joyce8/EMBER2024-capa huggingface dataset:
Function at 0x258010a7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x258010b6
pop dword [ebp - 0x34]
mov eax, 0xe5705631
sub eax, 0xbff0457b
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x716eedce
sub dword [ebp - 0x44], 0x231ca883
mov dword [ebp - 0x40], 0x7be61d2c
add dword [ebp - 0x40], 0xb64d2f19
mov dword [ebp - 0x3c], 0x5fef71dd
add dword [ebp - 0x3c], 0xec5cd251
mov dword [ebp - 0x38], 0x51e72e78
add dword [ebp - 0x38], 0xae18d188
lea eax, [ebp - 0x44]
push eax
mov eax, 0xea7dd9c0
sub eax, 0xc4fc097c
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x8881a9c4
sub dword [ebp - 0x44], 0x140f406e
mov dword [ebp - 0x40], 0x29cc6fe
sub dword [ebp - 0x40], 0xc1306589
mov dword [ebp - 0x3c], 0xd081a29a
sub dword [ebp - 0x3c], 0x6d12362e
mov dword [ebp - 0x38], 0x21fc8fdd
sub dword [ebp - 0x38], 0x21fc8fdd
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x7d5ecc05
add eax, 0xa823047b
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3e37f
push 0
call eax
mov ecx, 0x4e9f
mov esi, eax
mov edx, 0x25829600
add edx, dword [ebp - 0x34]
mov ebx, 0x1ed321ec
xor dword [ebp - 8], ebx
mov edi, dword [edx]
xor dword [ebp - 0x1c], ebx
add edi, ebx
sub dword [ebp - 0x20], edi
mov dword [esi], edi
xor dword [ebp - 0x24], 0xac764733
add esi, 4
add edx, 0x19e66349
sub edx, 0x19e66345
loop 0x258011c6
add eax, 0x84723c67
sub eax, 0x84710f18
mov ebx, eax
add eax, 0x1e7ea932
add eax, 0xe18156d3
mov ecx, 0x4d0407fa
sub ecx, 0x278407fa
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x25807028
Capabilities:
Read data from internet
Receive data

Disassembly:
push 0x1c
push 0x258205a8
call fcn.2581aaa0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
sub eax, dword [edx + 0x10]
cmp dword [ebp + 0x10], eax
cmovb eax, dword [ebp + 0x10]
cmp dword [edx + 0xc], 0
je 0x258071a1
and dword [ebp - 0x20], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov eax, dword [edx + 4]
add eax, dword [edx + 0x10]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x130]
call dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 0x20], eax
xor edi, edi
inc edi
mov ebx, edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x25807140
test ebx, ebx
jne 0x25807168
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x25823e24]
mov esi, dword [eax + 0x1218]
mov ecx, esi
call dword [0x2581d220]
call esi
pop ecx
test ebx, ebx
je 0x258071a4
cmp dword [ebp - 0x20], 0
je 0x258071a4
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x25807181
mov eax, dword [ebp + 8]
mov word [eax + 0x120], di
jmp 0x258071a4
mov edx, dword [ebp + 0xc]
add dword [edx + 0x10], eax
mov ecx, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x138], ecx
mov eax, dword [edx + 0x10]
cmp eax, dword [edx + 0xc]
jge 0x258071a4
xor eax, eax
jmp 0x258071a7
xor edi, edi
inc edi
mov ax, di
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x258071b7
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x2581bbcc
call fcn.2581aa61
mov eax, dword fs:[0x2c]
xor ebx, ebx
mov ecx, dword [0x2582448c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x25823cb8]
cmp eax, dword [ecx + 4]
jg 0x25807284
cmp byte [0x25823cb4], 0
je 0x2580727e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
call fcn.258010a7
push 1
lea esi, [eax + 6]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov edi, eax
add esp, 0x14
test edi, edi
je 0x2580727e
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
push esi
push edi
call fcn.258010a7
add esp, 0x14
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
push str._nEFS:TMS:
call fcn.2580cc41
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.2580cbab
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 0x10
jb 0x2580727e
inc eax
push eax
push dword [ebp - 0x28]
call fcn.258010a7
pop ecx
pop ecx
call fcn.2581aa50
ret
mov edi, 0x25823cb8
push edi
call fcn.258010a7
cmp dword [0x25823cb8], 0xffffffff
pop ecx
jne 0x258071e5
mov eax, dword [0x25823de8]
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2581d220]
call esi
test al, al
je 0x258072e2
mov eax, dword [0x258240c4]
push ebx
push str.enableTMSLogging
push 0x2581db70
mov esi, dword [eax + 0x5a8]
mov ecx, esi
call dword [0x2581d220]
call esi
add esp, 0xc
test ax, ax
mov al, 1
jne 0x258072e6
jmp 0x258072e2
mov al, bl
jmp 0x258072e6
or dword [ebp - 4], 0xffffffff
push edi
mov byte [0x25823cb4], al
call fcn.258010a7
pop ecx
jmp 0x258071e5
Function at 0x2580babc
Capabilities:
Query remote server for available data

Disassembly:
push 0x18
push 0x25820790
call fcn.2581aaa0
and dword [ebp - 0x20], 0
and dword [ebp - 4], 0
push 0
push 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x134]
add eax, 0x28
push eax
push dword [ecx + 0x130]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
mov dword [ebp - 0x20], eax
xor edi, edi
inc edi
mov ebx, edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x2580bbbc
test ebx, ebx
jne 0x2580bbe4
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x25823e24]
mov esi, dword [eax + 0x1218]
mov ecx, esi
call dword [0x2581d220]
call esi
pop ecx
test ebx, ebx
je 0x2580bbea
cmp dword [ebp - 0x20], 0
jne 0x2580bbec
xor edi, edi
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x2580c0de
Capabilities:
Check internet connectivity via wininet

Disassembly:
push 0x1c
push 0x258208b8
call fcn.2581aaa0
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov dword [ebp - 0x20], eax
xor edi, edi
inc edi
mov ebx, edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x2580c1cf
test ebx, ebx
jne 0x2580c1f7
xor eax, eax
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x25823e24]
mov esi, dword [eax + 0x1218]
mov ecx, esi
call dword [0x2581d220]
call esi
pop ecx
test ebx, ebx
je 0x2580c206
cmp dword [ebp - 0x20], 0
je 0x2580c206
test byte [ebp - 0x24], 0x20
jne 0x2580c206
push 2
pop edi
mov ax, di
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40102b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 1
call fcn.00401e67
test eax, eax
jne 0x4010c5
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x403148
sub eax, 0x4026e6
mov dword [esp], 0x4026e6
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x4010c5
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.00401d2e
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.0040226c
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1be00
mov dword [esp], 0x40400c
call fcn.00402e4b
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x401e67
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x250
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
call ebx
push edx
mov dword [ebp - 0x228], eax
call esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x21c], 6
push ecx
push ecx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push esi
push esi
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x220], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push edx
push edx
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x238]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push ecx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
mov dword [esp], 0
call ebx
lea ebx, [ebp - 0x210]
push edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push ecx
push ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1a
mov dword [esp], 0
call dword [sym.imp.SHELL32.DLL_SHGetFolderPathW]
sub esp, 0x14
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 5]
push esi
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d7a
sub eax, 0x403d20
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1926062
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4c5d725c
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x1000a4c4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1000a531
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000a512
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1000a52f
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1000a52f
push 0x1978
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x1000a54d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push 0
push dword [ebp - 0x28]
call fcn.1000a87a
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x1000aaec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1000ab2f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push 0x32ec
push 0x777f
push dword [ebp - 0x14]
push 0x1150
push 0x186b
push dword [ebp - 0x18]
push 0
call fcn.1000aec5
add esp, 0x1c
jmp 0x1000ac23
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1000ac12
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1000ab7d
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffef
jle 0x1000ac10
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 4], 0
je 0x1000ab98
jmp 0x1000ac10
mov dword [ebp - 4], 0xffffffed
jmp 0x1000aba8
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jle 0x1000ac0b
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x34], 0xffffffff
cmp dword [ebp - 0x30], 0xfffffff6
jbe 0x1000abeb
push 1
mov ecx, dword [ebp - 0x10]
call fcn.1001f9f7
mov dword [eax], 0xfffffff7
mov eax, dword [ebp - 8]
imul eax, dword [eax], 0xfffffff7
test eax, eax
je 0x1000abe5
mov eax, 0xffff
test eax, eax
jne 0x1000abeb
and dword [ebp - 0xc], 0
jmp 0x1000abf2
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
push 1
mov ecx, dword [ebp - 0x10]
call fcn.1001f9f7
cmp dword [eax], 0
je 0x1000ac09
jmp 0x1000aba1
jmp 0x1000aba1
jmp 0x1000ab72
jmp 0x1000ac23
push 0x1978
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esp, ebp
pop ebp
ret
Function at 0x1000ac5e
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x1000acca
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push 1
push 0x3657
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0x1205
call fcn.1000ad21
add esp, 0x2c
jmp 0x1000ad1d
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1000acf0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x1000ad1d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1000ad1d
push 0x10c3
push 0x2050
push 0xb8a
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
mov esp, ebp
pop ebp
ret

Function at 0x1000d897
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000d8fd
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000d8db
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1000d8d9
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1000d8fb
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1000d8fb
push 0x45f6
push 0x5faa
push 0
call fcn.1000e77a
add esp, 0xc
jmp 0x1000d941
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
push 0
push dword [ebp - 0x18]
push 0x6457
push 0x7d5b
push 0x4e01
push 0x19d8
push 0x77dd
push 0x1d9e
push 0xfa5
push 0x6f5
push dword [ebp - 0x1c]
call fcn.1000ad21
add esp, 0x2c
mov esp, ebp
pop ebp
ret
Function at 0x1001df60
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006942b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001e0fb
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1001e0d9
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [0x10bca9c4]
and eax, 1
jne 0x1001dff9
mov eax, dword [0x10bca9c4]
or eax, 1
mov dword [0x10bca9c4], eax
and dword [ebp - 4], 0
mov ecx, 0x10bca9f4
call fcn.1001fa70
push 0x1006a234
call fcn.10050495
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x10bca996]
test eax, eax
je 0x1001e059
mov ecx, 0x10bca9f4
call fcn.1001fb27
movzx eax, al
test eax, eax
jne 0x1001e059
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x10bca9f4
call fcn.1001fb30
lea eax, [ebp - 0x40]
push eax
mov ecx, 0x10bca9f4
call fcn.1001f9d1
push eax
lea ecx, [ebp - 0x14]
call fcn.1001f913
movzx eax, al
test eax, eax
je 0x1001e059
lea ecx, [ebp - 0x14]
call fcn.1001fb45
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov dword [ecx], eax
jmp 0x1001e128
mov eax, dword [ebp - 0x10]
push dword [eax]
lea eax, [ebp - 0x58]
push eax
call fcn.1003fc33
pop ecx
pop ecx
mov dword [ebp - 4], 1
push 0
push 0
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x30]
call fcn.100164ab
add esp, 0x10
mov dword [ebp - 0x1c], eax
push 0x2081
push 0
lea eax, [ebp - 0x1c]
push eax
push 0x10bca9f4
push 0x38ee
push 0x7796
push 0x2395
push dword [ebp - 0x10]
push 0x10bca996
call fcn.1001e77f
add esp, 0x24
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.1001f8b6
jmp 0x1001e128
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1001e0f9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x1001e128
push 0x671a
push 0x5f2e
push 0x4db
push 0x35d2
push 0x25b8
push 0x5d83
push 1
push 0x6030
call fcn.1000a66d
add esp, 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10025b00
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10025b80
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10025b5a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10025b58
push 1
push 1
push 0x6995
push 0x58df
push 0
call fcn.10025b00
add esp, 0x14
jmp 0x10025b7e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10025b7e
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x10025bb0
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10025b9e
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
jmp 0x10025bb0
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10025bb0
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov esp, ebp
pop ebp
ret
Function at 0x10028aac
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006985f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10028af1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
push 0x252
push dword [ebp - 0x14]
push 0
push 0x5c51
call fcn.10030ce4
add esp, 0x10
jmp 0x10028c3f
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10028c1b
mov dword [ebp - 0x1c], 0
push 3
lea ecx, [ebp - 0x54]
call fcn.1001f933
and dword [ebp - 4], 0
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x2c], 0x3ccde6bc
push 2
lea ecx, [ebp - 0x48]
call fcn.1001f933
mov byte [ebp - 4], 1
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x28], 0xe9f21c9b
mov dword [ebp - 0x24], 0xaa2910a8
mov dword [ebp - 0x10], 0
jmp 0x10028b61
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10028b7a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x54]
call fcn.1001f9f7
mov dword [eax], 0x678dc2a8
jmp 0x10028b5a
push 0x4a3d
push 0x582c
push 0x33f2
push 0x6d51
push 0x7b95
push 0x3ca9
lea eax, [ebp - 0x48]
push eax
push 0
push 0x7922
push 0x29c6
push 0x13cc
push 0x340e
push 0x25e9
push 0x157f
push 0x3f7f
lea eax, [ebp - 0x10]
push eax
call fcn.1002954b
add esp, 0x40
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x2c6b
lea eax, [ebp - 0x28]
push eax
push 0x5ea1
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.10030ec6
add esp, 0x2c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.1001f9b5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.1001f9b5
jmp 0x10028c3f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x10028c3f
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10028c69
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10028ca1
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10028c97
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x10028c9f
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10028cc2
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push 0x1615
push 0
push dword [ebp - 0xc]
call fcn.10036601
add esp, 0x10
mov esp, ebp
pop ebp
ret