joyce8/EMBER2024-capa huggingface dataset:
Function at 0x550910
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x601018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi], ebx
jne 0x550a0f
push edi
mov edi, 1
cmp dword [esi + 4], edi
je 0x55097b
call fcn.00550b00
cmp dword [esi + 4], edi
jne 0x550962
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x55095c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov dword [esi + 0x18], ebx
mov dword [esi + 4], ebx
pop edi
mov dword [esi], 0x17a8c
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00596083
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x404]
mov edx, str..pipe_
mov ecx, eax
mov dword [esi + 8], edi
sub edx, ecx
lea ecx, [ecx]
mov cl, byte [edx + eax]
cmp cl, bl
je 0x5509a2
mov byte [eax], cl
add eax, edi
lea ecx, [ebp - 5]
cmp eax, ecx
jb 0x550990
mov byte [eax], bl
mov ebx, dword [ebp + 8]
push 0x400
lea eax, [ebp - 0x404]
call fcn.00401570
add esp, 4
push 0
push 0
push 0x10000
push 0x10000
push edi
push 0
push 0x40000003
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 0x14], eax
cmp eax, 0xffffffff
jne 0x550a07
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, esi
call fcn.00550790
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00596083
mov esp, ebp
pop ebp
ret 4
mov dword [esi + 4], 2
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00596083
mov esp, ebp
pop ebp
ret 4

Function at 0x550a30
Capabilities:
Connect pipe

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
cmp dword [esi], ebx
jne 0x550afc
cmp dword [esi + 4], 2
je 0x550a74
call fcn.00550b00
cmp dword [esi + 4], 1
jne 0x550a6b
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x550a65
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov dword [esi + 0x18], ebx
mov dword [esi + 4], ebx
mov dword [esi], 0x17a8d
pop esi
pop ebx
ret
lea eax, [esi + 0x1c]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
push edi
mov dword [eax + 0x10], ecx
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
push eax
push edx
mov dword [esi + 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x550acc
call fcn.00550b00
cmp dword [esi + 4], 1
jne 0x550ac6
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x550ac0
call edi
mov dword [esi], eax
mov dword [esi + 0x18], ebx
mov dword [esi + 4], ebx
mov dword [esi], 0x17a8e
call edi
cmp eax, 0x3e5
jne 0x550ae0
pop edi
mov dword [esi + 4], 3
pop esi
pop ebx
ret
cmp eax, 0x217
jne 0x550af2
pop edi
mov dword [esi + 4], 4
pop esi
pop ebx
ret
mov edi, eax
mov eax, esi
call fcn.00550790
pop edi
pop esi
pop ebx
ret
Function at 0x550bd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov esi, eax
test ebx, ebx
jle 0x550c97
cmp dword [esi + 4], 4
je 0x550bf3
mov eax, esi
call fcn.005507c0
xor ecx, ecx
cmp dword [esi], ecx
jne 0x550c86
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
lea eax, [esi + 0x1c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov edx, dword [esi + 0x18]
push eax
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
mov dword [esi + 0x2c], edx
mov edx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
push ecx
mov ecx, dword [esi + 0x14]
lea eax, [edi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x550c3c
mov eax, dword [ebp - 4]
jmp 0x550c88
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x3e5
jne 0x550c58
mov eax, esi
call fcn.005507c0
mov ebx, dword [ebp + 0xc]
jmp 0x550c88
call fcn.00550b00
cmp dword [esi + 4], 1
jne 0x550c81
mov edx, dword [esi + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x550c79
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 4], eax
mov dword [esi], ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
cmp dword [esi], 0
jne 0x550c97
add edi, eax
cmp edi, ebx
jl 0x550be6
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x550cb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov esi, eax
test ebx, ebx
jle 0x550d77
cmp dword [esi + 4], 4
je 0x550cd3
mov eax, esi
call fcn.005507c0
xor ecx, ecx
cmp dword [esi], ecx
jne 0x550d66
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
lea eax, [esi + 0x1c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov edx, dword [esi + 0x18]
push eax
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
mov dword [esi + 0x2c], edx
mov edx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
push ecx
mov ecx, dword [esi + 0x14]
lea eax, [edi + edx]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x550d1c
mov eax, dword [ebp - 4]
jmp 0x550d68
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x3e5
jne 0x550d38
mov eax, esi
call fcn.005507c0
mov ebx, dword [ebp + 0xc]
jmp 0x550d68
call fcn.00550b00
cmp dword [esi + 4], 1
jne 0x550d61
mov edx, dword [esi + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x550d59
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 4], eax
mov dword [esi], ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
cmp dword [esi], 0
jne 0x550d77
add edi, eax
cmp edi, ebx
jl 0x550cc6
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x550fc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push edi
mov edi, dword [sym.imp.MSVCR100.dll_abort]
cmp dword [ebp + 8], ebx
jne 0x550fe9
push str.ERROR_15112:_readline_called_with_invalid_parameters
mov ecx, 0x610240
call fcn.00504670
add esp, 4
call edi
mov eax, dword [esi + 0x818]
cmp eax, ebx
je 0x551005
mov ecx, dword [esi + 0x81c]
cmp ecx, eax
jb 0x551005
cmp ecx, dword [esi + 0x820]
jbe 0x551019
push str.ERROR_15111:_invalid_readline_buffer_state_detected
mov ecx, 0x610240
call fcn.00504670
add esp, 4
call edi
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ebx
mov edi, edx
mov eax, dword [esi + 0x81c]
cmp eax, dword [esi + 0x820]
jae 0x551071
test ebx, ebx
jle 0x551046
mov eax, dword [esi + 0x81c]
cmp byte [eax], 0xa
jne 0x551042
test ebx, ebx
je 0x551046
mov byte [eax], 0x58
dec ebx
cmp dword [ebp - 4], 0
mov eax, dword [esi + 0x81c]
jne 0x551132
cmp byte [eax], 0xd
jne 0x5510c9
inc eax
mov dword [esi + 0x81c], eax
mov dword [ebp - 4], 1
cmp eax, dword [esi + 0x820]
jb 0x55102f
mov eax, dword [esi + 0x818]
mov edx, dword [esi + 0x400]
push 0
lea ecx, [ebp - 8]
push ecx
push 0x10000
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5510ef
mov ecx, dword [ebp - 8]
mov dword [esi + 0x404], 0
test ecx, ecx
jne 0x55110c
mov dword [esi + 0x408], 1
mov eax, edi
sub eax, dword [ebp + 8]
mov dword [esi + 0x408], 1
mov byte [edi], 0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, byte [eax]
cmp al, 0xa
je 0x55115c
cmp al, 0xc
je 0x55114d
lea ecx, [edx + 0x3ff]
cmp edi, ecx
jae 0x55113e
mov byte [edi], al
inc edi
inc dword [esi + 0x81c]
jmp 0x551021
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 8]
mov dword [esi + 0x404], eax
mov dword [esi + 0x408], 1
test ecx, ecx
je 0x5510af
mov eax, dword [esi + 0x818]
mov edx, dword [ebp + 8]
mov dword [esi + 0x81c], eax
add eax, ecx
mov dword [esi + 0x408], 0
mov dword [esi + 0x820], eax
jmp 0x551021
cmp byte [eax], 0xa
jne 0x55113e
inc eax
mov dword [esi + 0x81c], eax
mov eax, edi
sub eax, edx
mov byte [edi], 0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp edi, edx
jne 0x551162
mov eax, dword [esi + 0x81c]
mov cl, byte [eax]
mov byte [edi], cl
inc edi
inc dword [esi + 0x81c]
mov eax, edi
mov byte [edi], 0
pop edi
sub eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x56a3e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
movzx esi, word [eax]
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [ebp - 4], ebx
cmp ebx, ecx
jb 0x56a402
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
sub ecx, ebx
cmp eax, ecx
jbe 0x56a410
mov dword [ebp + 0xc], ecx
mov eax, ecx
xor ecx, ecx
test eax, eax
je 0x56a450
sub ebx, edx
mov dword [ebp - 8], eax
push edi
lea esp, [esp]
movzx edi, byte [ebx + edx]
mov ecx, esi
shr ecx, 8
xor ecx, edi
add edi, esi
imul edi, edi, 0x3193
mov esi, 0x58bf
sub esi, edi
mov byte [edx], cl
and esi, 0xffff
inc edx
dec eax
jne 0x56a420
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
pop edi
mov edx, dword [ebp + 8]
add ebx, eax
mov eax, dword [ebp + 0x10]
mov dword [edx], ebx
mov word [eax], si
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x586360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [eax], ebx
mov dword [eax + 4], edx
test edx, edx
je 0x5864c8
mov ecx, dword [edx + 0x74]
mov dword [eax + 0x18c], ecx
mov ecx, dword [edx + 0x78]
mov dword [eax + 0x190], ecx
mov ecx, dword [edx + 0x80]
mov dword [eax + 0x198], ecx
mov ecx, dword [edx + 0x84]
mov dword [eax + 0x19c], ecx
mov ecx, dword [edx + 0x7c]
mov dword [eax + 0x194], ecx
mov ecx, dword [edx + 0x88]
mov dword [eax + 0x1a0], ecx
lea esi, [edx + 0x48]
lea edi, [eax + 0xf4]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
lea esi, [edx + 0x2c]
lea edi, [eax + 0xd8]
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [edx + 0x8c]
mov dword [eax + 0x1a4], ecx
mov ecx, dword [edx + 0x90]
mov dword [eax + 0x1a8], ecx
mov ecx, dword [edx + 0x94]
mov dword [eax + 0x1bc], ecx
mov ecx, dword [edx + 0x98]
mov dword [eax + 0x1c0], ecx
mov ecx, dword [edx + 0x9c]
mov dword [eax + 0x1c4], ecx
