joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c4eda
Capabilities:
Accept command line arguments

Disassembly:
push 0x440
mov eax, 0x571dd5
call fcn.00513d1f
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x44c], esi
mov ecx, esi
push 0x5853c1
mov dword [ebp - 4], ebx
mov dword [ebp - 0x448], ebx
call fcn.00450b3c
mov dword [ebp - 4], ebx
mov dword [ebp - 0x448], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4c50ba
push 0x400
lea eax, [ebp - 0x410]
push eax
push ebx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x4c5065
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x428]
call fcn.00450b3c
xor ecx, ecx
lea eax, [ebp - 0x428]
inc ecx
cmp dword [ebp - 0x414], 0xf
push ecx
cmova eax, dword [ebp - 0x428]
push 0x58f5d4
push 0xffffffffffffffff
push dword [ebp - 0x418]
mov dword [ebp - 4], ecx
push eax
call fcn.004be06a
add esp, 0x14
cmp eax, 0xffffffff
je 0x4c5057
lea ecx, [ebp - 0x441]
inc eax
push ecx
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x440]
call fcn.004b6452
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x448], 3
call fcn.00455548
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x428]
call fcn.004551af
lea ecx, [ebp - 0x440]
call fcn.00455548
cmp dword [ebp - 0x414], 0xf
lea eax, [ebp - 0x428]
push 1
cmova eax, dword [ebp - 0x428]
push 0x586890
push ebx
push dword [ebp - 0x418]
push eax
call fcn.004a627e
add esp, 0x14
cmp eax, 0xffffffff
je 0x4c5057
lea ecx, [ebp - 0x441]
push ecx
push eax
push ebx
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x440]
call fcn.004b6452
lea eax, [ebp - 0x440]
mov dword [ebp - 0x448], 7
push eax
mov ecx, esi
call fcn.00451a5d
lea ecx, [ebp - 0x440]
call fcn.00455548
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], bl
call fcn.00455548
push str.Acrobat
mov ecx, esi
call fcn.0046b416
test al, al
jne 0x4c5085
push str.AcroRd32
mov ecx, esi
call fcn.0046b416
test al, al
je 0x4c50b3
call fcn.004cb294
test al, al
je 0x4c50b3
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.__typerenderer
push eax
call fcn.00517f83
pop ecx
pop ecx
test eax, eax
jne 0x4c50b3
push 6
push str.Broker
mov ecx, esi
call fcn.004558e5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.00513cce
ret 4
Function at 0x4cac3f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5665ca
mov eax, dword fs:[0]
push eax
mov eax, dword [0x5df440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xf
jbe 0x4cac6c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
leave
ret

Function at 0x4cb3c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 1
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4cb40e
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
test esi, esi
je 0x4cb408
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x4cb40e
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret

Function at 0x4cc036
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x56d501
call fcn.00513d1f
mov edi, ecx
mov eax, dword [ebp + 8]
push dword [edi + 8]
mov esi, dword [eax + 8]
push esi
push 1
push dword [eax + 4]
call fcn.00523399
add esp, 0x10
cmp eax, esi
jne 0x4cc067
call fcn.00513cce
ret 4
call fcn.0051a190
mov esi, dword [eax]
lea eax, [edi + 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004c7c59
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x40]
push str.Failed_writing_to_file
push eax
call fcn.004ab51f
add esp, 0x14
push esi
push eax
mov byte [ebp - 4], 1
call fcn.004cbdda
int3
Function at 0x4cd37c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [0x5ece07], 0
je 0x4cd395
cmp byte [ebp + 8], 0
je 0x4cd4b3
push esi
lea eax, [ebp - 0xc]
xor esi, esi
push eax
push 0x20019
push esi
push str.SOFTWAREAdobeAdobe_AcrobatDCInstaller_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4cd4ab
cmp dword [ebp - 0xc], esi
je 0x4cd4ab
push edi
push 4
pop edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], edi
cmp byte [0x5ece07], al
jne 0x4cd406
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
push str.bIsSingleClientApp
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4cd406
cmp dword [ebp - 8], edi
jne 0x4cd406
cmp dword [ebp - 4], esi
setne byte [0x5ece05]
cmp byte [0x5ece05], 0
je 0x4cd4a1
lea eax, [ebp - 0x10]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
push str.bIsSCAcroAppInstalled
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4cd444
cmp dword [ebp - 8], edi
jne 0x4cd444
cmp dword [ebp - 4], esi
setne byte [0x5ece04]
lea eax, [ebp - 0x10]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
push str.SCAPackageLevel
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4cd473
cmp dword [ebp - 8], edi
jne 0x4cd473
mov eax, dword [ebp - 4]
mov dword [0x5df2ec], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
push str.IsAcrInstalledInRdrMode
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4cd4a1
cmp dword [ebp - 8], edi
jne 0x4cd4a1
cmp dword [ebp - 4], esi
setne byte [0x5ece06]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov byte [0x5ece07], 1
pop esi
leave
ret
Function at 0x4d74c6
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x566bbe
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5df440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [edi], vtable.rna::messaging::NamedPipeChannelServer.0
call fcn.005442c0
cmp dword [edi + 0xc], 0xffffffff
je 0x4d7520
push 0xfa
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [edi + 0xac]
test ebx, ebx
je 0x4d753c
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x581450]
mov ecx, ebx
call esi
mov ebx, dword [edi + 0xb0]
test ebx, ebx
je 0x4d7558
mov eax, dword [ebx]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x581450]
mov ecx, ebx
call esi
lea ecx, [edi + 0xb4]
call fcn.0045b56b
lea esi, [edi + 0x94]
lea ecx, [esi + 0x14]
call fcn.0045b56b
mov ecx, esi
call fcn.004ac48e
lea ecx, [edi + 0x50]
call fcn.004ac6e5
lea ecx, [edi + 0x38]
call fcn.0045556e
lea ecx, [edi + 0x20]
call fcn.0045556e
mov dword [edi], vtable.rna::messaging::IpcChannelBase.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4e29e1
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x596e88]
xor byte [esi + ecx], al
inc esi
cmp esi, 0x27b
jb 0x4e29e5
pop edi
pop esi
mov byte [ecx + 0x27b], 0
mov eax, ecx
ret

Function at 0x4e2a0e
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x596e88]
xor byte [esi + ecx], al
inc esi
cmp esi, 0x22a
jb 0x4e2a12
pop edi
pop esi
mov byte [ecx + 0x22a], 0
mov eax, ecx
ret

Function at 0x4e2a3b
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x596e88]
xor byte [esi + ecx], al
inc esi
cmp esi, 0x134
jb 0x4e2a3f
pop edi
pop esi
mov byte [ecx + 0x134], 0
mov eax, ecx
ret

Function at 0x4e2a68
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x596e88]
xor byte [esi + ecx], al
inc esi
cmp esi, 0x132
jb 0x4e2a6c
pop edi
pop esi
mov byte [ecx + 0x132], 0
mov eax, ecx
ret

Function at 0x4e2a95
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x596e88]
xor byte [esi + ecx], al
inc esi
cmp esi, 0x74
jb 0x4e2a99
pop edi
pop esi
mov byte [ecx + 0x74], 0
mov eax, ecx
ret

Function at 0x4e2abc
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x596e88]
xor byte [esi + ecx], al
inc esi
cmp esi, 0x64
jb 0x4e2ac0
pop edi
pop esi
mov byte [ecx + 0x64], 0
mov eax, ecx
ret
Function at 0x4e2ae3
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x596e88]
xor byte [esi + ecx], al
inc esi
cmp esi, 0x25
jb 0x4e2ae7
pop edi
pop esi
mov byte [ecx + 0x25], 0
mov eax, ecx
ret

Function at 0x4e2b0a
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x596e88]
xor byte [esi + ecx], al
inc esi
cmp esi, 0x20
jb 0x4e2b0e
pop edi
pop esi
mov byte [ecx + 0x20], 0
mov eax, ecx
ret

Function at 0x4e2b31
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x596e88]
xor byte [esi + ecx], al
inc esi
cmp esi, 0x1d
jb 0x4e2b35
pop edi
pop esi
mov byte [ecx + 0x1d], 0
mov eax, ecx
ret

Function at 0x4e2b58
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x596e88]
xor byte [esi + ecx], al
inc esi
cmp esi, 0x18
jb 0x4e2b5c
pop edi
pop esi
mov byte [ecx + 0x18], 0
mov eax, ecx
ret

Function at 0x4e2b7f
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x596e88]
xor byte [esi + ecx], al
inc esi
cmp esi, 0x15
jb 0x4e2b83
pop edi
pop esi
mov byte [ecx + 0x15], 0
mov eax, ecx
ret

Function at 0x4e2ba6
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x596e88]
xor byte [esi + ecx], al
inc esi
cmp esi, 0x14
jb 0x4e2baa
pop edi
pop esi
mov byte [ecx + 0x14], 0
mov eax, ecx
ret

Function at 0x4e2bcd
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x596e88]
xor byte [esi + ecx], al
inc esi
cmp esi, 0xf
jb 0x4e2bd1
pop edi
pop esi
mov byte [ecx + 0xf], 0
mov eax, ecx
ret

Function at 0x4e2bf4
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x596e88]
xor byte [esi + ecx], al
inc esi
cmp esi, 0xa
jb 0x4e2bf8
pop edi
pop esi
mov byte [ecx + 0xa], 0
mov eax, ecx
ret

Function at 0x4e2c1b
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x596e88]
xor byte [esi + ecx], al
inc esi
cmp esi, 9
jb 0x4e2c1f
pop edi
pop esi
mov byte [ecx + 9], 0
mov eax, ecx
ret

Function at 0x4e2c42
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x596e88]
xor byte [esi + ecx], al
inc esi
cmp esi, 7
jb 0x4e2c46
pop edi
pop esi
mov byte [ecx + 7], 0
mov eax, ecx
ret
Function at 0x4e2c69
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x596e88]
xor byte [esi + ecx], al
inc esi
cmp esi, 5
jb 0x4e2c6d
pop edi
pop esi
mov byte [ecx + 5], 0
mov eax, ecx
ret

Function at 0x4e2c90
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor esi, esi
xor edx, edx
mov eax, esi
mov edi, 0x10e
div edi
mov al, byte [edx + 0x596e88]
xor byte [esi + ecx], al
inc esi
cmp esi, 4
jb 0x4e2c94
pop edi
pop esi
mov byte [ecx + 4], 0
mov eax, ecx
ret

Function at 0x4e33c1
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4e3421
push ebx
mov edx, 0x10000000
cmp eax, 0x7c
je 0x4e3420
cmp eax, 0x29
jne 0x4e3425
cmp dword [esi + 0x10], 0
jne 0x4e3420
test dword [esi + 0x50], edx
je 0x4e351d
cmp eax, 0x5d
jne 0x4e33fb
test dword [esi + 0x50], edx
je 0x4e3511
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004e2d3b
mov ecx, esi
call fcn.004e509b
mov ecx, esi
call fcn.004e50db
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x4e33cf
pop ebx
mov al, cl
pop esi
ret
cmp eax, 0x2e
jne 0x4e3436
push 5
lea ecx, [esi + 0x24]
call fcn.004e505d
jmp 0x4e3408
cmp eax, 0x5c
jne 0x4e3482
mov ecx, esi
call fcn.004e509b
test byte [esi + 0x50], 0x80
je 0x4e3479
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x4e3462
push 4
lea ecx, [esi + 0x24]
call fcn.004e505d
mov ecx, esi
call fcn.004e509b
jmp 0x4e3416
cmp al, 0x42
jne 0x4e3479
push 4
lea ecx, [esi + 0x24]
call fcn.004e505d
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x4e3459
mov ecx, esi
call fcn.004e3527
jmp 0x4e340f
cmp eax, 0x5b
jne 0x4e34a5
mov ecx, esi
call fcn.004e509b
mov ecx, esi
call fcn.004e3abe
push 4
push 0x5d
mov ecx, esi
call fcn.004e48f2
jmp 0x4e340f
cmp eax, 0x28
jne 0x4e34d2
mov ecx, esi
call fcn.004e509b
mov ecx, esi
call fcn.004e5606
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.004e48f2
test bl, bl
je 0x4e3416
jmp 0x4e340f
cmp eax, 0x5e
jne 0x4e34de
push 2
jmp 0x4e3451
cmp eax, 0x24
jne 0x4e34ea
push 3
jmp 0x4e3451
cmp eax, 0x2a
je 0x4e3515
cmp eax, 0x2b
je 0x4e3515
cmp eax, 0x3f
je 0x4e3515
cmp eax, 0x7b
je 0x4e3515
cmp eax, 0x7d
jne 0x4e33ed
test dword [esi + 0x50], edx
je 0x4e3519
jmp 0x4e33fb
push 4
jmp 0x4e351f
push 0xa
jmp 0x4e351f
push 6
jmp 0x4e351f
push 5
mov ecx, esi
call fcn.004e48bc
int3
Function at 0x4fae50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x5ed128], 0x12c
push ebx
push esi
push edi
mov esi, ecx
jg 0x4faf11
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x30]
push eax
call fcn.00544ae7
add esp, 0xc
lea edi, [esi + 0xc]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x4faee0
cmp dword [ebp - 4], 0
jne 0x4faee0
cmp byte [esi + 0x48], 0
lea eax, [ebp - 4]
je 0x4faea5
push eax
push edi
call fcn.00544c7d
pop ecx
pop ecx
test al, al
jne 0x4faeb8
jmp 0x4faee0
push 0x493e0
push eax
push edi
call fcn.00544cc9
add esp, 0xc
test al, al
je 0x4faf11
and dword [0x5ed128], 0
mov ebx, dword [esi + 0x14]
mov byte [esi + 0x48], 1
test ebx, ebx
je 0x4faee0
mov eax, dword [ebx]
push edi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x581450]
mov ecx, ebx
call esi
test al, al
jne 0x4faf0c
cmp dword [edi], 0xffffffff
je 0x4faef5
cmp dword [ebp - 4], 0
jne 0x4faf0c
push edi
call fcn.005449c1
or dword [edi], 0xffffffff
pop ecx
cmp dword [ebp - 4], 0
je 0x4faf0c
inc dword [0x5ed128]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebx
leave
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x513701
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.00528f4a
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x513740
sub eax, 1
je 0x51373b
sub eax, 1
je 0x513737
xor eax, eax
leave
ret
push 3
jmp 0x513742
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x514c23
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x514c62
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x514c62
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x514c62
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x514c62
cmp dword [ecx + 0x74], 0xe
jbe 0x514c62
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x533803
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00533679

Function at 0x5340a4
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00534026

Function at 0x535ed3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00535b50

Function at 0x53fff0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
xor ecx, ecx
push ecx
push esi
push 0x540070
push ecx
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
pop esi
leave
ret

Function at 0x5445d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
lea eax, [ebp - 4]
push eax
xor ecx, ecx
push ecx
push esi
push 0x5446f0
push ecx
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
pop esi
leave
ret
Function at 0x544a0e
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
or edi, 0xffffffff
cmp dword [ebx + 0x10], 0
jne 0x544a30
mov ecx, dword [ebp + 0x10]
or eax, edi
mov dword [ecx], 1
jmp 0x544ad2
mov eax, dword [ebp + 0x10]
xor edx, edx
mov ecx, 0xfa
push esi
mov dword [eax], 7
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
div ecx
mov esi, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x544a6e
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x581450]
mov ecx, dword [ebp + 0x14]
call esi
cmp eax, 6
je 0x544ac4
mov esi, dword [ebp - 4]
cmp dword [ebx + 0x14], 7
mov eax, ebx
jbe 0x544a78
mov eax, dword [ebx]
push 0
push 0x4110100
push 3
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x544ac9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp eax, 2
je 0x544aad
cmp eax, 0xe7
jne 0x544ad6
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
dec esi
mov dword [ebp - 4], esi
test eax, eax
jne 0x544a4d
jmp 0x544acf
cmp edi, 0xffffffff
je 0x544acf
mov eax, dword [ebp + 0x10]
and dword [eax], 0
mov eax, edi
pop esi
pop edi
pop ebx
leave
ret
lea eax, [ebp - 4]
push eax
call fcn.00544936
pop ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x544acf

Function at 0x544ae7
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
or ebx, 0xffffffff
push edi
mov edi, dword [ebp + 8]
mov dword [esi], 7
cmp dword [edi + 0x10], eax
jne 0x544b11
mov dword [esi], 1
jmp 0x544ba5
push eax
mov dword [ebp - 4], eax
xor ebx, ebx
lea eax, [ebp - 4]
inc ebx
push eax
push ebx
push str.S:_ML__NW___LW_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
mov eax, dword [ebp - 4]
and dword [ebp - 8], 0
cmp byte [0x5dfef4], 0
mov dword [ebp - 0xc], eax
mov eax, 0x80001
cmovne ebx, eax
mov dword [ebp - 0x10], 0xc
cmp dword [edi + 0x14], 7
jbe 0x544b4f
mov edi, dword [edi]
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, 0x400
push eax
push eax
push 0xff
push 8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push dword [ebp - 4]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp ebx, 0xffffffff
jne 0x544b92
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.00544936
pop ecx
mov dword [esi], eax
jmp 0x544ba5
cmp byte [0x5dfef4], 0
je 0x544ba2
mov byte [0x5dfef4], 0
and dword [esi], 0
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x544bac
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, eax
mov dword [esi], 7
cmp dword [ebx], 0xffffffff
jne 0x544bd5
mov dword [esi], 1
jmp 0x544c76
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x544c07
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp eax, 0xea
je 0x544c07
lea eax, [ebp - 0xc]
jmp 0x544c6d
cmp dword [ebp - 8], 0x1fffff
jbe 0x544c18
mov dword [esi], 3
jmp 0x544c76
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 1]
push eax
push dword [ebp - 8]
call fcn.004053b2
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
and dword [ebp - 0xc], 0
sub ecx, edi
push 0
push edx
mov eax, dword [eax]
push ecx
add eax, edi
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x544c5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
cmp eax, 0xea
jne 0x544c6a
add edi, dword [ebp - 0xc]
and dword [esi], 0
mov ecx, dword [ebp - 8]
cmp edi, ecx
jb 0x544c2a
jmp 0x544c76
lea eax, [ebp - 0x14]
push eax
call fcn.00544936
mov dword [esi], eax
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x544cc9
Capabilities:
Create thread

Disassembly:
push 0x1c
mov eax, 0x57a7d6
call fcn.00513cec
xor esi, esi
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x10]
push 0xc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
call fcn.00513938
pop ecx
test eax, eax
je 0x544d0f
mov edi, eax
lea esi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
jmp 0x544d11
mov eax, esi
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], esi
push ecx
push esi
push eax
push 0x5448a0
push esi
push esi
call fcn.0052550c
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x544d9a
push dword [ebp + 0xc]
mov dword [ebp - 4], 1
push ebx
call fcn.00544c7d
pop ecx
pop ecx
push dword [ebp - 0x10]
mov bl, al
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [ebp - 0x18], 0
je 0x544da1
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [ebp - 0x18], eax
jne 0x544d64
push 5
jmp 0x544da3
push esi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00500188
add esp, 0xc
test eax, eax
je 0x544d7b
push 2
jmp 0x544da3
push dword [ebp - 0x10]
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], 0
jne 0x544da8
mov al, bl
call fcn.00513cba
ret
mov dword [ebp - 0x18], esi
push 6
jmp 0x544da3
push 1
call fcn.0050054f
call fcn.00524b18
int3