joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40685d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edi
push edi
add esp, 4
sub edi, 0xa1f0
or edi, 0xd960
add edi, 0x3c6e
pop edi
push edx
or edx, 0x153dc
call fcn.0040685d
add byte [edi + 0x44], al
dec edx
inc esp
cmp bh, byte [0x8333464d]
add esp, 4
pop edx
add esp, 4
pop edx
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push ecx
push edx
add esp, 4
add ecx, 0xcf05
xor ecx, 0xebf0
sub ecx, 0xc4cf
pop ecx
push edx
xor edx, 0xd187
pop edx
push esi
push edx
add esp, 4
jmp 0x4068e3
sub esi, 0x8381
pop esi
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x406907
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x406961
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x40682f
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x40682f
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x40694b
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x406955
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x4069aa
push edx
push eax
add esp, 4
jmp 0x406975
sub edx, 0x4637
or edx, 0x802d
pop edx
push ebx
push edx
add esp, 4
add ebx, 0x60b8
or ebx, 0x355d
pop ebx
push ebx
sub ebx, 0x437c
pop ebx
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x406a12
push ecx
or ecx, 0x3d04
sub ecx, 0xc612
or ecx, 0x2b00
and ecx, 0x48ec
pop ecx
push ecx
push eax
add esp, 4
add ecx, 0x18224
pop ecx
push esi
push eax
add esp, 4
and esi, 0xb0de
pop esi
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x406a08
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x4067d3
mov dword [ebp - 0x2a8], 0
Function at 0x4075fb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ebx, 0xc0aa
pop ebx
push ecx
jmp 0x40760b
add ecx, 0xd5a
and ecx, 0x5efd
and ecx, 0x12fae
pop ecx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x407694
Function at 0x438c91
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x438a14
add eax, 0x3ddeb420
push ebx
pop ebx
call fcn.00438cdb
dec ebx
mov ebx, 0x3f4734c
xor dword [ecx], esi
add eax, 0x8131dac6
inc ecx
sub ebx, 0x39b33d8d
and ebx, eax
sub eax, 0x977901b6
cmp ecx, edx
jne fcn.00438c91
add ebx, 0x825570a7
and eax, eax
and eax, eax
ret
Function at 0x1087e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1087e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1087e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1087e06a
add dl, dl
jne 0x1087e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1087e0dc
xor eax, eax
add dl, dl
jne 0x1087e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1087e17d
add dl, dl
jne 0x1087e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1087e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1087e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1087e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1087e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1087e075
mov eax, 1
add dl, dl
jne 0x1087e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1087e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1087e0e1
sub eax, ebx
mov ebx, 1
jne 0x1087e128
mov ecx, 1
add dl, dl
jne 0x1087e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1087e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1087e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1087e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1087e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1087e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1087e136
cmp eax, 0x7d00
jae 0x1087e16d
cmp eax, 0x500
jb 0x1087e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1087e075
cmp eax, 0x7f
ja 0x1087e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1087e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1087e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1087e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x417f70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x14000]
push edi
jmp 0x417f8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417f91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417f80
mov eax, 1
add ebx, ebx
jne 0x417fa3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417f98
jne 0x417fb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417f98
xor ecx, ecx
sub eax, 3
jb 0x417fc8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41803a
mov ebp, eax
add ebx, ebx
jne 0x417fd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417fe0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x418004
inc ecx
add ebx, ebx
jne 0x417ff0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417fe5
jne 0x418001
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417fe5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x418024
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x418015
jmp 0x417f86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x418024
add edi, ecx
jmp 0x417f86
pop esi
mov edi, esi
mov ecx, 0x315
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x418042
cmp byte [edi], 4
jne 0x418042
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x418047
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x4180bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x418074
mov ecx, edi
jns 0x4180a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1807c]
or eax, eax
je 0x4180b9
mov dword [ebx], eax
add ebx, 4
jmp 0x418091
call dword [esi + 0x1808c]
mov ebp, dword [esi + 0x18080]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4180f3
sub esp, 0xffffff80
jmp section.UPX0

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, reloc.winmm.dll_PlaySoundW
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4c4cb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x79000]
push edi
or ebp, 0xffffffff
jmp 0x4c4cd2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4c4cd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c4cc8
mov eax, 1
add ebx, ebx
jne 0x4c4ceb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4c4cfc
jne 0x4c4d1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c4d1b
dec eax
add ebx, ebx
jne 0x4c4d08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4c4ce0
add ebx, ebx
jne 0x4c4d17
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4c4d6d
xor ecx, ecx
sub eax, 3
jb 0x4c4d33
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4c4da2
sar eax, 1
mov ebp, eax
jmp 0x4c4d3e
add ebx, ebx
jne 0x4c4d3e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c4d0c
inc ecx
add ebx, ebx
jne 0x4c4d4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4c4d0c
add ebx, ebx
jne 0x4c4d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4c4d4e
jne 0x4c4d6a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4c4d4e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4c4d8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4c4d7e
jmp 0x4c4cce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4c4d8c
add edi, ecx
jmp 0x4c4cce
pop esi
mov edi, esi
mov ecx, 0x38bb
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4c4daa
cmp byte [edi], 0x13
jne 0x4c4daa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4c4daf
lea edi, [esi + 0xc0000]
mov eax, dword [edi]
or eax, eax
je 0x4c4e27
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc69b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc6b04]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4c4ddc
mov ecx, edi
jns 0x4c4e0b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc6b08]
or eax, eax
je 0x4c4e21
mov dword [ebx], eax
add ebx, 4
jmp 0x4c4df9
call dword [esi + 0xc6b18]
mov ebp, dword [esi + 0xc6b0c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4c4e5b
sub esp, 0xffffff80
jmp 0x417710
Function at 0x40109f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
nop
mov eax, 0x402021
push eax
mov eax, dword [ebp + 8]
push eax
call sub.msvcrt.dll_fopen
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov eax, 1
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.msvcrt.dll_fwrite
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call sub.msvcrt.dll_fclose
add esp, 4
mov eax, dword [ebp - 8]
leave
ret

Function at 0x4010ec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
nop
mov eax, 0x44
push eax
mov eax, 0
push eax
lea eax, [ebp - 0x54]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, 0x10
push eax
mov eax, 0
push eax
lea eax, [ebp - 0x10]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, 0x44
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0x8000000
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_CreateProcessA
cmp eax, 0
je 0x40118c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, 1
jmp 0x401191
mov eax, 0
leave
ret
Function at 0x401193
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
nop
mov eax, 0x18
push eax
mov eax, 0
push eax
lea eax, [ebp - 0x18]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, 0x402024
mov dword [ebp - 0x18], eax
mov eax, 0x402029
mov dword [ebp - 0x14], eax
mov eax, 0x402041
mov dword [ebp - 0x10], eax
mov eax, 0x451842
mov dword [ebp - 0xc], eax
mov eax, 0x451847
mov dword [ebp - 8], eax
mov eax, 0x451855
mov dword [ebp - 4], eax
mov eax, 0x20
push eax
mov eax, 0
push eax
lea eax, [ebp - 0x38]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, 0x17
mov dword [ebp - 0x38], eax
mov eax, 1
mov dword [ebp - 0x34], eax
mov eax, 0x4f800
mov dword [ebp - 0x30], eax
mov eax, 0xd
mov dword [ebp - 0x28], eax
mov eax, 1
mov dword [ebp - 0x24], eax
mov eax, 0xb84247
mov dword [ebp - 0x20], eax
mov eax, 0
mov dword [ebp - 0xa14], eax
mov eax, dword [ebp - 0xa14]
cmp eax, 2
jge 0x40138e
jmp 0x40125b
mov eax, dword [ebp - 0xa14]
inc eax
mov dword [ebp - 0xa14], eax
jmp 0x401238
mov eax, dword [ebp - 0xa14]
mov ecx, 0xc
imul eax, ecx
lea ecx, [ebp - 0x18]
add ecx, eax
mov eax, dword [ecx]
push eax
call sub.msvcrt.dll_getenv
add esp, 4
mov ecx, dword [ebp - 0xa14]
mov edx, 0xc
imul ecx, edx
lea edx, [ebp - 0x18]
add edx, ecx
add edx, 4
mov ecx, dword [ebp - 0xa14]
shl ecx, 4
mov dword [ebp - 0xa18], eax
lea eax, [ebp - 0x38]
add eax, ecx
mov ecx, dword [eax]
push ecx
mov eax, dword [edx]
push eax
call section..text
add esp, 8
push eax
mov eax, dword [ebp - 0xa18]
push eax
mov eax, 0xfd5a9d
push eax
lea eax, [ebp - 0x524]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x10
mov eax, dword [ebp - 0xa14]
mov ecx, 0xc
imul eax, ecx
lea ecx, [ebp - 0x18]
add ecx, eax
add ecx, 8
mov eax, dword [ebp - 0xa14]
shl eax, 4
lea edx, [ebp - 0x38]
add edx, eax
add edx, 8
mov eax, dword [edx]
push eax
mov eax, dword [ecx]
push eax
call section..text
add esp, 8
mov ecx, dword [ebp - 0xa14]
shl ecx, 4
lea edx, [ebp - 0x38]
add edx, ecx
add edx, 8
mov ecx, dword [edx]
push ecx
push eax
lea eax, [ebp - 0x524]
push eax
call fcn.0040109f
add esp, 0xc
mov eax, dword [ebp - 0xa14]
shl eax, 4
lea ecx, [ebp - 0x38]
add ecx, eax
add ecx, 4
mov eax, dword [ecx]
cmp eax, 0
je 0x401389
mov eax, 0xd
push eax
mov eax, 0xfd5aae
push eax
call section..text
add esp, 8
lea ecx, [ebp - 0x524]
push ecx
push eax
mov eax, 0xfd5aa3
push eax
lea eax, [ebp - 0xa10]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x10
lea eax, [ebp - 0xa10]
push eax
mov eax, 0
push eax
call fcn.004010ec
add esp, 8
jmp 0x40124c
mov eax, 0
leave
ret
Function at 0x401880
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4018b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
add eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff0000
je 0x40198c
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0
jmp 0x40192e
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x20]
jae 0x401983
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00401850
add esp, 8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jne 0x401981
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x30]
mov cx, word [eax + edx*2]
mov word [ebp - 4], cx
movzx edx, word [ebp - 4]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
jmp 0x4019aa
jmp 0x401925
mov dword [ebp - 0x10], 0
jmp 0x4019a7
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
sub eax, dword [edx + 0x10]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x40ce10
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529750
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x58d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 7
xor eax, eax
mov dword [ebp - 0x14], 7
push str.WGC_IPC
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00408b40
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
mov edx, str..pipe_
lea ecx, [ebp - 0x40]
call fcn.0041d0d0
add esp, 4
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x40ce90
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00408ce0
push 0
push 0
push 0
push 0
xor eax, eax
mov dword [ebp - 0x14], 7
cmp dword [ebp - 0x2c], 8
push 0xff
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push 0
push 0x80003
push eax
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
xor edx, edx
mov dword [ebp - 0x4c], eax
cmp eax, 0xffffffff
mov dword [ebp - 0x48], 0x4b2af0
mov cl, 1
movzx ecx, cl
sete bl
cmove ecx, edx
mov byte [ebp - 0x44], cl
test cl, cl
je 0x40cefc
push ecx
mov eax, esp
mov byte [ebp - 0x44], dl
lea ecx, [ebp - 0x4c]
mov dword [eax], ecx
call dword [ebp - 0x48]
add esp, 4
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x40cf11
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.00408ce0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c79eb
mov esp, ebp
pop ebp
ret
Function at 0x412b20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52a7c3
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x58d00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov eax, dword [ebp + 8]
mov dword [edi], vtable.Launcher.0
mov dword [edi + 4], eax
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov word [edi + 0x24], 0
mov byte [edi + 0x26], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0x4b2af0
mov byte [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0x4b2af0
mov byte [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov byte [ebp - 4], 3
mov dword [ebp + 8], ecx
call fcn.004aa460
lea ecx, [edi + 0x44]
mov byte [ebp - 4], 4
mov dword [ebp + 8], ecx
call fcn.004aa460
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov byte [ebp - 4], 7
lea esi, [edi + 0x5c]
mov dword [edi + 0x58], 2
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0041ca10
mov dword [esi], eax
mov byte [ebp - 4], 8
mov ecx, esi
push 0x550d04
push 0x550d00
mov word [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
call fcn.00424b80
push eax
add eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.00424c10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4167b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor bl, bl
push edi
cmp dword [esi], 0
je 0x4167c9
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
call fcn.0043a550
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp byte [esi + 8], 0
mov edi, eax
je 0x4167f5
push ecx
mov ecx, esp
mov byte [esi + 8], 0
mov dword [ecx], esi
mov eax, dword [esi + 4]
call eax
add esp, 4
mov dword [esi], edi
mov byte [esi + 8], 1
test edi, edi
jne 0x41680c
mov byte [esi + 8], 0
mov al, bl
pop edi
pop esi
pop ebx
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
movzx ebx, bl
mov ecx, 1
pop edi
cmovne ebx, ecx
pop esi
mov al, bl
pop ebx
pop ebp
ret 8
Function at 0x416b30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52af8e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x58d00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
call fcn.00416720
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x416b88
mov dword [ebp - 4], 0
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x416c03
lea ecx, [ebp - 0x18]
call fcn.004a1300
mov dword [ebp - 4], 2
mov ecx, dword [eax]
push str.Launcher::terminate
push 0x5bb
push str.srclauncher.cpp
mov eax, dword [ecx]
call dword [eax + 4]
push eax
mov edx, str.result
mov ecx, 0x550dd8
call fcn.0046a6a0
add esp, 0x10
mov dword [ebp - 4], 3
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x416c03
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x416c03
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x416c03
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x416b81
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52af8e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x58d00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
call fcn.00416720
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x416b88
mov dword [ebp - 4], 0
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x416c03
lea ecx, [ebp - 0x18]
call fcn.004a1300
mov dword [ebp - 4], 2
mov ecx, dword [eax]
push str.Launcher::terminate
push 0x5bb
push str.srclauncher.cpp
mov eax, dword [ecx]
call dword [eax + 4]
push eax
mov edx, str.result
mov ecx, 0x550dd8
call fcn.0046a6a0
add esp, 0x10
mov dword [ebp - 4], 3
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x416c03
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x416c03
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x416c03
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8