joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100bfbf0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x10]
mov ebx, dword [eax]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffffd
cmp eax, 4
ja case.0x100bfc0d.4
jmp dword [eax*4 + 0x100bfe28]
lea eax, [edi + 0x15c]
push eax
call fcn.100bf5c0
movzx ecx, word [edi + 0x40]
add esp, 4
movzx esi, ax
lea eax, [ecx + 1]
and eax, 0xffff
cmp eax, esi
jne 0x100bfc3f
mov dword [edi + 0x18], 0
jmp 0x100bfc56
cmp ecx, esi
jne 0x100bfcca
push esi
push str.Received_last_DATA_packet_block__d_again._n
push ebx
call fcn.100a4be0
add esp, 0xc
mov word [edi + 0x40], si
lea esi, [edi + 0x160]
push 4
push esi
call fcn.100bf620
movzx eax, word [edi + 0x40]
push eax
push esi
call fcn.100bf600
add esp, 0x10
lea eax, [edi + 0xc8]
push dword [edi + 0x148]
push eax
push 0
push 4
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
js 0x100bfd9e
mov eax, dword [edi + 0x154]
xor ecx, ecx
add eax, 4
cmp dword [edi + 0x14c], eax
lea eax, [edi + 0x38]
push eax
setl cl
lea ecx, [ecx*2 + 1]
mov dword [edi], ecx
call fcn.1003157a
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push eax
push esi
push str.Received_unexpected_DATA_packet_block__d__expecting_block__d_n
push ebx
call fcn.100a4be0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
xor eax, eax
lea esi, [edi + 0x160]
push 4
push esi
mov word [edi + 0x40], ax
mov dword [edi + 0x18], eax
call fcn.100bf620
movzx eax, word [edi + 0x40]
push eax
push esi
call fcn.100bf600
add esp, 0x10
lea eax, [edi + 0xc8]
push dword [edi + 0x148]
push eax
push 0
push 4
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
js 0x100bfd9e
lea eax, [edi + 0x38]
mov dword [edi], 1
push eax
call fcn.1003157a
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
movzx eax, word [edi + 0x40]
inc dword [edi + 0x18]
inc eax
push dword [edi + 0x18]
and eax, 0xffff
push eax
push str.Timeout_waiting_for_block__d_ACK.__Retries___d_n
push ebx
call fcn.100a4be0
mov eax, dword [edi + 0x18]
add esp, 0x10
cmp eax, dword [edi + 0x20]
jle 0x100bfd7a
mov dword [edi + 8], 0xffffff9d
xor eax, eax
mov dword [edi], 3
pop edi
pop esi
pop ebx
pop ebp
ret
push dword [edi + 0x148]
lea eax, [edi + 0xc8]
push eax
push 0
push 4
push dword [edi + 0x160]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x100bfe04
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push dword [edi + 0x10]
call fcn.100b0630
push eax
push 0x100f1afc
push ebx
call fcn.100a4b40
add esp, 0x14
mov eax, 0x37
pop edi
pop esi
pop ebx
pop ebp
ret
lea esi, [edi + 0x160]
push 5
push esi
call fcn.100bf620
movzx eax, word [edi + 0x40]
push eax
push esi
call fcn.100bf600
add esp, 0x10
lea eax, [edi + 0xc8]
push dword [edi + 0x148]
push eax
push 0
push 4
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [edi], 3
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push str.tftp_rx:_internal_error
push 0x100f1afc
push ebx
call fcn.100a4b40
add esp, 0xc
mov eax, 0x47
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100c02f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx]
mov eax, dword [eax]
cmp edx, 3
ja case.default.0x100c0302
jmp dword [edx*4 + 0x100c0358]
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.100bfe40
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.100bfbf0
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.100c0500
push str.TFTP_finished
push 0x100e3bcc
push eax
call fcn.100a4be0
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0x100f1afc
push eax
call fcn.100a4b40
add esp, 0xc
mov eax, 0x47
pop ebp
ret
Function at 0x100c1160
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x101025ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.10049acf
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x100c11c4
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x100c11c4
lea eax, [ebp - 0x108]
push eax
call dword [0x101036a0]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002f7bd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1002f7bd
mov esp, ebp
pop ebp
ret

