joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401c66
pop dword [ebp - 0x24]
mov eax, 0xb35a9515
add eax, 0x4ce58751
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x92e8054f
add dword [ebp - 0x34], 0xbb6a3ffc
mov dword [ebp - 0x30], 0x4644ce91
add dword [ebp - 0x30], 0xebee7db4
mov dword [ebp - 0x2c], 0xf9fdc930
sub dword [ebp - 0x2c], 0xadb18502
mov dword [ebp - 0x28], 0x63745f26
sub dword [ebp - 0x28], 0x63745f26
lea eax, [ebp - 0x34]
push eax
mov eax, 0x57c893b
add eax, 0xfac3a719
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x355ade3f
add dword [ebp - 0x34], 0x3f178b17
mov dword [ebp - 0x30], 0xf72bcca8
add dword [ebp - 0x30], 0x4a4094cd
mov dword [ebp - 0x2c], 0x321c9158
sub dword [ebp - 0x2c], 0xcead24ec
mov dword [ebp - 0x28], 0xc2f94eb0
add dword [ebp - 0x28], 0x3d06b150
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xca258da3
add eax, 0x361aa289
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3445e
push 0
call eax
mov ecx, 0x3f2b
xor ebx, ebx
add ebx, eax
mov edx, 0xc76daa05
add edx, 0x38d2c5fb
add edx, dword [ebp - 0x24]
mov edi, 0xddda15b8
xor dword [ebp - 0x1c], 0x5791f022
mov esi, dword [edx]
sub dword [ebp - 0x10], edx
sub esi, edi
mov dword [ebx], esi
sub dword [ebp - 8], ecx
add ebx, 0x7b16d5aa
sub ebx, 0x7b16d5a6
add edx, 4
loop 0x401d7e
add eax, 0x888ff85a
add eax, 0x7770f725
mov ebx, eax
add eax, 5
mov ecx, 0x568f3b38
sub ecx, 0x564f3b38
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x4059c0
Capabilities:
Check mutex on windows
Get common file path

Disassembly:
push str.BISHOP_Launcher
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
jne 0x4059ea
push str.CreateMutex
push eax
xor edx, edx
xor ecx, ecx
call fcn.00406de0
add esp, 8
xor eax, eax
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4059e5
push str.GK2IE_BISHOP
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
jne 0x4059e5
push 0x429b88
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x405a27
or eax, 0xffffffff
ret 0x10
push esi
push 0x429b88
push 0x429568
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.manualindex.html
push 0x429568
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov eax, dword [esp + 8]
push 0
push 0x405a80
push 0
push 0x84
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov esi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
ret 0x10

Function at 0x406f00
Capabilities:
Create directory
Get common file path

Disassembly:
sub esp, 0x118
mov eax, dword [0x427138]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push ebp
push edi
lea eax, [esp + 0xc]
push eax
mov edi, ecx
mov dword [esp + 0x10], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x1c], 1
jne 0x406f65
cmp word [0x429778], 0
je 0x406f4b
push 0x429778
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x406fbb
pop edi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00409a6d
add esp, 0x118
ret
push 0
push 0x1c
push esi
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x406f4b
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.BISHOP
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push esi
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x406fa1
call ebp
cmp eax, 0xb7
jne 0x406f4b
push str.GK2IE
push esi
call edi
push 0
push esi
call ebx
test eax, eax
jne 0x406fbb
call ebp
cmp eax, 0xb7
jne 0x406f4b
mov ecx, dword [esp + 0x120]
pop edi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.00409a6d
add esp, 0x118
ret
Function at 0x4078b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x138
mov eax, dword [0x427138]
xor eax, esp
mov dword [esp + 0x134], eax
mov eax, dword [esp + 0x13c]
push ebx
push edi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4079a1
push 0
lea eax, [esp + 0xc]
push eax
push 0x100
lea ecx, [esp + 0x48]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40799a
push str.BSP_063
push str.code:_s
lea edx, [esp + 0x24]
push 0x20
push edx
call fcn.0040ae29
add esp, 0x10
push 0
push 0
push 0x10
lea eax, [esp + 0x18]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x30]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x40]
push eax
call fcn.00413d49
add esp, 8
test eax, eax
jne 0x40799a
lea eax, [esp + 0x3c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407965
push esi
sub eax, edx
push 1
push str.disk:_02d
lea edx, [esp + 0x18]
mov esi, eax
call fcn.00408410
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + esi + 0x4d]
push edx
call fcn.00413d49
add esp, 0x10
pop esi
test eax, eax
jne 0x40799a
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
pop edi
mov al, bl
pop ebx
xor ecx, esp
call fcn.00409a6d
add esp, 0x138
ret

Function at 0x4079c0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x2a8
mov eax, dword [0x427138]
xor eax, esp
mov dword [esp + 0x2a4], eax
push ebp
push esi
push edi
lea eax, [esp + 0xb0]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor esi, esi
mov dword [esp + 0xc], eax
test eax, eax
jbe 0x407ae7
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, edi
cmp word [esp + esi*2 + 0xb0], 0
lea edi, [esp + esi*2 + 0xb0]
je 0x407ae7
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
je 0x407a33
inc esi
cmp word [esp + esi*2 + 0xb0], 0
jne 0x407a22
jmp 0x407adc
push 0
push 0
push 0
push 0
push 0
push 0x40
lea ecx, [esp + 0x48]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x407adc
push str.GK2IE
lea eax, [esp + 0x34]
xor edx, edx
push eax
mov word [esp + 0xb6], dx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x407a7f
inc esi
cmp word [esp + esi*2 + 0xb0], 0
jne 0x407a71
jmp 0x407adc
mov cx, word [edi]
mov edx, 0x3a
mov word [ebx + 2], dx
mov word [ebx], cx
push ebx
lea edx, [esp + 0x14]
mov eax, 0x5c
xor ecx, ecx
push edx
mov word [ebx + 4], ax
mov word [ebx + 6], cx
call ebp
push str.disk.ini
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [esp + 0x10]
push ecx
call fcn.004078b0
add esp, 4
test al, al
jne 0x407b06
jmp 0x407ad0
inc esi
cmp word [esp + esi*2 + 0xb0], 0
jne 0x407ad0
inc esi
cmp esi, dword [esp + 0xc]
jb 0x407a00
pop edi
xor edx, edx
pop esi
mov word [ebx], dx
xor al, al
pop ebp
mov ecx, dword [esp + 0x2a4]
xor ecx, esp
call fcn.00409a6d
add esp, 0x2a8
ret
mov ecx, dword [esp + 0x2b0]
pop edi
pop esi
pop ebp
xor ecx, esp
mov al, 1
call fcn.00409a6d
add esp, 0x2a8
ret
Function at 0x407b20
Capabilities:
Set current directory

Disassembly:
sub esp, 0x44
mov eax, dword [0x427138]
xor eax, esp
mov dword [esp + 0x40], eax
cmp word [0x429778], 0
push esi
mov esi, ecx
jne 0x407c24
xor eax, eax
push ebx
xor ecx, ecx
push edi
lea ebx, [esp + 0xc]
mov word [esp + 0xc], ax
mov dword [esp + 0xe], eax
mov dword [esp + 0x12], eax
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
mov word [esp + 0x2c], cx
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
mov dword [esp + 0x46], eax
mov word [esp + 0x4a], ax
call fcn.004079c0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
test al, al
jne 0x407bae
push 0x423868
mov edx, ebx
push edx
call edi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x30]
push ecx
call edi
push str.setup.exe
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
pop edi
pop ebx
cmp eax, 0xffffffff
je 0x407c01
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x24]
push ecx
push str.setup.exe
jmp 0x407c66
push 0
push 0x4238dc
push 0x4241a0
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00409a6d
add esp, 0x44
ret
push 0x429778