mov ecx, dword [edx + 0xa0]
mov dword [eax + 0x1c8], ecx
mov ecx, dword [edx + 0xa4]
mov dword [eax + 0x1cc], ecx
mov ecx, dword [edx + 0xa8]
mov dword [eax + 0x1d0], ecx
lea esi, [edx + 0xac]
lea edi, [eax + 0x11c]
mov ecx, 0x11
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [edx + 0xf0]
mov dword [eax + 0x17c], ecx
mov ecx, dword [edx + 0xf4]
mov dword [eax + 0x180], ecx
mov cx, word [edx + 0xf8]
mov word [eax + 0x1d4], cx
mov ecx, dword [edx + 0xfc]
mov dword [eax + 0x1d8], ecx
lea esi, [edx + 0x100]
lea edi, [eax + 0xb4]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
lea edi, [eax + 0x48]
mov ecx, 9
lea esi, [eax + 0x24]
rep movsd dword es:[edi], dword [esi]
lea edi, [eax + 0x6c]
mov ecx, 9
lea esi, [eax + 0x24]
rep movsd dword es:[edi], dword [esi]
movzx esi, word [ebx + 0x11c]
mov edx, dword [eax + 0x14]
lea edi, [eax + 0x18]
mov eax, dword [eax + 8]
add esi, 0x20
push eax
mov ecx, 4
lea ebx, [ebp - 4]
mov dword [ebp - 4], edx
call fcn.00586320
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [ecx + 0x14], edx
test eax, eax
jne 0x586573
mov eax, dword [ecx + 0x184]
mov edx, dword [ebp + 0xc]
movzx esi, word [edx + 0x11e]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 8]
lea edi, [ecx + 0x188]
push eax
mov ecx, 1
call fcn.00586320
movzx ecx, word [ebp - 4]
mov edx, dword [ebp + 8]
add esp, 4
mov dword [edx + 0x184], ecx
test eax, eax
jne 0x586573
mov dword [edx + 0x98], eax
lea edi, [edx + 0x48]
mov ecx, 9
lea esi, [edx + 0x90]
rep movsd dword es:[edi], dword [esi]
lea edi, [edx + 0x6c]
mov ecx, 9
lea esi, [edx + 0x90]
rep movsd dword es:[edi], dword [esi]
lea edi, [edx + 0x24]
mov ecx, 9
lea esi, [edx + 0x90]
rep movsd dword es:[edi], dword [esi]
mov byte [edx + 0x1e8], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x596083
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x601018]
jne 0x59608d
repz ret
jmp fcn.0059660b
Function at 0x4015a0
Capabilities:
Encode data using xor

Disassembly:
push 0x41ffbc
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dl, bh
aad 0x27
sub eax, 0x4087f744
xchg ebx, eax
loop 0x40160c
aam 0x21
xchg ecx, eax
sbb cl, byte [edi]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
sub bl, byte [edi + eax*2 + 0x7b]
xor byte [eax], dh
push ebx
push 0x44657261
jbe 0x40164e
arpl word [ebp], sp
xor byte [eax], dh
xor byte [eax], dh
add byte [eax], al
add byte [eax], al
dec esp
xor dword [eax], eax
sub ch, dl
imul eax, dword [esi + 0x7ed04d02], 0x46
sahf
das
push esi
aas
add al, 0xd2
jecxz 0x4015e6
add byte gs:[eax], dh
xor byte [eax], dh
xor byte [eax], al
add byte [eax], al
add bh, bh
int3
or bh, byte [esi + 7]
xchg ebp, eax
cmc
mov ebp, 0x5b44569
inc ebp
mov ah, 5
int 0xfa
shr byte [ebp + 0x4f3a8b2e], 1
lodsd eax, dword [esi]
xor ebx, dword [ecx - 0x48ee309a]
or al, 0
stosb byte es:[edi], al
add byte [eax - 0x2d], ah
xchg ebx, eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
call 0x6a401836
retf 0

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x678c31ca
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..rdata
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x44a56267
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x1016810
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007398
push 0x1016ad0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x101b958], 0xffffffff
mov dword [0x101b95c], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x101b948]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x101b944]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x101b954], ecx
call fcn.01016ac0
mov eax, dword [0x101b700]
test eax, eax
jne 0x10168a1
push 0x1016ab0
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.01016a90
push 0x101b018
push 0x101b014
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x101b940]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x101b93c]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x101b010
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [edx]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x10169af
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x1016915
cmp al, 0x22
jne 0x1016907
cmp byte [esi], 0x22
jne 0x101691e
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x101692e
cmp al, 0x20
ja 0x101692e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x101691e
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x101694f
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x1016954
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x1016994
