joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cd27a
Capabilities:
Set environment variable

Disassembly:
push 0xc4
mov eax, 0x6672a3
call fcn.005b47af
mov esi, ecx
mov dword [ebp - 0xbc], esi
lea eax, [ebp - 0x7c]
push eax
call fcn.004c407a
mov ecx, eax
call fcn.004cd085
lea eax, [ebp - 0x94]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.004c407a
mov ecx, eax
call fcn.004cd0a4
mov eax, dword [esi + 4]
mov ebx, dword [esi]
mov byte [ebp - 4], 1
mov dword [ebp - 0xc0], eax
jmp 0x4cd372
mov esi, ebx
lea edi, [ebp - 0xd0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0xc8], 0
mov esi, dword [ebp - 0xbc]
je 0x4cd36f
push dword [ebp - 0xc8]
lea eax, [ebp - 0x7c]
mov ecx, esi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004ccd72
push eax
lea ecx, [ebp - 0x58]
call fcn.0040bd4b
xor edi, edi
mov byte [ebp - 4], 2
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00409de7
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x40]
call fcn.0040bd70
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x58]
call fcn.0040c7e1
test eax, eax
je 0x4cd34f
mov ecx, dword [ebp - 0xc4]
lea eax, [ebp - 0x58]
push 0xffffffffffffffff
push edi
push eax
call fcn.0040a209
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.00409de7
push edi
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.00409de7
mov eax, dword [ebp - 0xc0]
add ebx, 0x10
cmp ebx, eax
jne 0x4cd2cd
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.004aeb3c
push eax
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.00411307
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 5
push ecx
mov ecx, eax
call fcn.00411b9c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
push ecx
mov ecx, eax
call fcn.004120c0
cmp dword [eax + 0x14], 8
jb 0x4cd3bb
mov eax, dword [eax]
mov edi, dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
push eax
push str.USERPROFILE
call edi
xor ebx, ebx
lea ecx, [ebp - 0x28]
push 0
inc ebx
push ebx
call fcn.00409de7
lea ecx, [ebp - 0x4c]
call fcn.00409ec4
push 0
push ebx
lea ecx, [ebp - 0x64]
call fcn.00409de7
lea ecx, [ebp - 0xa0]
call fcn.00409ec4
push 0
push ebx
lea ecx, [ebp - 0xb8]
call fcn.00409de7
push 0
push ebx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.00409de7
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.00471ffc
cmp dword [eax + 0x14], 8
jb 0x4cd424
mov eax, dword [eax]
push eax
push str.LOCALAPPDATA
call edi
push 0
push ebx
lea ecx, [ebp - 0x28]
call fcn.00409de7
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004819af
cmp dword [eax + 0x14], 8
jb 0x4cd44a
mov eax, dword [eax]
push eax
push str.APPDATA
call edi
xor esi, esi
lea ecx, [ebp - 0x28]
push esi
push ebx
call fcn.00409de7
push esi
push ebx
lea ecx, [ebp - 0x94]
call fcn.00409de7
push esi
push ebx
lea ecx, [ebp - 0x7c]
call fcn.00409de7
call fcn.005b4759
ret
Function at 0x4cf35f
Capabilities:
Enumerate device drivers on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x667950
mov eax, dword fs:[0]
push eax
mov eax, 0x1828
call fcn.005b4b80
mov eax, dword [0x72232c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x1830], ebx
mov dword [ebp - 0x1834], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
lea eax, [ebp - 0x182c]
mov dword [ebp - 4], ebx
push eax
push 0x1000
lea eax, [ebp - 0x1810]
mov dword [ebp - 0x1830], 1
push eax
mov dword [ebp - 0x182c], ebx
call sub.PSAPI.DLL_EnumDeviceDrivers
test eax, eax
je 0x4cf4bf
mov edi, dword [ebp - 0x182c]
cmp edi, 0x1000
jae 0x4cf4bf
shr edi, 2
test edi, edi
je 0x4cf4bf
push 0x400
lea eax, [ebp - 0x810]
push eax
push dword [ebp + ebx*4 - 0x1810]
call sub.PSAPI.DLL_GetDeviceDriverBaseNameW
test eax, eax
je 0x4cf4b6
and dword [ebp - 0x1818], 0
xor eax, eax
mov dword [ebp - 0x1814], 7
mov word [ebp - 0x1828], ax
cmp word [ebp - 0x810], ax
je 0x4cf44a
lea eax, [ebp - 0x810]
push eax
call fcn.005ff18e
pop ecx
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x1828]
call fcn.0040a315
push 0x699eac
mov dword [ebp - 4], 1
call fcn.005ff18e
pop ecx
push eax
push 0xffffffffffffffff
push 0x699eac
lea ecx, [ebp - 0x1828]
call fcn.0041203b
cmp eax, 0xffffffff
je 0x4cf495
push 0
push eax
lea ecx, [ebp - 0x1828]
call fcn.004264e5
lea eax, [ebp - 0x1828]
mov ecx, esi
push eax
call fcn.00411fb2
push 0
push 1
lea ecx, [ebp - 0x1828]
mov byte [ebp - 4], 0
call fcn.00409de7
inc ebx
cmp ebx, edi
jl 0x4cf3fa
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b4733
mov esp, ebp
pop ebp
ret 4

Function at 0x4cf8b3
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x72232c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x114
lea eax, [ebp - 0x118]
push esi
push 0
push eax
call fcn.005f3980
add esp, 0xc
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
mov ecx, dword [ebp - 0x114]
pop esi
cmp ecx, 0xa
jb 0x4cf902
push 3
pop eax
jmp 0x4cf927
cmp ecx, 6
jb 0x4cf91c
push 2
pop eax
cmp dword [ebp - 0x110], eax
jae 0x4cf927
cmp ecx, 6
jne 0x4cf91c
xor eax, eax
inc eax
jmp 0x4cf927
xor eax, eax
xor edx, edx
inc eax
cmp ecx, 5
cmove eax, edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b4733
mov esp, ebp
pop ebp
ret

Function at 0x4d0cb2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4d0cc0
mov eax, dword [eax]
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push str.taskbarpin
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg al
pop ebp
ret
Function at 0x4d1983
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4d1991
mov eax, dword [eax]
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push str.taskbarunpin
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg al
pop ebp
ret

Function at 0x4d594b
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0x10
mov eax, 0x668e43
call fcn.005b477b
xor ebx, ebx
push ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push 0x6c0528
push 1
push ebx
push 0x6c05f8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x4d5994
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, dword [ebp + 8]
mov dword [esi], ebx
jmp 0x4d5a20
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push str.ROOTCIMV2
mov byte [ebp - 4], 1
call fcn.004bcbf4
mov ecx, dword [eax]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x4d59b9
mov ecx, dword [ecx]
jmp 0x4d59bb
mov ecx, ebx
mov eax, dword [esi]
lea edx, [ebp - 0x10]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push esi
call dword [eax + 0xc]
mov ecx, dword [ebp - 0x18]
mov esi, eax
test ecx, ecx
je 0x4d59dd
call fcn.004bcd46
mov dword [ebp - 0x18], ebx
test esi, esi
jns 0x4d59fe
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], bl
mov dword [esi], ebx
test eax, eax
je 0x4d5a20
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4d5a20
push ebx
push ebx
push 3
push 3
push ebx
push ebx
push 0xa
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x4d59e1
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], ebx
mov dword [esi], eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4d5a31
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
call fcn.005b4744
ret 4
Function at 0x4dedb0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
lea esi, [ecx + 4]
test esi, esi
je 0x4dedee
mov edi, dword [ebp + 0xc]
lea ebx, [edi + 4]
test ebx, ebx
je 0x4dedee
call fcn.00413672
test al, al
je 0x4dedee
mov ecx, edi
call fcn.00413672
test al, al
je 0x4dedee
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
jmp 0x4dedf0
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4e0693
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x66acec
call fcn.005b481d
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x4e0710
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x4e0710
call fcn.00412e32
mov esi, eax
jmp 0x4e07e7
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4e0733
call fcn.00412e32
jmp 0x4e07da
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x4e0729
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x4e0763
mov esi, 0x8007000e
jmp 0x4e07dc
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.004df63a
jmp 0x4e0789
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x4e075c
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x41c]
push ebx
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x4e0729
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.004e0558
mov esi, eax
test edi, edi
je 0x4e07e7
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4e0800
lea ecx, [ebp - 0x418]
call fcn.004dfc27
mov eax, esi
call fcn.005b476a
ret 0x10
Function at 0x4e1fa4
Capabilities:
Check mutex on windows

Disassembly:
push esi
push edi
push str.F9450C66_1453_46BD_BB0A_9399377E94BA
push 0
push 0
mov edi, ecx
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
cmp byte [edi + 0x20], 0
jne 0x4e1ff1
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
cmp eax, 0xb7
je 0x4e1fd3
call esi
cmp eax, 5
jne 0x4e1ff1
push 0x3b
pop esi
mov ecx, edi
call fcn.004e23a6
test al, al
jne 0x4e1ff6
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
sub esi, 1
jns 0x4e1fd6
xor al, al
pop edi
pop esi
ret
mov al, 1
jmp 0x4e1ff3

Function at 0x4e1ffa
Capabilities:
Create service
Persist via windows service

Disassembly:
call fcn.0040ff0c
cmp dword [eax + 4], 0
jle 0x4e202c
call fcn.0040ff47
cmp byte [eax + 0x27], 0
je 0x4e202c
call fcn.004e2a36
mov ecx, eax
call fcn.004fa14b
test al, al
jne 0x4e202c
call fcn.004e2a36
mov ecx, eax
jmp fcn.004f99fe
ret

Function at 0x4e258e
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0x2d0
mov eax, 0x66b0a9
call fcn.005b47af
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
xor edi, edi
push edi
push edi
push 0x23
push edi
mov dword [ebp - 0x2dc], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 7
mov dword [ebp - 0x250], edi
xor eax, eax
pop ebx
mov edi, 0x68e2e8
mov dword [ebp - 0x24c], ebx
push edi
mov word [ebp - 0x260], ax
call fcn.005ff18e
pop ecx
push eax
push edi
lea ecx, [ebp - 0x260]
call fcn.0040a315
and dword [ebp - 4], 0
xor eax, eax
and dword [ebp - 0x238], 0
push edi
mov dword [ebp - 0x234], ebx
mov word [ebp - 0x248], ax
call fcn.005ff18e
pop ecx
push eax
push edi
lea ecx, [ebp - 0x248]
call fcn.0040a315
xor eax, eax
mov dword [ebp - 0x21c], ebx
xor ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
je 0x4e264a
lea eax, [ebp - 0x218]
push eax
call fcn.005ff18e
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040a315
mov edi, 0x6869a4
mov byte [ebp - 4], 2
push edi
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x2d8]
push eax
call fcn.0040bca5
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 3
push ecx
push eax
lea eax, [ebp - 0x2c0]
push eax
call fcn.00417c9a
push edi
push eax
lea eax, [ebp - 0x2a8]
mov byte [ebp - 4], 4
push eax
call fcn.0040bca5
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 5
push ecx
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.00417c9a
push 0x687b58
push eax
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 6
push eax
call fcn.0040bca5
add esp, 0x3c
xor edi, edi
lea ecx, [ebp - 0x290]
push ebx
inc edi
push edi
call fcn.00409de7
push ebx
push edi
lea ecx, [ebp - 0x2a8]
call fcn.00409de7
push ebx
push edi
lea ecx, [ebp - 0x2c0]
call fcn.00409de7
push ebx
push edi
lea ecx, [ebp - 0x2d8]
call fcn.00409de7
push ebx
push edi
lea ecx, [ebp - 0x230]
call fcn.00409de7
push ebx
push edi
lea ecx, [ebp - 0x248]
call fcn.00409de7
mov byte [ebp - 4], 0xe
push ebx
push edi
lea ecx, [ebp - 0x260]
call fcn.00409de7
lea eax, [ebp - 0x278]
mov ecx, esi
push eax
call fcn.00411307
push ebx
push edi
lea ecx, [ebp - 0x278]
call fcn.00409de7
mov eax, esi
call fcn.005b4759
ret
Function at 0x4e4948
Capabilities:
Acquire debug privileges

Disassembly:
push 0xdc
mov eax, 0x66b7d9
call fcn.005b47af
mov dword [ebp - 0x20], str.SeTakeOwnershipPrivilege
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], str.SeRestorePrivilege
mov dword [ebp - 0x18], str.SeDebugPrivilege
mov edi, dword [esi]
lea ecx, [ebp - 0x38]
push edi
call fcn.004078a3
and dword [ebp - 4], 0
lea eax, [ebp - 0x38]
push 1
push eax
call fcn.0059a421
pop ecx
pop ecx
mov bl, al
lea ecx, [ebp - 0x38]
neg bl
push 0
sbb bl, bl
or dword [ebp - 4], 0xffffffff
push 1
call fcn.00409de7
add bl, 1
jne 0x4e49b4
add esi, 4
lea ecx, [ebp - 0x14]
cmp esi, ecx
jne 0x4e496f
mov al, 1
jmp 0x4e4a15
xor ebx, ebx
lea ecx, [ebp - 0xe8]
inc ebx
push ebx
push 3
call fcn.004078ff
push edi
lea eax, [ebp - 0xd8]
mov dword [ebp - 4], ebx
push str.Failed_to_obtain_privilege_named
push eax
call fcn.00412133
pop ecx
pop ecx
push eax
call fcn.0040710b
pop ecx
pop ecx
lea eax, [ebp - 0xe8]
push eax
push str.Core::setPrivileges
push 0x11c
push str.D:_build6c589d3ff8507062_srccoreCore.cpp
push 0
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0xe8]
call fcn.0040843a
xor al, al
call fcn.005b4759
ret

Function at 0x4e60c6
Capabilities:
Create process on windows

Disassembly:
push 0x34
mov eax, 0x66bd04
call fcn.005b47af
mov eax, dword [ecx]
mov esi, dword [ebp + 8]
cmp dword [eax + 0xb4], 2
jne 0x4e6166
lea eax, [ebp - 0x28]
push eax
call fcn.0042a82f
mov ecx, eax
call fcn.004765f5
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
jne 0x4e6119
cmp dword [esi + 0x14], 8
jb 0x4e6106
mov esi, dword [esi]
push 5
push ebx
push ebx
push esi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4e6159
push esi
lea eax, [ebp - 0x40]
push 0x6871ec
push eax
call fcn.0042ab6c
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0040c677
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.00409de7
push ebx
push ebx
lea eax, [ebp - 0x28]
push 5
push eax
call fcn.0059a4b2
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00409de7
jmp 0x4e6181
cmp dword [esi + 0x14], 8
jb 0x4e616e
mov esi, dword [esi]
push 5
xor ebx, ebx
push ebx
push ebx
push esi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.005b4759
ret 4
Function at 0x4e655c
Capabilities:
Hide graphical window

Disassembly:
push 8
mov eax, 0x66be2d
call fcn.005b477b
mov esi, ecx
mov eax, dword [esi]
mov ebx, dword [ebp + 0xc]
mov al, byte [eax + 0x22]
test al, al
je 0x4e65c6
lea eax, [ebp - 0x14]
push eax
call fcn.0042a82f
mov ecx, eax
call fcn.004761ab
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.004566f6
pop ecx
pop ecx
test al, al
je 0x4e65b6
push 4
pop ebx
push ebx
lea ecx, [esi + 0x60]
call fcn.00466088
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [eax + 0x9c8]
call fcn.004571a3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4e65c6
call fcn.00418cb4
push ebx
lea ecx, [esi + 0x60]
call fcn.00467ea2
push dword [ebp + 8]
push dword [esi + 0x64]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
cmp byte [eax + 0x13e], 0
je 0x4e65f2
push 0
push 1
lea ecx, [esi + 0x60]
call fcn.00468e51
call fcn.005b4744
ret 8
Function at 0x4e791a
Capabilities:
Create pipe

Disassembly:
push 0xb0
mov eax, 0x66c184
call fcn.005b477b
mov esi, ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4e7936
mov eax, dword [eax]
push 0
push 0x1388
mov ecx, 0x2000
push ecx
push ecx
push 0xff
push 6
push 3
push eax
call dword [sym.imp.KERNEL32.DLL_CreateNamedPipeW]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
jne 0x4e79c0
push 1
push 3
lea ecx, [ebp - 0xbc]
call fcn.004078ff
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0xac]
push str.CreateNamedPipe__error
push eax
call fcn.00412133
pop ecx
pop ecx
mov ecx, eax
call fcn.004129b9
lea eax, [ebp - 0xbc]
push eax
push str.DataPipe::Create
push 0x1f
push str.D:_build6c589d3ff8507062_srccoreDataPipe.cpp
push 0
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0xbc]
call fcn.0040843a
xor al, al
jmp 0x4e79c2
mov al, 1
call fcn.005b4744
ret 4

Function at 0x4e7acb
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ecx + 0x10], 0
jne 0x4e7ad9
xor al, al
jmp 0x4e7b05
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push 0
push eax
push dword [esi]
push dword [ebp + 8]
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4e7afd
xor al, al
jmp 0x4e7b04
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4e7b17
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ecx + 0x10], 0
jne 0x4e7b25
xor al, al
jmp 0x4e7b43
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
setne al
mov esp, ebp
pop ebp
ret 8
Function at 0x4e7daf
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66c1e1
mov eax, dword fs:[0]
push eax
mov eax, 0x20d0
call fcn.005b4b80
mov eax, dword [0x72232c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
cmp byte [esi + 0x11], 0
je 0x4e7df5
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_ConnectNamedPipe]
xor ebx, ebx
inc ebx
jmp 0x4e7e97
cmp dword [esi + 0xc], edi
je 0x4e7ea1
lea eax, [ebp - 0x202c]
mov dword [ebp - 0x202c], 0x2000
push eax
lea eax, [ebp - 0x2010]
mov ecx, esi
push eax
call fcn.004e7acb
test al, al
je 0x4e7e8c
lea eax, [ebp - 0x2010]
push eax
lea ecx, [ebp - 0x2028]
call fcn.00407874
push edi
push dword [ebp - 0x202c]
lea ecx, [ebp - 0x2028]
mov dword [ebp - 4], edi
call fcn.0040b36d
cmp dword [esi + 0x14], edi
je 0x4e7e6c
sub esp, 0x18
lea eax, [ebp - 0x2028]
mov ecx, esp
push eax
call fcn.0040784e
call dword [esi + 0x14]
add esp, 0x18
lea eax, [ebp - 0x2028]
push eax
lea ecx, [esi + 0x18]
call fcn.004e7d39
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2028]
push edi
push ebx
call fcn.00409d92
push 0x12c
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp byte [esi + 0x10], 0
jne 0x4e7dfd
cmp byte [esi + 0x11], 0
je 0x4e7eb0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_DisconnectNamedPipe]
push ebx
push 3
lea ecx, [ebp - 0x20dc]
call fcn.004078ff
lea eax, [ebp - 0x20cc]
mov dword [ebp - 4], ebx
push str.Exit_work_loop.
push eax
call fcn.0040710b
pop ecx
pop ecx
lea eax, [ebp - 0x20dc]
push eax
push str.DataReceiver::run
push 0x7d
push str.D:_build6c589d3ff8507062_srccoreDataPipe.cpp
push ebx
call fcn.0040b02b
mov ecx, eax
call fcn.0041875b
lea ecx, [ebp - 0x20dc]
call fcn.0040843a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b4733
mov esp, ebp
pop ebp
ret

Function at 0x4e7f1b
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x72232c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x4e7f3f
push 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_ConnectNamedPipe]
cmp byte [esi + 0x10], 0
je 0x4e7fb4
push ebx
cmp dword [esi + 0xc], 0
je 0x4e7fb3
jmp 0x4e7f9c
lea eax, [ebp - 0x28]
push eax
lea ecx, [esi + 0x14]
call fcn.004e7ccc
mov ecx, eax
call fcn.004e7732
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040784e
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
push dword [ebp - 0xc]
cmovae eax, dword [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.004e7b17
lea ecx, [esi + 0x14]
call fcn.004e7d0f
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00409d92
cmp dword [esi + 0x24], 0
jne 0x4e7f4e
push 0x12c
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp byte [esi + 0x10], 0
jne 0x4e7f46
pop ebx
cmp byte [esi + 0x11], 0
je 0x4e7fc3
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_DisconnectNamedPipe]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005b4733
mov esp, ebp
pop ebp
ret
Function at 0x4edc33
Capabilities:
Persist via run registry key

Disassembly:
push 0x258
mov eax, 0x66d4e6
call fcn.005b47af
call fcn.0040afed
lea eax, [ebp - 0x254]
push eax
call fcn.004e258e
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.00414df1
mov bl, al
pop ecx
pop ecx
neg bl
lea ecx, [ebp - 0x23c]
sbb bl, bl
or dword [ebp - 4], 0xffffffff
call fcn.00409ec4
push edi
push 1
lea ecx, [ebp - 0x254]
call fcn.00409de7
add bl, 1
je 0x4edc8f
xor al, al
jmp 0x4edd8a
call fcn.004e2a36
mov ecx, eax
call fcn.004fa14b
test al, al
je 0x4edc88
call fcn.0040ff47
mov al, byte [eax + 0x27]
test al, al
je 0x4edc88
call fcn.0040ff0c
cmp dword [eax + 4], edi
jne 0x4edd88
mov dword [ebp - 0x260], edi
mov dword [ebp - 0x25c], edi
mov dword [ebp - 0x258], edi
xor eax, eax
mov dword [ebp - 4], 1
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 0x21c], 7
push esi
mov dword [ebp - 0x220], edi
mov word [ebp - 0x230], ax
call fcn.005ff18e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x230]
call fcn.0040a315
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push 0x2001f
cmovae eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x260]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004c2721
lea eax, [ebp - 0x264]
mov dword [ebp - 0x264], 0x104
push eax
lea eax, [ebp - 0x218]
push eax
push 0x68e2e8
lea ecx, [ebp - 0x260]
call fcn.004c2890
lea ecx, [ebp - 0x230]
push edi
push 1
test eax, eax
je 0x4edd78
call fcn.00409de7
lea ecx, [ebp - 0x260]
call fcn.004c23fc
jmp 0x4edc88
call fcn.00409de7
lea ecx, [ebp - 0x260]
call fcn.004c23fc
mov al, 1
call fcn.005b4759
ret