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x407c55
push 0x429778
push esi
xor edx, edx
xor ecx, ecx
call fcn.00406de0
add esp, 8
pop esi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00409a6d
add esp, 0x44
ret
call fcn.00407140
test eax, eax
jne 0x407c7f
mov edx, dword [0x428158]
push eax
push edx
call fcn.004084c0
add esp, 8
test al, al
je 0x407c7f
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x44]
pop esi
xor ecx, esp
call fcn.00409a6d
add esp, 0x44
ret
Function at 0x407c90
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
sub esp, 0x674
mov eax, dword [0x427138]
xor eax, esp
mov dword [esp + 0x66c], eax
push ebx
push ebp
push esi
push edi
xor eax, eax
mov ebx, ecx
push 0x206
push eax
lea ecx, [esp + 0x47a]
push ecx
mov dword [esp + 0x20], ebx
mov word [esp + 0x47c], ax
call fcn.0040e740
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x27e]
push eax
mov word [esp + 0x280], dx
call fcn.0040e740
push ebx
lea eax, [esp + 0x48c]
call fcn.00407000
add esp, 0x1c
test al, al
jne 0x407d0e
push 0
push 0x4238dc
push 0x4241d8
push ebx
jmp 0x407e70
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [esp + 0x470]
push ecx
lea edx, [esp + 0x26c]
push edx
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.save_
lea eax, [esp + 0x26c]
push eax
call esi
lea ecx, [esp + 0x268]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x407d5e
push eax
push 0x4238dc
push 0x4241fc
push ebx
jmp 0x407e70
lea edx, [esp + 0x470]
push edx
lea eax, [esp + 0x26c]
push eax
call edi
push str.savecommon.dat
lea ecx, [esp + 0x26c]
push ecx
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x268]
push edx
call ebp
lea eax, [esp + 0x470]
push eax
lea ecx, [esp + 0x26c]
push ecx
call edi
push str.save_no
lea edx, [esp + 0x26c]
push edx
call esi
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x26c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x407e30
lea ebx, [ebx]
cmp word [esp + 0x44], 0x2e
je 0x407e19
test byte [esp + 0x18], 0x10
jne 0x407e19
lea edx, [esp + 0x470]
push edx
lea eax, [esp + 0x26c]
push eax
call edi
push str.save
lea ecx, [esp + 0x26c]
push ecx
call esi
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x26c]
push eax
call esi
lea ecx, [esp + 0x268]
push ecx
call ebp
lea edx, [esp + 0x18]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407dd0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x470]
push eax
lea ecx, [esp + 0x26c]
push ecx
call edi
push str.save_
lea edx, [esp + 0x26c]
push edx
call esi
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x14]
push 0
push 0x4238dc
push 0x424260
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x67c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00409a6d
add esp, 0x674
ret
Function at 0x407ff0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4208d7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x427138]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [edi], 0x424288
mov dword [edi + 0x54], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 4]
push esi
mov dword [esp + 0x20], ebx
push edi
mov dword [esp + 0x18], 1
call fcn.004081c0
mov dword [esp + 0x1c], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
call fcn.004044f0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x42955c]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x4084c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x40
push ebp
mov ebp, dword [esp + 0x4c]
push 0x38
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0040e740
mov ecx, dword [esp + 0x54]
add esp, 0xc
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x3c
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], str.open
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], 1