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x101691e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x10169af
Function at 0x100010b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
push esi
push edi
sub eax, 0
je 0x10001239
sub eax, 1
jne 0x100012ef
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
sub esp, 0xc
call fcn.100040b0
mov edx, str.attached_to_process
mov ecx, 0x10039d18
call fcn.10006bf0
push eax
call fcn.10006ea0
add esp, 4
call fcn.10009c90
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1000a160
push 0x100347b8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x10001138
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.send
push edi
call esi
push str.recv
push edi
mov dword [0x10039d0c], eax
call esi
mov dword [0x10039d08], eax
push 0x100029b0
push 0x10039d0c
call fcn.10009510
push 0x10002b60
push 0x10039d08
call fcn.10009510
push 0x10002100
push 0x10039dcc
call fcn.10009510
push 0x10002110
push 0x10039dc8
call fcn.10009510
call fcn.10009cf0
test eax, eax
je 0x10001195
mov edx, str.set_hooks_commit_failed
mov ecx, 0x10039d18
call fcn.10006bf0
push eax
call fcn.10006ea0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push str..pipeinjector_awesome_2000
call esi
mov dword [0x10038abc], eax
cmp eax, 0xffffffff
jne 0x100011dd
mov edx, str.cannot_open_stream_pipe
mov ecx, 0x10039d18
call fcn.10006bf0
push eax
call fcn.10006ea0
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push str..pipeinjector_awesome_2000_cmd
call esi
mov dword [0x10038ab8], eax
cmp eax, 0xffffffff
jne 0x10001204
mov edx, str.cannot_open_cmd_stream_pipe
jmp 0x100011c0
push 0
push 0
push dword [ebp + 8]
push 0x10002f10
push 0x400
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100012ef
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
call fcn.10009c90
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.1000a160
push 0x10002b60
push 0x10039d08
call fcn.100099a0
call fcn.10009cf0
call fcn.10009c90
call esi
push eax
call fcn.1000a160
push 0x100029b0
push 0x10039d0c
call fcn.100099a0
call fcn.10009cf0
mov edx, str.detached_from_process
mov ecx, 0x10039d18
call fcn.10006bf0
push eax
call fcn.10006ea0
mov eax, dword [0x10038abc]
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x100012ac
push eax
call esi
mov eax, dword [0x10038ab8]
cmp eax, 0xffffffff
je 0x100012b9
push eax
call esi
mov ecx, 0x10039d1c
call fcn.10005750
test eax, eax
jne 0x100012ef
mov eax, dword [0x10039d18]
push 0
mov ecx, dword [eax + 4]
xor eax, eax
add ecx, 0x10039d18
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10001ea0
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10002810
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10027fc0
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x10038014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2c], edi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], edi
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x2c], 0x10
push eax
push edx
call dword [sym.imp.WS2_32.dll_getsockname]
push 0x16
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
push 2
call dword [sym.imp.WS2_32.dll_inet_ntop]
movzx edx, word [ebp - 0x3a]
lea ecx, [ebp - 0x84]
call fcn.10001fd0
mov esi, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x54]
push 1
mov dword [ebp - 0x54], 0
push 0x100347ac
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0xf
mov byte [ebp - 0x54], 0
call fcn.100059c0
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x6c]
call fcn.10006f40
add esp, 4
push esi
push eax
mov byte [ebp - 4], 2
mov ecx, edi
push dword [ebp - 0x2c]
call fcn.10007de0
mov edx, dword [ebp - 0x58]
cmp edx, 0x10
jb 0x10002904
mov ecx, dword [ebp - 0x6c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100028fa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100029a8
push edx
push ecx
call fcn.1000b0a2
add esp, 8
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0xf
mov byte [ebp - 0x6c], 0
cmp edx, 0x10
jb 0x10002946
mov ecx, dword [ebp - 0x54]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000293c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100029a8
push edx
push ecx
call fcn.1000b0a2
add esp, 8
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0xf
mov byte [ebp - 0x54], 0
cmp edx, 0x10
jb 0x1000298b
mov ecx, dword [ebp - 0x84]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10002981
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100029a8
push edx
push ecx
call fcn.1000b0a2
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000b094
mov esp, ebp
pop ebp
ret
call fcn.1001162f
int3