joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432df0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov edx, eax
shr edx, 2
xor ebx, 0x45504d5a
xor ecx, ecx
push edi
test edx, edx
jle 0x432e10
xor dword [esi + ecx*4], ebx
inc ecx
cmp ecx, edx
jl 0x432e08
lea edi, [edx*4]
mov edx, eax
and edx, 3
mov ecx, 0
jle 0x432e30
add esi, edi
xor byte [esi + ecx], bl
inc ecx
shr ebx, 8
cmp ecx, edx
jl 0x432e25
pop edi
pop esi
pop ebx
ret

Function at 0x432e40
Capabilities:
Hash data via wincrypt
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x2038
call fcn.0044e2b0
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x2034], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2044]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
push 0
push 0
push 0
mov edi, ecx
mov ebx, edx
push ebp
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], ebx
call esi
cmp eax, 0xffffffff
jne 0x432e8d
mov eax, 1
jmp 0x432ffa
push 0
push 0
push 0
push edi
call esi
cmp eax, 0xffffffff
je 0x432e83
push 0x2000
lea eax, [esp + 0x44]
push 0
push eax
call fcn.004416b0
add esp, 0xc
push 0
lea ecx, [esp + 0x18]
push ecx
push 0xa14
lea edx, [esp + 0x4c]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x14], 0xa14
jne 0x432e83
mov ebx, dword [ebx + 0x80c]
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call fcn.0040ab70
test eax, eax
je 0x43301e
test ebx, ebx
jbe 0x432fba
mov edi, dword [sym.imp.ADVAPI32.dll_CryptHashData]
jmp 0x432f20
mov esi, 0x2000
cmp ebx, 0x2000
ja 0x432f2f
mov esi, ebx
mov edx, dword [esp + 0x24]
push 0
lea eax, [esp + 0x24]
push eax
push esi
lea ecx, [esp + 0x4c]
push ecx
push edx
sub ebx, esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x20], esi
jne 0x433015
cmp dword [esp + 0x2c], 0
je 0x433015
mov eax, dword [esp + 0x28]
test eax, eax
je 0x433015
test esi, esi
je 0x433015
push 1
push esi
lea ecx, [esp + 0x48]
push ecx
push eax
call edi
test eax, eax
je 0x433015
mov ecx, dword [esp + 0x18]
mov eax, esi
lea edx, [esp + 0x40]
call fcn.00432df0
cmp eax, esi
jne 0x433015
push 0
lea edx, [esp + 0x18]
push edx
push esi
lea eax, [esp + 0x4c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x14], esi
jne 0x433015
test ebx, ebx
ja 0x432f20
lea esi, [esp + 0x28]
call fcn.0040ac70
test eax, eax
je 0x433019
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [eax + 0x830], ecx
mov ecx, dword [esp + 0x38]
mov dword [eax + 0x834], edx
mov edx, dword [esp + 0x3c]
mov dword [eax + 0x838], ecx
mov dword [eax + 0x83c], edx
call fcn.0040ac00
xor eax, eax
mov ecx, dword [esp + 0x2044]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043e4c7
add esp, 0x2038
ret 4
lea esi, [esp + 0x28]
call fcn.0040ac00
mov eax, 2
jmp 0x432ffa
Function at 0x433560
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x453326
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x264], eax
push esi
push edi
mov eax, dword [0x48e050]
xor eax, esp
push eax
lea eax, [esp + 0x278]
mov dword fs:[0], eax
mov eax, dword [0x491d10]
mov edx, dword [eax + 0xc]
mov esi, ecx
mov ecx, 0x491d10
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
push str..bku
lea eax, [esp + 0x1c]
mov dword [esp + 0x284], 0
mov ecx, dword [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004322c0
lea edi, [esp + 0x14]
mov byte [esp + 0x280], 1
call fcn.0042e780
mov byte [esp + 0x280], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433615
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x14]
cmp dword [edi - 0xc], 0
je 0x433715
lea ecx, [esp + 0x1c]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x433715
test esi, esi
je 0x433715
mov ecx, 0x47dcbc
lea eax, [esp + 0x48]
jmp 0x433650
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x433676
test dx, dx
je 0x433672
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x433676
add eax, 4
add ecx, 4
test dx, dx
jne 0x433650
xor eax, eax
jmp 0x43367b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4336cd
mov ecx, 0x47dcc0
lea eax, [esp + 0x48]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4336ae
test dx, dx
je 0x4336aa
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4336ae
add eax, 4
add ecx, 4
test dx, dx
jne 0x433688
xor eax, eax
jmp 0x4336b3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4336cd
test byte [esp + 0x1c], 0x10
jne 0x4336cd
cmp dword [esp + 0x38], 0
jne 0x4336cd
mov edx, dword [esp + 0x3c]
add dword [esp + 0x10], edx
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x433642
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [edi - 0x10]
mov dword [esp + 0x280], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43370f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
jmp 0x43373a
lea eax, [edi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x280], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433738
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x278]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x264]
xor ecx, esp
call fcn.0043e4c7
mov esp, ebp
pop ebp
ret
Function at 0x433760
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4539b8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x48e050]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x491d10]
mov edx, dword [eax + 0xc]
mov ecx, 0x491d10
call edx
add eax, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 0x28], 0
mov ecx, dword [esi]
cmp dword [ecx - 0xc], 0
jne 0x4337d0
add eax, 0xfffffff0
mov dword [esp + 0x28], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x433906
lea edi, [esp + 0x10]
call fcn.0040d720
test eax, eax
je 0x4337e4
cmp dword [esp + 0x10], 0
jne 0x4337f8
mov ecx, esi
call fcn.00433560
push eax
mov dword [esp + 0x14], eax
call fcn.0040d7e0
add esp, 4
mov eax, esi
lea edi, [esp + 0xc]
call fcn.0042e780
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 0xc]
cmp ecx, 1
jge 0x433819
push 0x80070057
call fcn.00401950
movzx edx, word [eax + 2]
cmp dx, 0x3a
jne 0x4338ee
cmp ecx, 2
jge 0x433836
push 0x80070057
call fcn.00401950
movzx ecx, word [eax + 4]
cmp cx, 0x5c
jne 0x4338ee
lea edi, [esp + 0xc]
call fcn.004339d0
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x433882
lea eax, [esi - 0x10]
mov dword [esp + 0x28], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x433906
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
test eax, eax
jne 0x4338b3
cmp ecx, 0x6400000
jae 0x4338b3
lea ecx, [esp + 0xc]
call fcn.004014d0
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0xa
push eax
push ecx
call fcn.00446300
mov esi, dword [esp + 0x10]
xor ecx, ecx
cmp ecx, edx
jb 0x4338ce
ja 0x433896
cmp esi, eax
jae 0x433896
lea ecx, [esp + 0xc]
call fcn.004014d0
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
add eax, 0xfffffff0
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433912
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x433c30
Capabilities:
Create service
Get common file path
Query service status
Start service

Disassembly:
push ebp
lea ebp, [esp - 0x220]
sub esp, 0x220
push 0xfffffffffffffffe
push 0x489b88
push 0x441f50
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x48e050]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x21c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x24], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x40], ebx
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
push 0x104
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str._system32drivers_
push 0x104
lea ecx, [ebp]
push ecx
call fcn.0043f083
push str.BkavChkUI.sys
push 0x104
lea edx, [ebp]
push edx
call fcn.0043f083
add esp, 0x18
mov dword [ebp - 4], ebx
push 2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, ebx
je 0x433d5f
push 0xf01ff
push str.BkavChkUI
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, ebx
jne 0x433d38
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x433d5f
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp]
push eax
push 1
push 1
push 1
push 0xf01ff
push str.BkavChkUI
push str.BkavChkUI
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x433d5f
lea ecx, [ebp - 0x40]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 4
je 0x433d5f
cmp eax, 2
je 0x433d5f
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.00433d9b
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x21c]
xor ecx, ebp
call fcn.0043e4c7
add ebp, 0x220
mov esp, ebp
pop ebp
ret
Function at 0x433dc0
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
sub esp, 0x450
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x44c], eax
push ebx
push esi
push edi
mov edi, dword [0x49675c]
push 0x21a
xor ebx, ebx
lea ecx, [esp + 0x1a]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x20], ax
call fcn.004416b0
add esp, 0xc
push 0x21a
lea eax, [esp + 0x23a]
xor edx, edx
push ebx
push eax
mov word [esp + 0x240], dx
call fcn.004416b0
add esp, 0xc
call fcn.00433c30
push ebx
push ebx
push 3
push ebx
push 1
push 0x10000000
push str..BkavChkUI0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push ebx
push edi
push 0x433f60
push ebx
push ebx
mov dword [edi + 0x244], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x234
call fcn.0043ef53
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x433e9e
push 0x104
lea ecx, [esi + 0x14]
push ebx
push ecx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov byte [esi + 0x21c], bl
mov dword [esi + 0x220], ebx
mov dword [esi + 0x224], ebx
mov dword [esi + 0x22c], ebx
mov dword [esi + 0x228], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.004416b0
add esp, 0xc
jmp 0x433ea0
xor esi, esi
push ebx
push 0x434410
push str.BkavQueryGUIPort
xor ebx, ebx
mov dword [edi + 0x24c], esi
call fcn.00405080
push str.BkavCheckUIServer_123456
mov ecx, edi
call fcn.0043d0f0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
push str.szBkavDir
push str.SOFTWAREBkav
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push str.ProcessGuiHistory_List
push str.System
lea edx, [esp + 0x1c]
push edx
push str._s_s_s
lea eax, [esp + 0x244]
push 0x104
push eax
call fcn.0043ed50
add esp, 0x18
push 0x260
lea edx, [edi + 0x250]
mov ecx, str.PGHIS
lea eax, [esp + 0x238]
call fcn.00403510
mov ecx, dword [esp + 0x458]
pop edi
pop esi
lea eax, [ebx + 1]
pop ebx
xor ecx, esp
call fcn.0043e4c7
add esp, 0x450
ret
Function at 0x4341a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x48af00
push 0x441f50
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x48e050]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x480], ecx
xor ebx, ebx
mov dword [ebp - 0x478], 1
mov dword [ebp - 0x484], ebx
mov dword [ebp - 0x474], ebx
mov dword [ebp - 0x470], ebx
push 0x228
push ebx
lea edx, [ebp - 0x46c]
push edx
call fcn.004416b0
add esp, 0xc
mov dword [ebp - 4], ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x474], esi
cmp esi, 0xffffffff
jne 0x434249
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateToolhelp32Snapshot_error:__d
call fcn.00404c20
add esp, 8
jmp 0x4342ed
mov dword [ebp - 0x470], 0x22c
lea eax, [ebp - 0x470]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x434230
mov ecx, dword [ebp - 0x468]
push ecx
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x4342d0
lea esi, [ebp - 0x240]
call fcn.00406850
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x480]
push edx
mov eax, esi
push eax
call fcn.0043ec25
add esp, 8
test eax, eax
jne 0x4342ca
mov ecx, dword [ebp - 0x468]
push ecx
mov ecx, ebx
mov esi, dword [ebp - 0x47c]
call fcn.004340f0
test eax, eax
je 0x4342ca
mov eax, 1
mov esi, dword [ebp - 0x474]
jmp 0x4342e7
mov esi, dword [ebp - 0x474]
lea edx, [ebp - 0x470]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x434264
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x478], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.00434323
mov eax, dword [ebp - 0x478]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0043e4c7
mov esp, ebp
pop ebp
ret 4
Function at 0x434470
Capabilities:
Connect pipe
Create pipe

Disassembly:
sub esp, 0x20
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push 1
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x434521
push 0
push 0
push 1
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x434521
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
push eax
push 0x1388
push 0xc350
push 0xc350
push 0xff
push 6
push 0x40000003
lea edx, [esp + 0x28]
push str..pipeAkScanGUIPipe
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], edx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov ecx, dword [esp + 0x24]
mov dword [ecx + 0x248], eax
cmp eax, 0xffffffff
jne 0x434529
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateNamedPipe_SZ_NOTIFY_MANAGER_NAMED_PIPE_error:__d
call fcn.00404c20
add esp, 8
xor eax, eax
add esp, 0x20
ret 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x434551
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ConnectNamedPipe_failed_with__d
call fcn.00404c20
add esp, 8
xor eax, eax
add esp, 0x20
ret 4
push esi
call fcn.00435b80
add esp, 0x20
ret 4
Function at 0x434560
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [0x49675c]
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, eax
test ebx, ebx
jne 0x4345a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateEvent_pipe_report
call fcn.00404c20
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push edi
lea esi, [esp + 0x18]
mov dword [esp + 0x28], ebx
call fcn.00434470
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFileEx]
mov esi, eax
jmp 0x4345c0
push 1
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x4345f4
cmp eax, 0xc0
je 0x4345c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.WaitForSingleObjectEx___d_
call fcn.00404c20
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x434619
mov edx, dword [edi + 0x248]
push 0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x43469d
push 0x186c0
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4346b1
mov eax, dword [edi + 0x248]
push 0x434740
push esi
push 0xc350
lea ecx, [esi + 0x18]
push ecx
mov edx, eax
push edx
mov dword [esi + 0x14], eax
mov dword [esi + 0x186bc], 0
call ebp
test eax, eax
jne 0x43468e
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
test eax, eax
jne 0x43467d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DisconnectNamedPipe_failed_with__d
call fcn.00404c20
add esp, 8
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
lea esi, [esp + 0x18]
call fcn.00434470
jmp 0x4345b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ConnectNamedPipe___d_
call fcn.00404c20
add esp, 8
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435960
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, eax
test edi, edi
je 0x435b10
test esi, esi
je 0x435b10
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x435b10
mov ebx, dword [esp + 0x20]
mov eax, ebx
call fcn.004358e0
cmp dword [ebp], eax
jl 0x435b10
mov eax, 0x55555556
imul ebx
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [ecx*4]
mov eax, 0x6bca1af3
imul edx
sar edx, 5
xor ebp, ebp
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], ecx
lea eax, [ebp + 0x13]
mov dword [esp + 0x14], ebp
js 0x435a84
cmp ebp, ebx
jne 0x4359f3
mov edx, ebx
imul edx, edx, 0x4c
lea eax, [ecx*4]
sub eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
test eax, eax
jle 0x435a6c
mov ebp, eax
lea esp, [esp]
movzx ecx, byte [edi]
movzx edx, byte [edi + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [edi + 2]
shl ecx, 8
or ecx, edx
shl ecx, 8
mov edx, ecx
shr edx, 0x1a
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_B]
mov byte [esi], dl
shl ecx, 6
mov edx, ecx
shr edx, 0x1a
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_B]
shl ecx, 6
mov byte [esi + 1], dl
mov edx, ecx
shr edx, 0x1a
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_B]
shr ecx, 0x14
and ecx, 0x3f
mov byte [esi + 2], dl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_B]
mov byte [esi + 3], cl
add edi, 3
add esi, 4
sub ebp, 1
jne 0x435a00
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
inc ebp
cmp ebp, ebx
lea edx, [edx + eax*4]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebp
jle 0x4359da
lea eax, [ecx + ecx*2]
mov ecx, dword [esp + 0x20]
sub ecx, eax
je 0x435af9
lea ebp, [ecx + 1]
test ebp, ebp
je 0x435af9
xor eax, eax
test ecx, ecx
jle 0x435aa0
movzx eax, byte [edi]
inc edi
shl eax, 8
cmp ecx, 1
jle 0x435aae
movzx edx, byte [edi]
or eax, edx
inc edi
shl eax, 8
cmp ecx, 2
jle 0x435abb
movzx ecx, byte [edi]
or eax, ecx
shl eax, 8
test ebp, ebp
jle 0x435ada
mov ecx, ebp
mov edx, eax
shr edx, 0x1a
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_B]
mov byte [esi], dl
inc esi
shl eax, 6
sub ecx, 1
jne 0x435ac4
add dword [esp + 0x10], ebp
mov edi, 4
sub edi, ebp
test edi, edi
jle 0x435af5
push edi
push 0x3d
push esi
call fcn.004416b0
add esp, 0xc
add dword [esp + 0x10], edi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x435b20
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [0x496760]
push 0x485fb0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x435b3a
xor eax, eax
pop esi
ret
push str.SendReport
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 4], eax
test eax, eax
je 0x435b36
push eax
push str.m_pfnReport:__08X
call fcn.00404c20
add esp, 8
push 0
push 0
push 0
push 0x435f20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop esi
ret

Function at 0x435be0
Capabilities:
Connect pipe
Create pipe

Disassembly:
sub esp, 0x20
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push 1
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x435c89
push 0
push 0
push 1
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x435c89
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
push eax
push 0x1388
push 0x2710
push 0x2710
push 0xff
push 6
push 0x40000003
lea edx, [esp + 0x28]
push str..pipeR3p0rtM4n4g3rP1p3
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], edx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x435c91
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateNamedPipe_SZ_NOTIFY_MANAGER_NAMED_PIPE_error:__d
call fcn.00404c20
add esp, 8
xor eax, eax
add esp, 0x20
ret 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x435cb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ConnectNamedPipe_failed_with__d
call fcn.00404c20
add esp, 8
xor eax, eax
add esp, 0x20
ret 4
push esi
call fcn.00435b80
add esp, 0x20
ret 4