mov dword [esp + 0x10], 0x440
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x408538
cmp dword [esp + 0x28], 0x20
jle 0x408538
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
setne al
pop ebp
add esp, 0x40
ret
push ebx
push esi
push edi
push 0
push 0x200
lea ecx, [esp + 0x60]
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov edx, dword [esp + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov esi, eax
shr esi, 1
je 0x4085a3
cmp esi, 0x7fffffff
ja 0x4085a3
mov ebx, dword [esp + 0x58]
lea edi, [esp + 0x10]
mov ecx, esi
mov edx, ebx
call fcn.00408430
test eax, eax
jl 0x4085a7
mov eax, dword [esp + 0x10]
mov ecx, esi
sub ecx, eax
lea edx, [ebx + eax*2]
mov eax, 0x4242fc
call fcn.00408470
mov ebx, dword [esp + 0x58]
test ebp, ebp
jne 0x4085b0
mov ebp, str._current_dir_
test esi, esi
je 0x408619
cmp esi, 0x7fffffff
ja 0x4085e3
lea edi, [esp + 0x10]
mov ecx, esi
mov edx, ebx
call fcn.00408430
test eax, eax
jl 0x4085e3
mov eax, dword [esp + 0x10]
mov ecx, esi
sub ecx, eax
lea edx, [ebx + eax*2]
mov eax, ebp
call fcn.00408470
mov ebx, dword [esp + 0x58]
test esi, esi
je 0x408619
cmp esi, 0x7fffffff
ja 0x408619
lea edi, [esp + 0x10]
mov ecx, esi
mov edx, ebx
call fcn.00408430
test eax, eax
jl 0x408619
mov eax, dword [esp + 0x10]
mov ecx, esi
sub ecx, eax
lea edx, [ebx + eax*2]
mov eax, str.__r_nexe:__
call fcn.00408470
mov ebx, dword [esp + 0x58]
mov ebp, dword [esp + 0x54]
test ebp, ebp
jne 0x408626
mov ebp, str._unknown_application_
test esi, esi
je 0x40868f
cmp esi, 0x7fffffff
ja 0x408659
lea edi, [esp + 0x54]
mov ecx, esi
mov edx, ebx
call fcn.00408430
test eax, eax
jl 0x408659
mov eax, dword [esp + 0x54]
mov ecx, esi
sub ecx, eax
lea edx, [ebx + eax*2]
mov eax, ebp
call fcn.00408470
mov ebx, dword [esp + 0x58]
test esi, esi
je 0x40868f
cmp esi, 0x7fffffff
ja 0x40868f
lea edi, [esp + 0x54]
mov ecx, esi
mov edx, ebx
call fcn.00408430
test eax, eax
jl 0x40868f
mov eax, dword [esp + 0x54]
mov ecx, esi
sub ecx, eax
lea edx, [ebx + eax*2]
mov eax, 0x42436c
call fcn.00408470
mov ebx, dword [esp + 0x58]
push 0x40
push 0x423dc8
push ebx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebx
xor al, al
pop ebp
add esp, 0x40
ret
Function at 0x408ce0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x420962
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x427138]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi], 0x424288
mov dword [edi + 0x54], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 4]
push esi
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x1c], 1
call fcn.004081c0
mov dword [esp + 0x20], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
call fcn.004044f0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x42955c]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov ecx, dword [esp + 0x2c]
push 0x32
mov edx, esi
mov byte [esp + 0x24], 2
call fcn.00403d10
test eax, eax
jne 0x408dda
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x408dd3
or eax, 4
push ebx
push eax
call fcn.00401e60
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8

Function at 0x409a6d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427138]
jne 0x409a77
repz ret
jmp fcn.0040e4b0
Function at 0x408e74
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
add eax, 0xffffcac9
push ebx
mov ebx, dword [esp + 0xc]
xor edx, 0xb3a
push ebp
push esi
mov esi, dword [esp + 0x20]
add esi, 0x3b2
mov dword [esp + 0x14], eax
push edi
mov edi, dword [esp + 0x14]
lea ebp, [ebx - 0x12f2]
add edi, 0x50f
mov dword [esp + 0x14], esi
lea eax, [esi - 0xbf]
mov esi, dword [esp + 0x28]
lea ecx, [ebx - 0x36f2]
cmp edi, eax
jg 0x408efc
mov eax, ecx
xor eax, 0x2fa9
cmp edx, eax
jg 0x408efc
cmp dword [esi + 0xa4], 0x5069
jb 0x408ef2
mov eax, dword [0x93113c]
mov eax, dword [eax + 0x68]
sub eax, dword [esi + 0x28]
add eax, dword [0x976918]
mov dword [esi + 0x18], eax
jmp 0x408efc
mov dword [esi + 0x90], 0x40c050
cmp edx, ebx
jg 0x409024
xor edi, 0x15ee
xor ebp, ebp
mov edx, dword [0x93113c]
mov eax, dword [0x976914]
dec eax
add eax, dword [edx + 0x58]
add dword [edx + 0xb8], eax
mov eax, dword [esi + 0x90]
mov ebx, dword [eax + ebp]
add ebp, 4
imul ebx, dword [esi + 0x64]
mov eax, dword [0x9768e4]
add eax, dword [0x976914]
xor eax, 0xc1796
sub dword [esi + 0xb8], eax
mov eax, dword [esi + 0x68]
mov edx, ebx
mov ecx, dword [0x93113c]
xor eax, 0xf47fe
shr edx, 0x18
or dword [ecx + 0x7c], eax
mov eax, dword [esi + 0xd0]
add eax, 0x98562b8
xor dword [esi + 8], eax
mov ecx, dword [esi + 0x78]
mov eax, dword [esi + 0x94]
mov byte [ecx + eax], dl
mov edx, ebx
inc dword [esi + 0x78]
mov eax, dword [0x97693c]
add eax, 0xfffe7f10
shr edx, 0x10
add eax, dword [esi + 0x3c]
or dword [esi], eax
mov eax, dword [esi + 0xa8]
inc eax
imul eax, dword [0x976968]
mov dword [0x976968], eax
mov ecx, dword [esi + 0x78]
mov eax, dword [esi + 0x94]
mov byte [ecx + eax], dl
mov edx, ebx
inc dword [esi + 0x78]
mov ecx, dword [esi + 0x94]
mov eax, dword [0x976910]
shr edx, 8
mov byte [eax + ecx], dl
mov ecx, dword [0x976910]
inc ecx
mov dword [0x976910], ecx
mov eax, dword [esi + 0x94]
mov byte [ecx + eax], bl
inc dword [0x976910]
mov ecx, dword [0x93113c]
mov eax, dword [esi + 0x28]
add eax, 0x1dd037e6
xor dword [0x976950], eax
mov eax, dword [ecx + 0x20]
xor eax, 1
imul eax, dword [ecx + 8]
mov dword [ecx + 8], eax
mov ecx, dword [0x93113c]
mov eax, dword [0x9768f8]
add eax, 0xff7a05f0
xor dword [ecx + 0xd0], eax
cmp ebp, 0x4ae8
jl 0x408f0c
jmp 0x409089
mov eax, dword [0x976944]
mov ebx, dword [0x9768b8]
imul eax, ebx
cmp ebp, eax
jbe 0x409089
mov edx, dword [0x93113c]
mov eax, dword [edx + 0xcc]
or eax, dword [esp + 0x18]
and eax, dword [esi + 0x6c]
cmp ebx, eax
ja 0x409089
and ecx, dword [esp + 0x14]
mov eax, dword [edx + 0x58]
xor ecx, ebp
sub eax, dword [0x976898]
push ecx
mov ecx, dword [esi]
or eax, 0x353e
push eax
lea eax, [edi + 0x2a8c]
and ecx, 0x1bc1
sub ecx, dword [esi + 0xb4]
push eax
mov eax, dword [edx + 0x40]
or eax, dword [esi + 0xa4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
xor edi, 0x710
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x409096
Capabilities:
Create pipe

Disassembly:
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
xor ecx, 0x270f
push ebx
mov ebx, dword [esp + 0x18]
add eax, 0xffffb197
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x18]
add ebp, 0xfffff008
push edi
mov edi, ebx
xor ebx, 0x98e
xor edi, 0x1bf4
cmp ecx, eax
je 0x409101
mov eax, dword [0x93113c]
mov eax, dword [eax + 0x4c]
cmp eax, dword [0x9768f0]
mov eax, dword [esp + 0x14]
je 0x4090ec
mov dword [eax + 0x64], 0x1c3b55a7
add esi, 0xe87
mov dword [eax + 0x90], 0x6d79c0
jmp 0x409187
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x7c]
sub eax, 0x2e56
xor eax, ebp
cmp dword [edx + 0xd0], eax
jae 0x409187
mov eax, dword [esp + 0x18]
add eax, 0xffff9a24
push eax
mov eax, edi
sub eax, ecx
mov ecx, dword [edx + 0x20]
push eax
mov eax, dword [0x93113c]
and ecx, 0x2400
or ecx, dword [eax + 0x74]
mov eax, edi
sub eax, dword [edx + 0xb4]
push ecx
push eax
lea eax, [ebx + 0x3537]
push eax
mov eax, ebp
and eax, edi
push eax
mov eax, dword [edx + 0x40]
sub eax, ebp
and eax, dword [0x9768e4]
push eax
imul eax, dword [0x9768c0], 0x2eec
and eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [0x93113c]
mov ecx, dword [eax + 0x20]
mov eax, 0x1c3e
and ecx, 0x3537
sub eax, ecx
add dword [0x976914], eax
pop edi
lea eax, [esi - 0x4b5]
pop esi
pop ebp
pop ebx
ret