Function at 0x100c11e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100c1160
Function at 0x100c4b20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x100c4b4c
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x100c4b3d
pop edi
xor eax, eax
pop esi
pop ebp
ret
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x100c4b80
cmp dword [esi + 8], 0
jne 0x100c4b70
push 0x100d380c
push dword [eax + 8]
call fcn.1003168f
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x100c4b70
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.100c8b65
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x100c4ba2
mov eax, dword [esi + 8]
test eax, eax
je 0x100c4b9c
push eax
call fcn.10031503
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x100c6770
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x100c67a2
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop esi
pop ebp
ret

Function at 0x100c6920
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x100c6953
push 0x2e
push edi
call fcn.10037560
add esp, 8
test eax, eax
je 0x100c6951
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x100c7820
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x10103694]
mov edi, eax
add esp, 4
test edi, edi
jne 0x100c784d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x100c7894
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x100c789a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x100c78fa
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
lea ebx, [ebx]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
dec dword [ebp + 0x10]
jne 0x100c78c0
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x100c7927
nop
mov eax, dword [esi + 4]
push 1
push 0x100eaa4a
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x100eaa4b
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x100c7900
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x571d0f05
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x2ca06955
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x440400
Capabilities:
Check for software breakpoints

Disassembly:
jbe 0x440439
sub al, 0x2e
invalid
fsub dword [ebp - 0x5948b831]
dec esp
pushal
aam 0xb3
dec esi
rol byte [ecx], 1
scasb al, byte es:[edi]
invalid

Function at 0xc8e0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00c8e200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xc8e0d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc8e0c2
add dl, dl
jne 0xc8e0e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc8e134
xor eax, eax
add dl, dl
jne 0xc8e0ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc8e1d5
add dl, dl
jne 0xc8e0fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc8e108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc8e113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc8e11e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xc8e12a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xc8e0cd
mov eax, 1
add dl, dl
jne 0xc8e142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc8e14d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc8e139
sub eax, ebx
mov ebx, 1
jne 0xc8e180
mov ecx, 1
add dl, dl
jne 0xc8e166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc8e171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc8e15d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc8e0cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc8e197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc8e1a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc8e18e
cmp eax, 0x7d00
jae 0xc8e1c5
cmp eax, 0x500
jb 0xc8e1c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc8e0cd
cmp eax, 0x7f
ja 0xc8e1c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc8e0cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xc8e1f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xc8e0cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x405fd0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x405f73
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x405f91
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x405fef
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x405fd6
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x405fdf
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x405fe9
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x405fcb
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x405f55
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40603c
dec eax
je 0x406033
sub eax, 3
je 0x40602a
mov dword [ebp - 4], 0x40
jmp 0x406059
mov dword [ebp - 4], 4
jmp 0x40603f
mov dword [ebp - 4], 0x20
jmp 0x40603f
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
invalid

Function at 0x406d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
pop esp

Function at 0x406d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop esp
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.0040589c
xor ebx, dword [ecx - 0x32]
fimul word [ebp - 0x72b7b]
call dword [eax - 0x18]
pop ss
jmp 0x406d93
invalid
Function at 0x407860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 0x14]
call fcn.00405861
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x40787f
jmp fcn.0040723e
cmp dword [ebp - 0x37c], 0
je 0x40788d
jmp fcn.00407942
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x4078e6
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x4078eb
jmp fcn.0040723e
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x407932
lea eax, [ebp - 0x714]
push eax
call fcn.004058ac
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.00405861
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x40793d
jmp fcn.00407942
jmp fcn.0040723e

