joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push ebp
mov ebp, 0x10
push edi
lea ebx, [esi + 4]
cmp dword [esi + 0x18], ebp
jb 0x4a7014
mov eax, dword [ebx]
jmp 0x4a7016
mov eax, ebx
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x4a7037
pop edi
pop ebp
mov al, 1
pop ebx
ret
cmp edi, 2
je 0x4a709a
cmp edi, 3
je 0x4a709a
call fcn.004895c0
test al, al
jne 0x4a713c
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x4a713c
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi + 0x18], ebp
jb 0x4a7079
mov ebx, dword [ebx]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push edi
push ebx
push str.Failed_to_retrieve_reg_value__name:__s__error:__i
push 0x7f
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsPnzRegKey.cpp
push 1
push eax
call edx
add esp, 0x1c
pop edi
pop ebp
xor al, al
pop ebx
ret
call fcn.004895c0
cmp byte [esp + 0x18], 0
je 0x4a70f6
test al, al
jne 0x4a713c
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x4a713c
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi + 0x18], ebp
jb 0x4a70d5
mov ebx, dword [ebx]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push edi
push ebx
push str.Reg_value_is_not_found__name:__s__error:__i
push 0x79
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsPnzRegKey.cpp
push 1
push eax
call edx
add esp, 0x1c
pop edi
pop ebp
xor al, al
pop ebx
ret
test al, al
jne 0x4a713c
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x4a713c
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi + 0x18], ebp
jb 0x4a7121
mov ebx, dword [ebx]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push edi
push ebx
push str.Reg_value_is_not_found__name:__s__error:__i
push 0x7b
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsPnzRegKey.cpp
push 0
push eax
call edx
add esp, 0x1c
pop edi
pop ebp
xor al, al
pop ebx
ret
Function at 0x4a7150
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, ecx
cmp byte [ebx + 4], 0
push esi
push edi
jne 0x4a71a5
call fcn.004895c0
test al, al
jne 0x4a71a5
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x4a71a5
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push str.m_bNeedClose
push str.PnzAssert:__s
push 0xd5
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsPnzRegKey.cpp
push 2
push eax
call edx
add esp, 0x18
mov edi, dword [esp + 0x1c]
cmp dword [edi + 0x18], 0x10
lea esi, [edi + 4]
jb 0x4a71b6
mov eax, dword [esi]
jmp 0x4a71b8
mov eax, esi
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [ebx]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
test ebx, ebx
je 0x4a7230
call fcn.004895c0
test al, al
jne 0x4a7228
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x4a7228
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
cmp dword [edi + 0x18], 0x10
jb 0x4a720a
mov esi, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push esi
push ebx
push str.Error__d_occured_while_setting_key_value__s
push 0xda
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsPnzRegKey.cpp
push 1
push eax
call edx
add esp, 0x1c
pop edi
pop esi
xor al, al
pop ebx
ret 0x10
pop edi
pop esi
mov al, 1
pop ebx
ret 0x10
Function at 0x4bb830
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x60f403
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x72d150]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor eax, eax
mov dword [esi + 4], eax
mov edi, dword [esp + 0x28]
push 0xffffffffffffffff
lea ebp, [esi + 0xc]
mov dword [esi], vtable.CPnzDb::STest.0
push eax
lea ebx, [edi + 0xc]
mov dword [ebp + 0x18], 0xf
mov dword [ebp + 0x14], eax
push ebx
mov ecx, ebp
mov dword [esp + 0x2c], eax
mov byte [ebp + 4], al
call fcn.004021a0
movzx eax, byte [ebx + 0x1c]
mov byte [ebp + 0x1c], al
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x30], ecx
movzx edx, byte [edi + 0x34]
mov byte [esi + 0x34], dl
lea ebp, [esi + 0x48]
fld dword [edi + 0x3c]
xor ecx, ecx
fstp dword [esi + 0x3c]
movzx eax, byte [edi + 0x40]
mov byte [esi + 0x40], al
push 0xffffffffffffffff
push ecx
mov dword [ebp + 0x18], 7
mov dword [ebp + 0x14], 0
lea ebx, [edi + 0x48]
mov word [ebp + 4], cx
push ebx
mov ecx, ebp
mov byte [esp + 0x2c], 1
call fcn.00402410
movzx edx, byte [ebx + 0x1c]
mov byte [ebp + 0x1c], dl
mov eax, dword [edi + 0x6a]
mov dword [esi + 0x6a], eax
mov ecx, dword [edi + 0x6e]
mov dword [esi + 0x6e], ecx
mov edx, dword [edi + 0x72]
mov dword [esi + 0x72], edx
mov eax, dword [edi + 0x76]
mov dword [esi + 0x76], eax
movzx ecx, byte [edi + 0x7a]
mov byte [esi + 0x7a], cl
mov edx, dword [edi + 0x80]
mov dword [esi + 0x80], edx
mov eax, dword [edi + 0x84]
mov dword [esi + 0x84], eax
movzx ecx, byte [edi + 0x88]
mov byte [esi + 0x88], cl
movzx edx, byte [edi + 0x91]
mov byte [esi + 0x91], dl
movzx eax, byte [edi + 0x92]
mov byte [esi + 0x92], al
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4

Function at 0x4d73b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x617b98
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x72d150]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 4], eax
lea ecx, [esi + 8]
mov dword [esp + 0x14], eax
mov dword [esi], vtable.CPnzDb::SPresetItem.0
call fcn.004c55b0
lea ecx, [esi + 0x20]
mov byte [esi + 0x18], 1
call fcn.004c5640
mov byte [esi + 0x30], 1
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x553cd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x62ec43
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x72d150]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x768d7c
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esp + 0x18], ebx
mov dword [ecx], 0x768d7c
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x68b01b
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.00553160
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x556ff0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 0x10
jb 0x556fff
mov ecx, dword [eax + 4]
jmp 0x557002
lea ecx, [eax + 4]
mov edx, dword [eax + 0x14]
add edx, ecx
mov eax, 0x811c9dc5
cmp ecx, edx
je 0x557022
push esi
movsx esi, byte [ecx]
imul eax, eax, 0x1000193
inc ecx
xor eax, esi
cmp ecx, edx
jne 0x557011
pop esi
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.005d5af9
imul eax, eax, 0xb14
imul edx, edx, 0x41a7
add esp, 8
sub edx, eax
mov eax, edx
jns 0x55704c
add eax, 0x7fffffff
ret 4
Function at 0x557c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x62ef48
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x72d150]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov ebp, ecx
lea ecx, [ebp + 8]
call fcn.00553320
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x557de8
mov esi, dword [edi + 0x20]
add esi, 8
mov eax, esi
lea edx, [eax + 1]
jmp 0x557c60
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x557c60
sub eax, edx
push eax
push esi
lea ecx, [ebp + 0x98]
call fcn.00403490
lea eax, [edi + 0x2c]
mov edi, dword [eax + 0x20]
cmp edi, eax
je 0x557de8
cmp edi, ebx
je 0x557de8
add ebp, 0x50
nop
mov ecx, dword [edi + 0x18]
add ecx, 8
mov eax, ecx
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
lea esi, [eax + 1]
jmp 0x557cb0
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x557cb0
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0x44]
call fcn.00403490
mov ecx, dword [edi + 0x14]
add ecx, 8
mov eax, ecx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x557ce6
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0x28]
call fcn.00403490
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0xa0], 1
call fcn.004133e0
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 8]
push ecx
push edx
push eax
lea edx, [esp + 0x20]
push edx
mov ecx, ebp
mov byte [esp + 0xa8], 2
call fcn.00557790
mov esi, 0x10
cmp dword [esp + 0x8c], esi
jb 0x557d4d
mov eax, dword [esp + 0x78]
push eax
call fcn.005be738
add esp, 4
mov dword [esp + 0x8c], 0xf
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
cmp dword [esp + 0x70], esi
jb 0x557d76
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.005be738
add esp, 4
mov dword [esp + 0x70], 0xf
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
cmp dword [esp + 0x38], esi
jb 0x557d99
mov edx, dword [esp + 0x24]
push edx
call fcn.005be738
add esp, 4
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
mov dword [esp + 0x98], 0xffffffff
cmp dword [esp + 0x54], esi
jb 0x557dc7
mov eax, dword [esp + 0x40]
push eax
call fcn.005be738
add esp, 4
mov ecx, edi
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.00553620
mov edi, eax
cmp edi, ebx
jne 0x557c90
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret
Function at 0x558d50
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x62f101
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x72d150]
xor eax, esp
mov dword [esp + 0xc4], eax
push ebx
push esi
mov eax, dword [0x72d150]
xor eax, esp
push eax
lea eax, [esp + 0xd4]
mov dword fs:[0], eax
mov esi, dword [esp + 0xe4]
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x38], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x558e37
cmp dword [esp + 0x44], 2
jne 0x558e37
cmp dword [esp + 0x38], 6
jb 0x558e37
lea ecx, [esp + 0x10]
call fcn.004a6cb0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
lea ecx, [esp + 0x1c]
mov dword [esp + 0xe0], 0
call fcn.00401a40
push 0
push 0x101
lea ecx, [esp + 0x20]
push ecx
push 3
lea ecx, [esp + 0x20]
mov byte [esp + 0xec], 1
call fcn.004a72d0
test al, al
sete bl
cmp dword [esp + 0x30], 0x10
mov byte [esp + 0xdc], 0
jb 0x558e1f
mov edx, dword [esp + 0x1c]
push edx
call fcn.005be738
add esp, 4
test bl, bl
je 0x558e5f
lea ecx, [esp + 0x10]
mov dword [esp + 0xdc], 0xffffffff
call fcn.004a6d30
xor al, al
mov ecx, dword [esp + 0xd4]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.005cd251
add esp, 0xd4
ret
push str.EnableLUA
lea ecx, [esp + 0x1c]
call fcn.00401a40
push 0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0xe8], 2
call fcn.004a7c00
test al, al
lea ecx, [esp + 0x18]
sete bl
call fcn.00401ac0
test bl, bl
je 0x558ea9
mov dword [esp + 0xc], 1
mov byte [esi], 1
jmp 0x558eb8
cmp dword [esp + 0xc], 0
je 0x558eb5
mov byte [esi], 1
jmp 0x558eb8
mov byte [esi], 0
lea ecx, [esp + 0x10]
mov dword [esp + 0xdc], 0xffffffff
call fcn.004a6d30
mov al, 1
jmp 0x558e39
Function at 0x559c70
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00559c00
mov esi, dword [esp + 0x10]
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x559c8b
mov eax, dword [edi]
jmp 0x559c8d
mov eax, edi
lea ecx, [ebx + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x559ca8
pop edi
pop esi
mov al, 1
pop ebx
ret 8
push ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp ebp, 2
je 0x559d20
cmp ebp, 3
je 0x559d20
cmp ebp, 0x12
je 0x559d20
mov byte [ebx], 1
call fcn.004895c0
test al, al
jne 0x559d73
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x559d73
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi + 0x18], 8
jb 0x559cfc
mov edi, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push edi
push ebp
push str.Failed_to_start_file_search__error:__i__file:__S
push 0x3e
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsPnzFileFinder.cpp
push 2
push eax
call edx
add esp, 0x1c
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret 8
cmp byte [esp + 0x18], 0
je 0x559d73
call fcn.004895c0
test al, al
jne 0x559d73
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x559d73
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
cmp dword [esi + 0x18], 8
jb 0x559d58
mov edi, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push edi
push ebp
push str.Failed_to_start_file_search_because_the_file_is_not_found__error:__i__file:__S
push 0x38
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsPnzFileFinder.cpp
push 1
push eax
call edx
add esp, 0x1c
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret 8
Function at 0x55ab41
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x55ab94
call fcn.004895c0
test al, al
jne 0x55ab94
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x55ab94
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push str.m_key___NULL
push str.PnzAssert:__s
push 0xbd
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsCryptPnzCrKey.cpp
push 2
push eax
call edx
add esp, 0x18
mov eax, dword [esi + 8]
test eax, eax
jne 0x55aba2
xor al, al
pop esi
pop ecx
ret 8
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push esi
lea ecx, [esp + 8]
push ecx
push edx
push 0
push 0
push 0
push eax
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x55ac1e
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.004895c0
test al, al
jne 0x55ac16
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x55ac16
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push esi
push edi
push str.CryptEncrypt___has_failed__error:__i___dataSize:__i
push 0xc5
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsCryptPnzCrKey.cpp
push 2
push eax
call edx
add esp, 0x1c
pop edi
xor al, al
pop esi
pop ecx
ret 8
mov al, 1
pop esi
pop ecx
ret 8

Function at 0x55ac31
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0
jne 0x55ac84
call fcn.004895c0
test al, al
jne 0x55ac84
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x55ac84
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push str.m_key___NULL
push str.PnzAssert:__s
push 0xd0
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsCryptPnzCrKey.cpp
push 2
push eax
call edx
add esp, 0x18
mov eax, dword [esi + 8]
test eax, eax
jne 0x55ac92
xor al, al
pop esi
pop ecx
ret 8
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
push edx
push 0
push 0
push 0
push eax
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x55ad0d
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.004895c0
test al, al
jne 0x55ad05
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x55ad05
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push esi
push edi
push str.CryptDecrypt___has_failed__error:__i___dataSize:__i
push 0xd8
push str.E:PnzBsPnzBsTempFBCVersion037_00SrcPnzCodeUtilsCryptPnzCrKey.cpp
push 2
push eax
call edx
add esp, 0x1c
pop edi
xor al, al
pop esi
pop ecx
ret 8
mov al, 1
pop esi
pop ecx
ret 8
Function at 0x55c070
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x358
mov eax, dword [0x72d150]
xor eax, esp
mov dword [esp + 0x354], eax
mov eax, dword [esp + 0x35c]
mov ecx, dword [esp + 0x360]
push edi
mov edi, dword [esp + 0x368]
mov dword [esp + 0xc], ecx
test eax, eax
je 0x55c0a8
cmp word [eax], 0
jne 0x55c0e0
push 0x208
lea edx, [esp + 0x154]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x55c0d9
xor al, al
pop edi
mov ecx, dword [esp + 0x354]
xor ecx, esp
call fcn.005cd251
add esp, 0x358
ret
lea eax, [esp + 0x150]
push esi
push 0
push 0x80
push 3
push 0
push 3
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x55c11a
pop esi
xor al, al
pop edi
mov ecx, dword [esp + 0x354]
xor ecx, esp
call fcn.005cd251
add esp, 0x358
ret
lea eax, [esp + 0x14]
push eax
push esi
mov byte [esp + 0x13], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x55c1e2
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebx, ecx
mov ebp, eax
test edi, edi
je 0x55c14a
mov dword [edi], ecx
mov dword [edi + 4], eax
test eax, eax
jl 0x55c1e0
jg 0x55c15d
cmp ecx, 0x40
jbe 0x55c1e0
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x40
lea edx, [esp + 0x128]
push edx
push esi
call edi
test eax, eax
je 0x55c1e0
cmp dword [esp + 0x14], 0x40
jne 0x55c1e0
mov ecx, dword [esp + 0x158]
mov eax, ecx
cdq
add eax, 0xf8
adc edx, 0
cmp edx, ebp
jg 0x55c1e0
jl 0x55c19e
cmp eax, ebx
ja 0x55c1e0
push 0
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x55c1e0
push 0
lea eax, [esp + 0x18]
push eax
push 0xf8
lea ecx, [esp + 0x30]
push ecx
push esi
call edi
test eax, eax
je 0x55c1e0
cmp dword [esp + 0x14], 0xf8
jne 0x55c1e0
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
mov dword [eax], edx
mov byte [esp + 0x13], 1
pop ebp
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x35c]
mov al, byte [esp + 0xb]
pop esi
pop edi
xor ecx, esp
call fcn.005cd251
add esp, 0x358
ret
Function at 0x55c210
Capabilities:
Create pipe

Disassembly:
sub esp, 8
xor edx, edx
push esi
mov esi, ecx
cmp byte [esp + 0x14], dl
je 0x55c22b
cmp byte [esp + 0x18], dl
setne dl
lea edx, [edx + edx + 1]
jmp 0x55c236
cmp byte [esp + 0x18], dl
je 0x55c236
mov edx, 2
cmp byte [esp + 0x1c], 0
je 0x55c243
or edx, 0x80000
movzx ecx, byte [esp + 0x20]
or edx, 0x40000000
neg ecx
sbb ecx, ecx
and ecx, 4
cmp byte [esp + 0x24], 0
je 0x55c25f
or ecx, 2
fld dword [esp + 0x34]
push 0
fmul qword [0x697590]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x18], eax
fldcw word [esp + 0x18]
fistp qword [esp + 8]
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 0x38]
fldcw word [esp + 0x20]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ecx
mov ecx, dword [esp + 0x28]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x55c306
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004895c0
test al, al
jne 0x55c2fd
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x55c2fd
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push esi
push str.CreateNamedPipe___has_failed__error:__i
push 0x42
push 0x6ac450
push 2
push eax
call edx
add esp, 0x18
xor al, al
pop esi
add esp, 8
ret 0x28
mov al, 1
pop esi
add esp, 8
ret 0x28

Function at 0x55c215
Capabilities:
Create pipe

Disassembly:
sub esp, 8
xor edx, edx
push esi
mov esi, ecx
cmp byte [esp + 0x14], dl
je 0x55c22b
cmp byte [esp + 0x18], dl
setne dl
lea edx, [edx + edx + 1]
jmp 0x55c236
cmp byte [esp + 0x18], dl
je 0x55c236
mov edx, 2
cmp byte [esp + 0x1c], 0
je 0x55c243
or edx, 0x80000
movzx ecx, byte [esp + 0x20]
or edx, 0x40000000
neg ecx
sbb ecx, ecx
and ecx, 4
cmp byte [esp + 0x24], 0
je 0x55c25f
or ecx, 2
fld dword [esp + 0x34]
push 0
fmul qword [0x697590]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x18], eax
fldcw word [esp + 0x18]
fistp qword [esp + 8]
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 0x38]
fldcw word [esp + 0x20]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ecx
mov ecx, dword [esp + 0x28]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x55c306
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004895c0
test al, al
jne 0x55c2fd
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x55c2fd
call fcn.004895a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push esi
push str.CreateNamedPipe___has_failed__error:__i
push 0x42
push 0x6ac450
push 2
push eax
call edx
add esp, 0x18
xor al, al
pop esi
add esp, 8
ret 0x28
mov al, 1
pop esi
add esp, 8
ret 0x28