx, dword [ebp - 0x8001c]
cmp dword [ecx], 0xffffffff
je 0x1002dd31
push 0
lea edx, [ebp - 0x80018]
push edx
mov eax, dword [ebp - 0x80014]
push eax
lea ecx, [ebp - 0x80008]
push ecx
mov edx, dword [ebp - 0x8001c]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1002dd2f
jmp 0x1002dd4b
jmp 0x1002dd35
xor eax, eax
jmp 0x1002dd50
jmp 0x1002dd39
jmp 0x1002dd4b
jmp 0x1002dd46
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002dc65
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1002dd60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x1002dd73
xor eax, eax
jmp 0x1002dda4
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1002dd9b
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jne 0x1002dd99
jmp 0x1002dd9f
jmp 0x1002dd9d
jmp 0x1002dd9f
jmp 0x1002dd73
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002ddb0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x1002ddea
xor eax, eax
jmp 0x1002de2c
push 2
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov dword [edx], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x1002de40
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x1002de7a
xor eax, eax
jmp 0x1002debc
push 2
push 0
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x1002dfb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x20c], 0
mov byte [ebp - 0x208], 0
push 0x1ff
push 0
lea eax, [ebp - 0x207]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0
push 0
push 0
mov ecx, dword [ebp - 0x218]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x200
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp - 0x218]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1002e036
xor eax, eax
jmp 0x1002e138
movzx ecx, byte [ebp - 0xa]
cmp ecx, 0x55
jne 0x1002e04b
movzx edx, byte [ebp - 9]
cmp edx, 0xaa
je 0x1002e052
xor eax, eax
jmp 0x1002e138
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x210], ecx
jmp 0x1002e072
mov edx, dword [ebp - 0x210]
add edx, 1
mov dword [ebp - 0x210], edx
cmp dword [ebp - 0x210], 4
jge 0x1002e136
mov eax, dword [ebp - 0x210]
shl eax, 4
lea ecx, [ebp + eax - 0x4a]
mov dword [ebp - 0x214], ecx
mov edx, dword [ebp - 0x218]
mov eax, dword [edx + 0x10]
add eax, 1
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 0x214]
movzx eax, byte [edx + 4]
test eax, eax
je 0x1002e0ef
mov ecx, dword [ebp - 0x214]
movzx edx, byte [ecx + 4]
cmp edx, 0xf
je 0x1002e0ef
mov eax, dword [ebp - 0x214]
movzx ecx, byte [eax + 4]
cmp ecx, 5
je 0x1002e0ef
push 0x10
mov edx, dword [ebp - 0x214]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
mov eax, 1
jmp 0x1002e138
mov ecx, dword [ebp - 0x214]
movzx edx, byte [ecx + 4]
cmp edx, 0xf
je 0x1002e10d
mov eax, dword [ebp - 0x214]
movzx ecx, byte [eax + 4]
cmp ecx, 5
jne 0x1002e131
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax + 8]
mov dword [edx + 0xc], ecx
jmp 0x1002e063
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret 4

Function at 0x1002e1e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jb 0x1002e21a
mov eax, 1
jmp 0x1002e21c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret