joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d8b8
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x47c748]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0045d84d
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00436c10
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x45d907
cmp dword [ebp - 0x1c], 5
jb 0x45d91f
jmp 0x45d91b
cmp dword [ebp - 0x10], 1
jne 0x45d91f
cmp dword [ebp - 0x1c], 4
ja 0x45d91b
jne 0x45d91f
cmp dword [ebp - 0x18], 0
jbe 0x45d91f
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x46b10c
call fcn.0045d73e
test eax, eax
jge 0x45d940
mov byte [0x481bd0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004327b6
add ebp, 0x78
leave
ret
Function at 0x402970
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
mov eax, dword [0x467004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x200]
mov dword [ebp - 0x60], 0
push eax
push 4
mov esi, ecx
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push 0xc9
push dword [0x4690b4]
mov dword [ebp - 0x200], 0x1fc
mov dword [ebp - 0x1fc], esi
mov dword [ebp - 0x1f8], 1
mov dword [ebp - 0x1f4], 7
mov dword [ebp - 0x1f0], 0x8006
call dword [sym.imp.USER32.dll_LoadIconA]
movups xmm0, xmmword [str.Pageant__PuTTY_authentication_agent_]
mov ecx, dword [0x45849c]
mov ebx, eax
lea eax, [ebp - 0x200]
mov dword [ebp - 0x1c8], ecx
mov cl, byte [0x4584a0]
movups xmmword [ebp - 0x1e8], xmm0
push eax
movups xmm0, xmmword [0x45848c]
push 0
mov dword [ebp - 0x1ec], ebx
movups xmmword [ebp - 0x1d8], xmm0
mov byte [ebp - 0x1c4], cl
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov esi, eax
test ebx, ebx
je 0x402a36
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00433718
mov esp, ebp
pop ebp
ret
Function at 0x402a50
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x467004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4686e8], 0
push ebx
push esi
push edi
je 0x402c45
lea eax, [ebp - 0x118]
push eax
push str.SoftwareSimonTathamPuTTYSessions
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x402c45
push dword [0x4686b0]
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov esi, eax
cmp esi, dword [0x4686b8]
jle 0x402ac8
mov edi, dword [sym.imp.USER32.dll_RemoveMenu]
nop
push 0x400
push 0
push dword [0x4686b0]
call edi
dec esi
cmp esi, dword [0x4686b8]
jg 0x402ab0
xor esi, esi
xor edi, edi
call fcn.00431070
push 0x104
mov ebx, eax
lea eax, [ebp - 0x110]
push eax
push edi
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x402bea
mov dword [ebp - 0x114], 0x1000
nop
mov eax, str.Default_20Settings
lea ecx, [ebp - 0x110]
nop dword [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x402b30
test dl, dl
je 0x402b2c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x402b30
add ecx, 2
add eax, 2
test dl, dl
jne 0x402b10
xor eax, eax
jmp 0x402b35
sbb eax, eax
or eax, 1
test eax, eax
je 0x402bc8
xor edx, edx
mov ecx, ebx
call fcn.00430f20
mov edx, ebx
lea ecx, [ebp - 0x110]
call fcn.00431920
mov eax, dword [ebp - 0x114]
xorps xmm0, xmm0
mov dword [ebp - 0x138], eax
movlpd qword [ebp - 0x134], xmm0
movlpd qword [ebp - 0x12c], xmm0
movlpd qword [ebp - 0x120], xmm0
mov dword [ebp - 0x148], 0x30
mov dword [ebp - 0x144], 0x13
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0
mov eax, dword [ebx]
mov dword [ebp - 0x124], eax
lea eax, [ebp - 0x148]
push eax
push 1
push edi
push dword [0x4686b0]
call dword [sym.imp.USER32.dll_InsertMenuItemA]
inc edi
add dword [ebp - 0x114], 0x10
push 0x104
lea eax, [ebp - 0x110]
inc esi
push eax
push esi
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x402b00
mov ecx, ebx
call fcn.00431090
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x402c45
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], 0x30
push eax
push 1
push edi
push dword [0x4686b0]
mov dword [ebp - 0x144], 0x11
mov dword [ebp - 0x140], edi
mov dword [ebp - 0x13c], 3
mov dword [ebp - 0x124], str._No_sessions_
call dword [sym.imp.USER32.dll_InsertMenuItemA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00433718
mov esp, ebp
pop ebp
ret
Function at 0x4030a0
Capabilities:
Hide graphical window

Disassembly:
cmp dword [0x4686a8], 0
jne 0x4030d1
push 0
push 0x401d80
push 0
push 0xd3
push dword [0x4690b4]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 1
push eax
mov dword [0x4686a8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x403cc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
push 0
push edx
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x403d16
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00430620
push eax
push esi
push str.Failed_to_run___s_:__s
call fcn.004318b0
add esp, 0xc
mov esi, eax
push 0x30
push 0x458328
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, esi
pop esi
pop ebp
jmp fcn.00431220
pop esi
pop ebp
ret
Function at 0x404bb0
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x467004]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
xor edi, edi
mov byte [esp + 0xf], 0
or ebx, 0xffffffff
cmp byte [0x4686ee], 0
jne 0x404d26
lea eax, [esp + 0x20]
mov byte [0x4686ee], 1
push eax
push 0x106
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x404d26
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push edi
push edi
push eax
mov dword [esp + 0x28], eax
xorps xmm0, xmm0
lea eax, [esp + 0x2c]
movlpd qword [esp + 0x1c], xmm0
push eax
push str._sputty__lu__llu.chm
call fcn.004318b0
add esp, 0x14
mov edi, eax
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x404cbe
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x10], eax
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x404d26
mov ecx, edi
call fcn.00431220
mov eax, dword [esp + 0x10]
add eax, 1
mov dword [esp + 0x10], eax
adc esi, 0
push esi
push eax
push dword [esp + 0x24]
lea eax, [esp + 0x2c]
push eax
push str._sputty__lu__llu.chm
call fcn.004318b0
add esp, 0x14
mov edi, eax
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404c60
mov eax, dword [0x468708]
xor esi, esi
mov ecx, dword [0x4686fc]
mov dword [esp + 0x1c], ecx
test eax, eax
je 0x404d12
nop dword [eax]
nop word [eax + eax]
push 0
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 0
push edx
sub eax, esi
push eax
lea eax, [esi + ecx]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404d52
add esi, dword [esp + 0x10]
mov eax, dword [0x468708]
mov ecx, dword [esp + 0x1c]
cmp esi, eax
jb 0x404ce0
mov dword [0x468704], edi
xor edi, edi
mov byte [0x468701], 1
mov byte [esp + 0xf], 1
mov ecx, edi
call fcn.00431220
cmp ebx, 0xffffffff
je 0x404d39
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x12c]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00433718
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x404d26
Function at 0x4056e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x467004]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x418], edx
mov ebx, ecx
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x414], 0
call fcn.00430860
lea edx, [ebp - 0x414]
mov dword [ebp - 0x420], eax
mov ecx, eax
call fcn.0040e360
mov edi, eax
cmp edi, 0xffffffff
je 0x4057f2
mov ecx, ebx
call fcn.004310f0
mov ecx, dword [ebx + 8]
xor esi, esi
test ecx, ecx
je 0x405771
push 0
lea eax, [ebp - 0x410]
sub ecx, esi
push eax
mov eax, dword [ebx]
push ecx
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4057f2
add esi, dword [ebp - 0x410]
mov ecx, dword [ebx + 8]
cmp esi, ecx
jb 0x405744
call fcn.00431080
mov ebx, eax
nop dword [eax + eax]
push 0
lea eax, [ebp - 0x410]
push eax
push 0x400
lea eax, [ebp - 0x40c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4057f4
push dword [ebp - 0x410]
lea edx, [ebp - 0x40c]
mov ecx, ebx
call fcn.00405680
mov esi, eax
add esp, 4
test esi, esi
je 0x405780
cmp esi, 0xffffffff
je 0x4057f4
mov ecx, ebx
call fcn.004310c0
mov ecx, dword [ebp - 0x418]
xor ebx, ebx
mov dword [ecx], eax
mov eax, dword [ebp - 0x41c]
mov dword [eax], esi
mov ecx, dword [ebp - 0x414]
call fcn.00431220
mov ecx, dword [ebp - 0x420]
call fcn.00431220
jmp 0x405827
xor ebx, ebx
mov ecx, dword [ebp - 0x418]
mov eax, dword [ebp - 0x41c]
mov dword [ecx], 0
mov dword [eax], 0
mov ecx, dword [ebp - 0x414]
call fcn.00431220
mov ecx, dword [ebp - 0x420]
call fcn.00431220
cmp edi, 0xffffffff
je 0x40582e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x405839
mov ecx, ebx
call fcn.00431090
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00433718
mov esp, ebp
pop ebp
ret

Function at 0x405ab0
Capabilities:
Terminate process

Disassembly:
push esi
mov edx, ecx
mov ecx, dword [0x468724]
push 0
call fcn.00432320
mov esi, eax
add esp, 4
test esi, esi
jne 0x405ae2
push 0x10a
push str.C:Usersomahr_source_reposputty_caccodepageant.c
push str.priv___Public_and_private_trees_out_of_sync__
call fcn.00438224
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x405af0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
call fcn.00405a20
mov edi, eax
mov dword [ebp - 0x14], 1
push 0
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [ebp - 8], ecx
mov ecx, dword [0x468728]
mov dword [ebp - 4], edx
lea edx, [ebp - 0x14]
call fcn.00432320
add esp, 4
mov ecx, edi
mov esi, eax
call fcn.00431090
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405c00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x14]
push edi
mov dword [ebp - 0x14], 2
mov dword [ebp - 8], eax
call fcn.00405b50
mov ecx, dword [0x468728]
lea edx, [ebp - 0x14]
push 0
mov edi, eax
call fcn.00432320
add esp, 4
mov esi, eax
test edi, edi
je 0x405c47
mov ecx, edi
call fcn.00431090
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x408fb0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov eax, dword [esi + 8]
mov dword [esi + 4], 0
test eax, eax
je 0x408ff9
xor ecx, ecx
sub eax, ecx
push ebx
push eax
mov eax, dword [esi]
add eax, ecx
push 1
push eax
call fcn.0043d63c
push ebx
mov edi, eax
call fcn.0043836a
add esp, 0x14
test eax, eax
jne 0x40903b
test edi, edi
je 0x408ff9
mov ecx, dword [esi + 4]
add ecx, edi
mov dword [esi + 4], ecx
mov eax, dword [esi + 8]
cmp ecx, eax
jb 0x408fc7
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, dword [esi + 8]
jne 0x409017
push ebx
call fcn.00438e25
add esp, 4
mov ecx, 1
cmp eax, 0xffffffff
cmovne edi, ecx
mov ecx, dword [esi]
mov eax, edi
mov edx, dword [esi + 4]
add esi, 0xc
mov dword [esi], ecx
mov dword [esi + 8], edx
mov dword [esi + 4], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], esi
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
mov eax, 2
pop ebx
ret

Function at 0x40bdc0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 0xc], 0xc
test dl, dl
mov dword [ebp - 4], 0
mov ecx, 0x40080003
mov eax, dword [esi]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1000
push 0x1000
push 0xff
push 8
mov eax, 0x40000003
cmovne eax, ecx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
pop esi
setne al
mov esp, ebp
pop ebp
ret
Function at 0x40be40
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov al, dl
mov ebx, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [ebp - 1], al
test al, al
je 0x40be5e
mov byte [ebp - 1], 0
jmp 0x40be91
lea eax, [ebx + 0x10]
push eax
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x40be91
call edi
mov edi, eax
cmp edi, 0x3e5
je 0x40bf00
test edi, edi
je 0x40be8b
cmp edi, 0x217
jne 0x40bec9
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebx + 0x28]
mov esi, dword [ebx + 0xc]
push esi
push 0x40be20
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x10]
call eax
add esp, 0xc
test eax, eax
je 0x40beb3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor dl, dl
mov ecx, ebx
call fcn.0040bdc0
test al, al
je 0x40bec5
mov al, byte [ebp - 1]
jmp 0x40be54
call edi
mov edi, eax
mov ecx, edi
call fcn.00430620
push eax
push str.Error_while_listening_to_named_pipe:__s
call fcn.004318b0
mov ecx, dword [ebx + 8]
mov esi, eax
call fcn.0040c7d0
mov ecx, dword [ebx + 0x28]
push edi
push esi
push 0
mov edx, dword [ecx]
push eax
push 1
push ecx
mov eax, dword [edx]
call eax
add esp, 0x20
mov ecx, esi
call fcn.00431220
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40df60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
push 0
mov edx, 0x102c
mov ecx, 1
call fcn.00431190
add esp, 4
mov ebx, eax
push 0
push 0
push 0
mov dword [ebx + 4], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
mov dword [ebx], 0
call esi
cmp dword [0x467aec], 0xffffffff
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x1028], edi
mov word [ebx + 0x15], 0
mov byte [ebx + 0x14], 0
mov dword [ebx + 0x1c], eax
jne 0x40e001
push 0x468e00
mov dword [0x468df8], 0x468df8
mov dword [0x468dfc], 0x468df8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0
call esi
push 0
mov edx, 0x40df10
mov dword [0x467aec], eax
mov ecx, eax
call fcn.00405090
add esp, 4
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebx + 4]
push eax
push 0x40db10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40e025
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
mov byte [ebx + 0x17], 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e040
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov edx, 0x102c
push 0
mov ecx, 1
call fcn.00431190
add esp, 4
mov edi, eax
lea ebx, [edi + 4]
mov dword [ebx], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0
push 0
mov dword [edi], 1
call esi
mov dword [edi + 0x10], eax
lea ecx, [edi + 0x30]
mov eax, dword [ebp + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], eax
call fcn.00432c40
cmp dword [0x467aec], 0xffffffff
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0x40e5c0
mov dword [edi + 0x4c], edi
mov dword [edi + 0x1c], eax
jne 0x40e0f1
push 0x468e00
mov dword [0x468df8], 0x468df8
mov dword [0x468dfc], 0x468df8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0
call esi
push 0
mov edx, 0x40df10
mov dword [0x467aec], eax
mov ecx, eax
call fcn.00405090
add esp, 4
lea eax, [ebp - 4]
push eax
push 0
push ebx
push 0x40dce0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40e112
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e360
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 9
mov esi, ecx
mov dword [ebp - 4], edx
push str..pipe_
push esi
call fcn.0043d0f0
add esp, 0xc
test eax, eax
je 0x40e396
push 0x16
push str.C:Usersomahr_source_reposputty_caccodewindows_named_pipe_client.c
push str.strncmp_pipename___.pipe___9___0
call fcn.00438224
add esp, 0xc
lea eax, [esi + 9]
push 0x5c
push eax
call fcn.00434370
add esp, 8
test eax, eax
je 0x40e3bc
push 0x17
push str.C:Usersomahr_source_reposputty_caccodewindows_named_pipe_client.c
push str.strchr_pipename__9_____NULL
call fcn.00438224
add esp, 0xc
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40e418
call ebx
cmp eax, 0xe7
jne 0x40e463
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
test eax, eax
je 0x40e451
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40e3e2
call fcn.0042f930
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x40e48a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov ecx, eax
call fcn.00430620
push eax
push str.Unable_to_get_user_SID:__s
call fcn.004318b0
mov ecx, dword [ebp - 4]
add esp, 8
mov dword [ecx], eax
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call ebx
mov ecx, eax
call fcn.00430620
push eax
push esi
push str.Error_waiting_for_named_pipe__s:__s
jmp 0x40e473
call ebx
mov ecx, eax
call fcn.00430620
push eax
push esi
push str.Unable_to_open_named_pipe__s:__s
call fcn.004318b0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [ecx], eax
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 1
push 6
push edi
call dword [0x4690a8]
test eax, eax
je 0x40e4c2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov ecx, eax
call fcn.00430620
push eax
push str.Unable_to_get_named_pipe_security_information:__s
jmp 0x40e43a
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40e4ed
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
push str.Owner_of_named_pipe__s_is_not_us
jmp 0x40e43a
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, ecx
mov edi, edx
mov eax, dword [esi]
cmp eax, dword [edi]
je 0x4121a6
push 0xa6
push str.C:Usersomahr_source_reposputty_caccodecryptompint.c
push str.x0__nw__x1__nw
call fcn.00438224
add esp, 0xc
mov eax, dword [ebp + 8]
xor edx, edx
and eax, 1
neg eax
mov dword [ebp + 8], eax
cmp dword [esi], edx
jbe 0x4121d9
mov eax, dword [esi + 4]
mov ecx, dword [edi + 4]
mov eax, dword [eax + edx*4]
xor eax, dword [ecx + edx*4]
mov ecx, dword [ebp + 8]
and ecx, eax
mov eax, dword [esi + 4]
xor dword [eax + edx*4], ecx
mov eax, dword [edi + 4]
xor dword [eax + edx*4], ecx
inc edx
cmp edx, dword [esi]
jb 0x4121b7
pop edi
pop esi
pop ebp
ret

Function at 0x4123b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
cmp ebx, 0x3fffffff
jbe 0x4123db
push 0x106
push str.C:Usersomahr_source_reposputty_caccodecryptompint.c
push str.hex.len_____size_t_0____4
call fcn.00438224
add esp, 0xc
lea eax, [ebx*4 + 0x1f]
mov ecx, 1
shr eax, 5
cmp eax, ecx
cmova ecx, eax
call fcn.00411ff0
xor edx, edx
mov esi, eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], edx
test ebx, ebx
je 0x41247d
mov eax, dword [ebp + 8]
dec eax
add eax, ebx
mov dword [ebp - 8], eax
nop dword [eax + eax]
movsx edi, byte [eax]
mov ebx, 0x66
mov ecx, dword [ebp - 4]
sub ebx, edi
shr edx, 3
and ecx, 7
shl ecx, 2
lea eax, [edi - 0x61]
or ebx, eax
lea eax, [edi - 0x57]
xor eax, edi
shr ebx, 0x1f
dec ebx
and ebx, eax
mov eax, dword [esi + 4]
xor ebx, edi
lea esi, [eax + edx*4]
mov edx, 0x46
sub edx, edi
lea eax, [edi - 0x41]
or edx, eax
lea eax, [edi - 7]
shr edx, 0x1f
xor eax, ebx
dec edx
and edx, eax
mov eax, dword [ebp - 8]
xor edx, ebx
dec eax
and edx, 0xf
mov dword [ebp - 8], eax
shl edx, cl
or dword [esi], edx
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
inc edx
mov dword [ebp - 4], edx
cmp edx, dword [ebp + 0xc]
jb 0x412410
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x412690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
push edi
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0xffffffff
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 0xffffffff
push eax
xor edx, edx
mov dword [esp + 0x20], 0
call fcn.00412580
mov esi, dword [esp + 0x1c]
add esp, 0xc
xor edi, edi
mov ecx, 0x10
mov edx, esi
shr edx, cl
mov eax, edx
xor edx, esi
neg eax
shr eax, 0x1f
neg eax
and edx, eax
and eax, ecx
xor esi, edx
add edi, eax
shr ecx, 1
jne 0x4126d4
mov eax, dword [esp + 0xc]
shl eax, 5
inc eax
add eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov eax, edx
mov edx, dword [ebp + 8]
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
test edx, edx
je 0x412740
mov esi, edx
nop dword [eax + eax]
movzx ecx, byte [esi + edi - 1]
dec esi
xor ecx, 0x30
mov eax, esi
dec ecx
xor eax, edx
shr ecx, 0x1f
dec ecx
and ecx, eax
xor edx, ecx
test esi, esi
jne 0x412720
mov eax, dword [ebp - 4]
mov dword [ebp + 8], edx
xor ecx, ecx
mov dword [ebp - 8], ecx
test eax, eax
je 0x4127a5
push ebx
nop word [eax + eax]
mov ebx, edx
mov edi, 1
shr ebx, cl
and bl, 1
shl edi, cl
neg bl
cmp edi, eax
jae 0x412797
mov ecx, dword [ebp - 0xc]
mov esi, ecx
lea eax, [edi + ecx]
sub edi, ecx
nop
mov dl, byte [esi]
lea esi, [esi + 1]
mov cl, byte [eax]
lea eax, [eax + 1]
xor cl, dl
and cl, bl
xor dl, cl
mov byte [esi - 1], dl
xor byte [eax - 1], cl
lea ecx, [edi + esi]
cmp ecx, dword [ebp - 4]
jb 0x412770
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
inc ecx
shr eax, cl
test eax, eax
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 4]
jne 0x412750
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret