joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40492a
Capabilities:
Get session user name

Disassembly:
push ebx
push edi
push esi
sub esp, 0x220
mov eax, esp
mov esi, ecx
lea ebx, [esp + 0x20]
mov dword [eax], 0x100
push eax
push ebx
push 2
call sub.Secur32.dll_GetUserNameExW
test al, 1
je 0x40499c
lea edi, [esp + 4]
mov edx, esi
mov ecx, edi
push dword [esp]
push ebx
push 0x100
call fcn.00404a86
add esp, 0xc
mov eax, dword [edi]
lea ecx, [esp + 0xc]
mov dword [ecx], esi
mov dword [ecx + 4], eax
and dword [ecx + 8], 0
mov dword [ecx + 0xc], 1
mov byte [ecx + 0x10], 0x5c
call fcn.00410caf
mov ecx, eax
mov eax, edx
test ecx, ecx
push 6
pop edx
cmovne edx, eax
mov eax, str.unknow
cmovne eax, ecx
jmp 0x4049a4
push 6
pop edx
mov eax, str.unknow
add esp, 0x220
pop esi
pop edi
pop ebx
ret

Function at 0x4049ae
Capabilities:
Get session user name

Disassembly:
push ebx
push edi
push esi
sub esp, 0x224
mov eax, esp
mov esi, ecx
lea ebx, [esp + 0x22]
mov dword [eax], 0x100
push eax
push ebx
push 2
call sub.Secur32.dll_GetUserNameExW
test al, 1
je 0x404a29
lea edi, [esp + 4]
mov edx, esi
mov ecx, edi
push dword [esp]
push ebx
push 0x100
call fcn.00404a86
add esp, 0xc
mov eax, dword [edi]
lea edi, [esp + 0xc]
mov dword [edi], esi
mov ecx, edi
mov dword [edi + 4], eax
and dword [edi + 8], 0
mov dword [edi + 0xc], 1
mov byte [edi + 0x10], 0x5c
call fcn.00410caf
mov ecx, edi
call fcn.00410caf
mov ecx, eax
mov eax, edx
test ecx, ecx
push 6
pop edx
cmovne edx, eax
mov eax, str.unknow
cmovne eax, ecx
jmp 0x404a31
push 6
pop edx
mov eax, str.unknow
add esp, 0x224
pop esi
pop edi
pop ebx
ret

Function at 0x404ba0
Capabilities:
Initialize winsock library

Disassembly:
push esi
sub esp, 0x190
push 0x4310c0
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov eax, esp
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x404be4
cmp ax, 0x2734
je 0x404bde
movzx eax, ax
cmp eax, 0x2753
je 0x404be8
cmp eax, 0x276b
je 0x404bee
cmp eax, 0x276c
mov si, 0xe
jmp 0x404bf2
xor esi, esi
jmp 0x404bf2
mov si, 0x12
jmp 0x404bf2
mov si, 0x15
push 0x4310c0
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
mov eax, esi
add esp, 0x190
pop esi
ret
Function at 0x40910e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x88
mov edi, ecx
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push 0x12
push 0x68
push eax
push ecx
push edx
call sub.ntdll.dll_NtQueryInformationFile
test eax, eax
je 0x40914d
cmp eax, 0xc0000022
je 0x409270
cmp eax, 0x80000005
jne 0x40927c
and word [edi + 0x48], 0
xor eax, eax
cmp byte [esp + 0x55], 0
movsd xmm0, qword [esp + 0x58]
movsd xmm1, qword [esp + 0x48]
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
sete al
movsd qword [edi], xmm0
movsd qword [edi + 8], xmm1
lea eax, [eax + eax*2 + 2]
and al, 0xf
mov byte [edi + 0x40], al
mov eax, 0x2ac18000
add ecx, eax
mov eax, 0xfe624e21
adc esi, eax
mov eax, esi
sar eax, 0x1f
push 0x64
pop edx
imul edx
mov dword [esp + 8], eax
mov ebx, edx
mov eax, ecx
push 0x64
pop ecx
mul ecx
mov dword [esp + 4], eax
mov eax, esi
mov dword [esp + 0xc], edx
mov esi, dword [esp + 0x2c]
mul ecx
mov ecx, dword [esp + 4]
add eax, dword [esp + 0xc]
mov dword [edi + 0x10], ecx
mov ecx, dword [esp + 0x28]
adc edx, dword [esp + 8]
mov dword [edi + 0x14], eax
mov eax, 0x2ac18000
adc ebx, 0
add ecx, eax
mov eax, 0xfe624e21
mov dword [edi + 0x18], edx
adc esi, eax
mov dword [edi + 0x1c], ebx
mov eax, esi
sar eax, 0x1f
push 0x64
pop edx
imul edx
mov dword [esp + 8], eax
mov ebx, edx
mov eax, ecx
push 0x64
pop ecx
mul ecx
mov dword [esp + 4], eax
mov ecx, edx
mov eax, esi
push 0x64
pop edx
mul edx
mov esi, 0x2ac18000
add eax, ecx
mov ecx, dword [esp + 4]
adc edx, dword [esp + 8]
mov dword [edi + 0x24], eax
mov eax, 0xfe624e21
mov dword [edi + 0x20], ecx
adc ebx, 0
add esi, dword [esp + 0x18]
mov dword [edi + 0x28], edx
mov dword [edi + 0x2c], ebx
adc eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
sar eax, 0x1f
push 0x64
pop ecx
imul ecx
mov dword [esp + 8], eax
mov eax, esi
mov ebx, edx
mul ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
mov esi, edx
mul ecx
mov ecx, dword [esp + 4]
add eax, esi
adc edx, dword [esp + 8]
mov dword [edi + 0x34], eax
mov dword [edi + 0x30], ecx
adc ebx, 0
mov dword [edi + 0x38], edx
mov dword [edi + 0x3c], ebx
jmp 0x409282
push 0x14
pop ecx
mov esi, 0x42b670
rep movsd dword es:[edi], dword [esi]
jmp 0x409282
mov word [edi + 0x48], 0xe
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40a37f
Capabilities:
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [esp], ecx
mov ebx, dword [edx + 4]
mov ecx, dword [edx + 8]
lea eax, [edx + 0x10]
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov eax, dword [esp + 8]
mov edi, dword [esp + 4]
mov esi, ebx
cmp ebx, eax
jb 0x40a3f9
movzx eax, byte [edi + 0x410]
push eax
push 0
push 0
push 3
push 0x400
push dword [esp + 0x20]
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0
push dword [edi]
call sub.ntdll.dll_NtQueryDirectoryFile
mov byte [edi + 0x410], 0
mov esi, eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40a4bc
and dword [edi + 4], 0
test esi, esi
mov dword [edi + 8], eax
jne 0x40a4a5
lea ebp, [edi + esi + 0x6e]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x5e]
mov ecx, ebp
lea ebx, [eax + esi]
test eax, eax
mov eax, 0x400
cmove ebx, eax
mov dword [edi + 4], ebx
mov edi, dword [ebp - 0x22]
shr edi, 1
mov edx, edi
push 1
push 0x42bb72
call fcn.00409a58
pop ecx
pop edx
test al, 1
jne 0x40a39e
mov ecx, ebp
mov edx, edi
push 2
push 0x42bb74
call fcn.00409a58
pop ecx
pop edx
test al, 1
jne 0x40a39e
mov ebx, dword [esp + 4]
lea ecx, [esp + 0x18]
lea esi, [ebx + esi + 0x10]
add ebx, 0x411
mov edx, ebx
push edi
push ebp
push 0x2fd
call fcn.00404a86
add esp, 0xc
mov ecx, dword [esi + 0x38]
lea eax, [esp + 0x18]
mov eax, dword [eax]
bt ecx, 0xa
setae dl
or dl, 4
test cl, 0x10
movzx edx, dl
push 2
pop ecx
mov esi, dword [esp]
cmove ecx, edx
and word [esi + 0x10], 0
mov byte [esi + 0xc], 1
mov dword [esi], ebx
mov dword [esi + 4], eax
mov byte [esi + 8], cl
jmp 0x40a4dd
cmp esi, 0xc0000022
jne 0x40a4d4
push 5
pop ecx
mov edi, dword [esp]
mov esi, 0x42bae8
rep movsd dword es:[edi], dword [esi]
jmp 0x40a4dd
mov eax, dword [esp]
and dword [eax + 4], 0
and dword [eax], 0
and dword [eax + 0xc], 0
and dword [eax + 8], 0
and dword [eax + 0x10], 0
jmp 0x40a4dd
mov eax, dword [esp]
mov word [eax + 0x10], 0xe
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40aa4d
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
mov edi, edx
lea ebp, [esp + 4]
mov dword [esp], ecx
cmp byte [ebx + 8], 0
je 0x40aa8d
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
and dword [esp + 8], 0
and dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
and dword [esp + 0x18], 0
lea eax, [esp + 8]
jmp 0x40aa8f
xor eax, eax
push eax
push ebp
push dword [esp + 0x3c]
push esi
push edi
call sub.KERNEL32.dll_ReadFile
test eax, eax
jne 0x40aac9
call sub.KERNEL32.dll_GetLastError
cmp ax, 0x3e3
je 0x40aa65
movzx eax, ax
cmp eax, 0x26
je 0x40aabd
cmp eax, 0x40
je 0x40aad9
cmp eax, 0x6d
jne 0x40aae8
mov eax, dword [esp]
and dword [eax + 4], 0
and dword [eax], 0
jmp 0x40aaf1
mov eax, dword [esp + 4]
mov ecx, dword [esp]
mov dword [ecx], eax
and word [ecx + 4], 0
jmp 0x40aaf1
mov eax, dword [esp]
and dword [eax], 0
mov dword [eax + 4], 0x24
jmp 0x40aaf1
mov eax, dword [esp]
mov word [eax + 4], 0xe
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40aaf9
Capabilities:
Write file on windows

Disassembly:
push esi
push eax
mov esi, ecx
mov eax, esp
push 0
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
push edx
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x40ab23
mov eax, dword [esp]
mov dword [esi], eax
and word [esi + 4], 0
add esp, 4
pop esi
ret
call sub.KERNEL32.dll_GetLastError
cmp ax, 6
je 0x40ab61
movzx eax, ax
cmp eax, 8
je 0x40ab55
cmp eax, 0x21
je 0x40ab6d
cmp eax, 0x6d
je 0x40ab79
cmp eax, 0x3e3
je 0x40ab85
cmp eax, 0x6f8
je 0x40ab55
cmp eax, 0x718
jne 0x40ab91
and dword [esi], 0
mov dword [esi + 4], 0x15
jmp 0x40ab1e
and dword [esi], 0
mov dword [esi + 4], 0x5a
jmp 0x40ab1e
and dword [esi], 0
mov dword [esi + 4], 0x5b
jmp 0x40ab1e
and dword [esi], 0
mov dword [esi + 4], 0x20
jmp 0x40ab1e
and dword [esi], 0
mov dword [esi + 4], 0x1f
jmp 0x40ab1e
mov word [esi + 4], 0xe
jmp 0x40ab1e

Function at 0x40ac1b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov al, byte [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov edi, edx
mov dword [esp], ecx
and al, 0xf
cmp al, 2
sete bl
mov eax, dword [edi]
test bl, 1
je 0x40ac6b
mov dword [esp + 4], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 4]
push 0x42bb70
push ebp
push esi
call fcn.00409abf
add esp, 0xc
movzx eax, word [esp + 0x10]
movzx ecx, ax
jmp dword [ecx*4 + 0x42f208]
mov dword [esp + 8], eax
lea ecx, [esp + 8]
mov edx, esi
push ebp
call fcn.0040ad26
pop ecx
cmp ax, 0x1c
ja case.0x40ac85.9
movzx ecx, ax
jmp dword [ecx*4 + 0x42f194]
xor bl, 1
jmp 0x40ac3a
mov ecx, dword [esp]
mov word [ecx + 8], ax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp]
and dword [eax + 4], 0
and dword [eax], 0
and dword [eax + 8], 0
jmp 0x40ac98

Function at 0x40b76b
Capabilities:
Create pipe
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1f4
mov al, byte [ecx + 0x84]
mov ebp, ecx
lea edi, [ecx + 0x84]
cmp al, 1
je case.default.0x40b7f8
cmp byte [ebp + 0x85], 1
je case.default.0x40b7f8
cmp byte [ebp + 0x86], 1
jne 0x40b7eb
lea esi, [esp + 0x140]
mov edx, str.DeviceNull
mov ecx, esi
push 0x42bcc8
push 0xc
call fcn.0040987b
pop eax
pop ecx
movzx eax, word [esi + 4]
test ax, ax
jne 0x40be29
mov ebx, dword [esp + 0x140]
mov ecx, ebx
call fcn.0040e3d3
test ax, ax
jne 0x40be1f
mov al, 1
xor ecx, ecx
mov dword [esp + 0x20], eax
movzx eax, byte [edi]
jmp dword [eax*4 + 0x42f274]
movzx eax, al
mov dword [esp + 0x20], 0
xor ecx, ecx
jmp dword [eax*4 + 0x42f274]
Function at 0x40d9bd
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov ebx, dword [esp + 0x44]
mov ebp, edx
mov dword [esp], ecx
mov dword [esp + 0x1c], edx
mov eax, dword [ebx + 0xc]
mov esi, dword [ebx + 0x14]
mov ecx, eax
sub ecx, esi
cmp ecx, 0x1ff
ja 0x40daff
add esi, 0x200
mov di, 2
jb 0x40db5f
cmp eax, esi
jae 0x40daff
mov ecx, ebx
call fcn.0040def4
dec esi
push 0x20
pop eax
je 0x40da12
bsr eax, esi
xor eax, 0x1f
test ax, ax
je 0x40db5f
mov cl, 0x20
mov esi, dword [ebx + 0xc]
mov edx, dword [esp + 0x3c]
sub cl, al
xor ebp, ebp
mov eax, 0
inc ebp
shl ebp, cl
test cl, 0x20
cmovne ebp, eax
mov eax, dword [ebx]
test esi, esi
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
je 0x40da75
mov edx, dword [ebx + 8]
mov ecx, dword [esp + 4]
mov dword [esp + 0xc], edx
push dword [esp + 8]
push ebp
push 0
mov dword [esp + 0x24], esi
push esi
mov dword [esp + 0x20], eax
call dword [eax + 4]
add esp, 0x10
test al, 1
je 0x40da9f
mov eax, dword [esp + 0xc]
jmp 0x40daf5
mov edx, dword [esp + 4]
lea ecx, [esp + 0x24]
push dword [esp + 8]
push ebp
push eax
call fcn.0040df88
add esp, 0xc
movzx edi, word [esp + 0x28]
test di, di
jne 0x40db5f
mov eax, dword [esp + 0x24]
jmp 0x40daf5
mov ecx, dword [esp + 4]
mov edx, ebp
push dword [esp + 8]
push 0
mov eax, dword [esp + 0x18]
call dword [eax]
add esp, 8
test eax, eax
je 0x40db5f
mov edi, dword [esp + 0x18]
cmp ebp, edi
mov ecx, edi
cmovb ecx, ebp
push ecx
mov esi, dword [esp + 0x10]
push esi
push eax
mov dword [esp + 0x20], eax
call fcn.0040307b
add esp, 0xc
mov ecx, dword [esp + 4]
mov edx, esi
push dword [esp + 8]
push 0
push edi
mov eax, dword [esp + 0x1c]
call dword [eax + 8]
add esp, 0xc
mov eax, dword [esp + 0x14]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], ebp
mov ebp, dword [esp + 0x1c]
mov ecx, ebx
call fcn.0040dfc2
cmp edx, 0x1ff
ja 0x40db1c
mov ecx, ebx
call fcn.0040def4
mov ecx, ebx
call fcn.0040dfc2
push dword [esp + 0x40]
lea ecx, [esp + 0x24]
push ecx
push edx
push eax
push ebp
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x40db43
mov esi, dword [ebx + 0x14]
mov eax, dword [ebx + 0xc]
add esi, dword [esp + 0x20]
mov dword [ebx + 0x14], esi
jmp 0x40d9d7
call sub.KERNEL32.dll_GetLastError
cmp ax, 0x6d
je 0x40db67
movzx eax, ax
cmp eax, 0x3e5
jne 0x40db73
mov eax, dword [0x42bafc]
jmp 0x40db6c
mov eax, dword [esp]
mov word [eax], di
jmp 0x40db7b
mov eax, dword [0x42b580]
mov ecx, dword [esp]
mov dword [ecx], eax
jmp 0x40db7b
mov eax, dword [esp]
mov word [eax], 0xe
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40dfe3
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [0x431094]
mov esi, dword fs:[0x2c]
mov eax, dword [esi + eax*4]
mov eax, dword [eax + 0x210]
test eax, eax
jne 0x40e15f
mov dword [esp], ecx
mov ecx, dword fs:[0x2c]
mov edi, edx
mov eax, dword [0x431094]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x210], 1
lock inc byte [0x43109c]
push 0x431098
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov ebp, dword [eax + 0x20]
call sub.KERNEL32.dll_GetCurrentThreadId
mov ebx, eax
lea ecx, [esp + 8]
mov edx, str.thread__panic:
mov dword [ecx], ebp
push 7
call fcn.0040e1ae
pop ecx
test ax, ax
jne 0x40e1a2
push 0x1f
pop esi
push 0x64
pop ecx
cmp ebx, 0x64
jb 0x40e08d
mov eax, ebx
xor edx, edx
div ecx
movzx edx, word [edx + edx + str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899]
mov ebx, eax
mov word [esp + esi + 0xc], dx
add esi, 0xfffffffe
jmp 0x40e06e
cmp ebx, 9
ja 0x40e09c
add bl, 0x30
mov byte [esp + esi + 0xd], bl
inc esi
jmp 0x40e0a9
movzx eax, word [ebx + ebx + str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899]
mov word [esp + esi + 0xc], ax
lea ecx, [esp + esi + 0xc]
push 0x21
pop edx
sub edx, esi
push ebp
call fcn.0040e1f6
pop ecx
test ax, ax
jne 0x40e1a2
lea ebx, [esp + 4]
mov edx, 0x42bd21
mov ecx, ebx
mov dword [ebx], ebp
push 8
call fcn.0040e1ae
pop ecx
mov ecx, dword [esp]
test ax, ax
jne 0x40e1a2
mov edx, edi
push ebp
call fcn.0040e1f6
pop ecx
test ax, ax
jne 0x40e1a2
lea ecx, [esp + 0xc]
mov edx, 0x42bd2d
mov dword [ecx], ebp
push 1
call fcn.0040e1ae
pop ecx
test ax, ax
jne 0x40e1a2
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea esi, [esp + 0xc]
mov edx, str.Unable_to_dump_stack_trace:_debug_info_stripped_n
mov ecx, esi
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x20]
mov dword [esi], eax
push 0x30
call fcn.0040e1ae
pop ecx
push 0x431098
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
lock dec byte [0x43109c]
je 0x40e1a2
and dword [esp + 4], 0
and dword [esp + 0xc], 0
push 0
push 4
push esi
push ebx
call sub.ntdll.dll_RtlWaitOnAddress
jmp 0x40e14d
cmp eax, 1
jne 0x40e1a2
mov eax, dword [0x431094]
mov ecx, dword fs:[0x2c]
mov edx, str.Panicked_during_a_panic._Aborting._n
mov eax, dword [ecx + eax*4]
lea ecx, [esp + 0xc]
mov dword [eax + 0x210], 2
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x20]
mov dword [ecx], eax
push 0x23
call fcn.0040e1ae
pop ecx
test ax, ax
call 0x40e1a7
push 3
call sub.KERNEL32.dll_ExitProcess
Function at 0x40e43b
Capabilities:
Create pipe

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1b4
mov dword [esp + 4], edx
mov edi, ecx
call sub.KERNEL32.dll_GetCurrentProcessId
xor ebx, ebx
mov ebp, eax
lea eax, [esp + 0x134]
lea esi, [esp + 8]
lea ecx, [esp + 0x14]
mov edx, str..pipezig_childprocess_d_d
inc ebx
lock xadd dword [0x430004], ebx
mov dword [esi], eax
mov dword [esi + 4], 0x80
mov dword [esp], esi
mov dword [ecx], esi
and dword [esi + 8], 0
push 0x1a
call fcn.0040f94a
pop ecx
test ax, ax
jne 0x40e4e0
mov edx, esp
mov ecx, ebp
call fcn.0040a656
test ax, ax
jne 0x40e4e0
lea ecx, [esp + 0x18]
mov edx, 0x42bd79
mov dword [ecx], esi
push 1
call fcn.0040f94a
pop ecx
test ax, ax
jne 0x40e4e0
mov edx, esp
mov ecx, ebx
call fcn.0040a656
test ax, ax
jne 0x40e4e0
lea ecx, [esp + 0x1c]
mov edx, 0x42bd7d
mov dword [ecx], esi
push 1
call fcn.0040f94a
pop ecx
test ax, ax
je 0x40e5a2
lea ebp, [esp + 0x34]
lea esi, [esp + 0x20]
mov ecx, esi
mov edx, ebp
push ebx
push eax
call fcn.0040901b
pop eax
pop ecx
mov eax, dword [esi]
and word [esp + eax*2 + 0x34], 0
mov eax, 0x1000
push 0x42bce0
push 0
push eax
push eax
push 1
push 0
push 0x40000001
push ebp
call sub.KERNEL32.dll_CreateNamedPipeW
cmp eax, 0xffffffff
je 0x40e573
mov ebx, eax
mov eax, dword [0x42bce8]
movsd xmm0, qword [0x42bce0]
lea ecx, [esp + 0x28]
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
push 0
push 0x80
push 3
push ecx
push 0
push 0x40000000
push ebp
call sub.KERNEL32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x40e57a
mov ecx, ebx
mov esi, eax
call fcn.0040e3d3
test ax, ax
je 0x40e596
mov ebp, eax
push esi
call sub.ntdll.dll_NtClose
push ebx
call sub.ntdll.dll_NtClose
jmp 0x40e589
call sub.KERNEL32.dll_GetLastError
jmp 0x40e585
call sub.KERNEL32.dll_GetLastError
push ebx
call sub.ntdll.dll_NtClose
mov bp, 0xe
mov eax, ebp
add esp, 0x1b4
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 4]
mov dword [edi], ebx
xor ebp, ebp
mov dword [eax], esi
jmp 0x40e589
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 8]
dec ebx
jmp 0x40e4e0

Function at 0x40e964
Capabilities:
Get process heap force flags

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
call fcn.0040f767
mov dword [esp], edx
mov dword [esp + 4], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
xor edx, edx
mov eax, dword [eax + 0x10]
mov ebp, dword [eax + 0x48]
movzx ecx, word [ebp + edx*2]
cmp ecx, 0x3d
je 0x40e99a
test ecx, ecx
mov esi, edx
jne 0x40e99d
jmp 0x40ea08
lea esi, [edx + 1]
lea eax, [ebp + edx*2]
mov dword [esp + 0xc], eax
movzx edi, word [ebp + esi*2]
test edi, edi
je 0x40e9b6
cmp edi, 0x3d
je 0x40e9b6
inc esi
jmp 0x40e9a5
xor eax, eax
cmp di, 0x3d
sete al
xor ebx, ebx
add eax, esi
lea ecx, [ebp + eax*2]
mov dword [esp + 8], eax
cmp word [ecx + ebx*2], 0
lea ebx, [ebx + 1]
jne 0x40e9cb
mov eax, esi
mov ecx, dword [esp + 4]
sub eax, edx
mov edx, dword [esp]
push eax
push dword [esp + 0x10]
call fcn.0040f728
pop ecx
pop edx
mov edx, dword [esp + 8]
add edx, ebx
test al, 1
je 0x40e988
xor eax, eax
cmp di, 0x3d
sete al
dec ebx
add eax, esi
lea eax, [ebp + eax*2]
jmp 0x40ea0c
xor eax, eax
xor ebx, ebx
mov edx, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40f6a9
Capabilities:
Create process on windows

Disassembly:
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0x8000400
push 1
push 0
push 0
push edx
push ecx
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
je 0x40f6d2
xor eax, eax
ret
call sub.KERNEL32.dll_GetLastError
movzx eax, ax
lea ecx, [eax - 0xbc]
cmp ecx, 0xf
jae 0x40f6ea
mov ax, 0x6d
ret
lea ecx, [eax - 2]
cmp ecx, 2
jb 0x40f714
cmp eax, 5
je 0x40f719
cmp eax, 0xb
je 0x40f6e5
cmp eax, 0x7b
je 0x40f71e
cmp eax, 0xce
je 0x40f723
cmp eax, 0xd8
je 0x40f6e5
mov ax, 0xe
ret
mov ax, 8
ret
mov ax, 9
ret
mov ax, 0x70
ret
mov ax, 0xb
ret

Function at 0x40fb4e
Capabilities:
Set file attributes

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x40]
test byte [esp + 0x45], 2
mov esi, ecx
mov ecx, 0x200040
mov edi, 0x200001
cmove edi, ecx
lea ecx, [eax + eax]
mov word [esp + 8], cx
mov word [esp + 0xa], cx
mov dword [esp + 0xc], edx
cmp word [edx], 0x2e
jne 0x40fba3
movzx ecx, word [edx + 2]
cmp ecx, 0x2e
je 0x40fb98
test ecx, ecx
jne 0x40fba3
and word [esp + 8], 0
jmp 0x40fba3
cmp word [edx + 4], 0
je 0x40fc98
lea ebx, [esp + 0x18]
mov ecx, edx
mov edx, eax
mov dword [ebx], 0x18
call fcn.0040ab99
xor ecx, ecx
test al, 1
lea eax, [esp + 8]
cmovne esi, ecx
mov dword [ebx + 4], esi
and dword [ebx + 0xc], 0
mov dword [ebx + 8], eax
and dword [ebx + 0x10], 0
and dword [ebx + 0x14], 0
lea esi, [esp + 0x10]
mov eax, esp
push 0
push 0
push edi
push 1
push 7
push 0
push 0
push esi
push ebx
push 0x110000
push eax
call sub.ntdll.dll_NtCreateFile
cmp eax, 0xc0000022
je 0x40fcb2
mov ecx, eax
mov ax, 8
cmp ecx, 0xc0000034
je 0x40fcd2
cmp ecx, 0xc000003a
je 0x40fcd2
cmp ecx, 0xc0000043
je 0x40fc98
cmp ecx, 0xc0000056
je 0x40fc8e
cmp ecx, 0xc00000ba
je 0x40fca4
cmp ecx, 0xc00000be
je 0x40fc92
cmp ecx, 0xc00000cc
je 0x40fc92
cmp ecx, 0xc0000103
je 0x40fc9e
test ecx, ecx
jne 0x40fcce
lea eax, [esp + 4]
mov byte [eax], 1
push 0xd
push 1
push eax
push esi
push dword [esp + 0x10]
call sub.ntdll.dll_NtSetInformationFile
cmp eax, 0xc0000022
je 0x40fcaa
cmp eax, 0xc00000a2
je 0x40fcaa
cmp eax, 0xc0000101
je 0x40fcb8
cmp eax, 0xc0000121
je 0x40fcaa
test eax, eax
jne 0x40fcc6
push dword [esp]
call sub.ntdll.dll_NtClose
xor eax, eax
jmp 0x40fcd2
mov ax, 0xf
jmp 0x40fcd2
mov ax, 0x1c
jmp 0x40fcd2
mov ax, 0x19
jmp 0x40fcd2
mov ax, 0x17
jmp 0x40fcd2
push dword [esp]
call sub.ntdll.dll_NtClose
mov ax, 9
jmp 0x40fcd2
push dword [esp]
call sub.ntdll.dll_NtClose
mov ax, 0x6c
jmp 0x40fcd2
push dword [esp]
call sub.ntdll.dll_NtClose
mov ax, 0xe
add esp, 0x30
pop esi
pop edi
pop ebx
ret

Function at 0x40fcd9
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, edx
mov edi, ecx
xor ebx, ebx
mov ebp, edx
cmp ebx, esi
jae 0x40fcfc
push ebp
push edi
call sub.ADVAPI32.dll_SystemFunction036
test eax, eax
je 0x40fd00
add ebx, ebp
add edi, ebp
xor ebp, ebp
jmp 0x40fce5
xor eax, eax
jmp 0x40fd09
call sub.KERNEL32.dll_GetLastError
mov ax, 0xe
pop esi
pop edi
pop ebx
pop ebp
ret