Function at 0x4081a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x430], ax
push 0x208
push 0
lea ecx, [ebp - 0x42e]
push ecx
call fcn.00407808
add esp, 0xc
xor edx, edx
mov word [ebp - 0x218], dx
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.00407808
add esp, 0xc
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x438], 0
push 0x105
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x438]
push edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x434]
push ecx
push 0x105
lea edx, [ebp - 0x430]
push edx
push 0x40d928
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x408266
push 0xa
push 0x104
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x434]
push ecx
call dword [sym.imp.MSVCR90.dll__itow_s]
add esp, 0x10
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x10
jge 0x408288
push str.thsnYaViMRAeBoda
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.004063f0
cmp dword [ebp + 0xc], 0
je 0x4082a0
mov ecx, dword [ebp + 0xc]
push ecx
push 0x104
mov edx, dword [ebp + 8]
push edx
call fcn.004063f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407668
mov esp, ebp
pop ebp
ret
Function at 0x408620
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00407808
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call fcn.00408570
add esp, 4
lea eax, [ebp - 0x210]
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x4086c3
push 0x40df10
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004063a0
push str.Could_not_open_file_mapping_object.
push 0x104
mov edx, dword [ebp + 0xc]
add edx, 0x208
push edx
call fcn.004063a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x410], eax
xor eax, eax
jmp 0x4087be
push 0x1e78
push 0
push 0
push 4
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x408739
push 0x40df88
push 0x104
mov eax, dword [ebp + 0xc]
push eax
call fcn.004063a0
push str.Could_not_map_view_of_file.
push 0x104
mov ecx, dword [ebp + 0xc]
add ecx, 0x208
push ecx
call fcn.004063a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x410], eax
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4087be
mov dword [ebp - 4], 0xe3c
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x218]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_memcpy_s]
add esp, 0x10
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.ReadSharedMemory__:
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004063a0
lea edx, [ebp - 0x210]
push edx
push str.succeeded._mapping_obj_name:__s
push 0x104
mov eax, dword [ebp + 0xc]
add eax, 0x208
push eax
call dword [sym.imp.MSVCR90.dll_swprintf_s]
add esp, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x410], 0
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00407668
mov esp, ebp
pop ebp
ret
Function at 0x4087d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00407808
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call fcn.00408570
add esp, 4
lea eax, [ebp - 0x210]
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x408868
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 2
je 0x408864
push 0
mov ecx, dword [ebp - 0x218]
push ecx
push str.Could_not_open_file_mapping_object
push str.ReleaseSharedMemory__
call fcn.004082b0
add esp, 0x10
xor eax, eax
jmp 0x40887a
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407668
mov esp, ebp
pop ebp
ret

Function at 0x408a80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov byte [0x4127a4], 1
mov dword [0x41279c], 1
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x40e190
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x408afa
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.iLogLevel
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x408b10
cmp dword [ebp - 0xc], 1
jne 0x408b10
mov dword [0x41279c], 2
mov esp, ebp
pop ebp
ret
Function at 0x4091e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x409204
mov eax, 3
jmp 0x40931c
mov ecx, dword [ebp - 0x14]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409220
mov eax, 2
jmp 0x40931c
mov dword [ebp - 4], 0x82
mov edx, dword [ebp - 4]
shl edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, 1
cmp dword [ebp - 4], eax
ja 0x4092fb
mov ecx, dword [ebp - 4]
shl ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x821
jb 0x409259
mov eax, 0xd
jmp 0x40931c
xor ecx, ecx
mov eax, dword [ebp - 4]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00407678
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
shl edx, 1
push edx
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call fcn.00407808
add esp, 0xc
mov edx, dword [ebp - 0x14]
add edx, 4
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
push 0x40e51c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4092cc
mov ecx, dword [ebp - 4]
sub ecx, 1
cmp dword [ebp - 8], ecx
jne 0x4092f6
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0040780e
add esp, 4
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [ebp - 8], 0
jne 0x4092f6
mov eax, 0xe8
jmp 0x40931c
jmp 0x40922f
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x409313
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x40931a
mov eax, 0xd
jmp 0x40931c
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x409330
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, 0xfeff
mov word [ebp - 8], ax
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x409372
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4093d4
push 0
lea edx, [ebp - 4]
push edx
push 2
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x409394
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4093d4
push 0
lea edx, [ebp - 4]
push edx
push 0x40e48c
call dword [sym.imp.MSVCR90.dll_wcslen]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push str._SESSION_
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4093c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4093d4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret