joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4666a0
Capabilities:
Get geographical location
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 4], eax
push 2
push dword [0x4c2228]
call fcn.0040324d
add esp, 8
push eax
call fcn.0041b0b3
add esp, 4
test eax, eax
je 0x4667eb
mov esi, eax
mov eax, dword [0x4c105c]
xor edi, edi
inc edi
mov ebp, 0x4c105c
push edi
push ebp
call dword [eax + 0x44]
add esp, 8
push 8
push dword [0x4c2228]
call fcn.004031ad
add esp, 8
mov ebx, eax
push 7
push dword [0x4c2228]
call fcn.004031ad
add esp, 8
mov bh, al
push edi
push dword [0x4c2228]
call fcn.0040324d
add esp, 8
mov edi, eax
push 0
push dword [0x4c2228]
call fcn.00403392
add esp, 8
movzx ecx, bl
movzx edx, bh
mov ebx, esp
push ecx
push edx
push ebx
push edi
push eax
push dword [0x4c2228]
push dword [0x4c2d6c]
push 0x4c2dc4
push ebp
push esi
call dword [esi]
add esp, 0x28
test eax, eax
jne 0x466820
push dword [esp]
push dword [0x4c2d68]
call fcn.0044f6fe
add esp, 8
push dword [esp]
call fcn.00411739
add esp, 4
push dword [0x4c2dc4]
push dword [0x4c2d68]
call fcn.00450493
add esp, 8
push 0x4c105c
push dword [0x4c2dc4]
push dword [0x4c2d68]
push dword [0x4c2228]
call fcn.0040f05c
add esp, 0x10
mov dword [0x4c2dc8], eax
xor esi, esi
mov edi, 0x40
mov ebx, dword [sym.imp.USER32.dll_DeleteMenu]
push esi
push edi
push dword [0x4c2d88]
call ebx
push esi
push edi
push dword [0x4c2d8c]
call ebx
mov byte [0x4c2dc0], 0
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00475893
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [0x497058]
push str._s_Internal_Error
call fcn.0045ad89
add esp, 8
mov esi, eax
push 0x30
push eax
push str.Unsupported_protocol_number_found
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.00411739
add esp, 4
push 1
call fcn.00462c39
mov edi, eax
push dword [0x497058]
push str._s_Error
call fcn.0045ad89
add esp, 8
mov esi, eax
push dword [0x4c2228]
call fcn.00413507
add esp, 4
push edi
push eax
push str.Unable_to_open_connection_to_n_s_n_s
call fcn.0045ad89
add esp, 0xc
mov ebx, eax
push edi
call fcn.00411739
add esp, 4
xor edi, edi
push 0x10
push esi
push ebx
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.00411739
add esp, 4
push ebx
call fcn.00411739
add esp, 4
push edi
call fcn.00480cfd

Function at 0x466884
Capabilities:
Get geographical location

Disassembly:
push esi
sub esp, 0x18
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0x14], eax
movzx eax, cx
mov esi, esp
push 0x14
push esi
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push esi
call fcn.00483294
add esp, 4
mov dword [0x4c3408], eax
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00475893
add esp, 0x18
pop esi
ret
Function at 0x46695c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
cmp dword [esp + 0x14], 2
jne 0x466a12
mov ebp, dword [esp + 0x1c]
lea eax, [ebp + 1]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x466a12
mov esi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x466a12
mov edi, eax
mov bl, byte [esp + 0x20]
push ebp
push dword [esp + 0x1c]
push eax
call fcn.00478390
add esp, 0xc
mov byte [edi + ebp], 0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test bl, bl
jne 0x4669cb
push 0
push 1
push 0x8002
push dword [0x4c1058]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x4c1058]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4669f2
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4669f9
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test bl, bl
jne 0x466a12
xor eax, eax
push eax
push eax
push 0x8002
push dword [0x4c1058]
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46a60b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
sub esp, 0x104
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0x100], eax
mov eax, esp
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x46a640
cmp byte [esp + 0x12], 0
js 0x46a644
mov bl, byte [esp + 0xa5]
shr bl, 7
jmp 0x46a646
xor ebx, ebx
jmp 0x46a646
mov bl, 1
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00475893
mov eax, ebx
add esp, 0x104
pop ebx
ret
Function at 0x46b3fc
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [esp + 0x1c]
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 4], eax
xor edi, edi
push edi
push 0x1028
push 1
call fcn.004116c4
add esp, 0xc
mov esi, eax
mov dword [eax], edi
lea ebx, [eax + 4]
mov dword [eax + 4], ebp
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
call ebp
mov dword [esi + 8], eax
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
call ebp
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x1024], eax
mov byte [esi + 0x12], 0
mov word [esi + 0x10], 0
mov eax, dword [esp + 0x24]
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x18], eax
mov eax, dword [0x4c3490]
test eax, eax
jne 0x46b48f
push 0x420fb8
call fcn.00459964
add esp, 4
mov dword [0x4c3490], eax
push esi
push eax
call fcn.004599fc
add esp, 8
mov eax, esp
push eax
push edi
push ebx
push 0x46b4cf
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x46b4b6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esi + 0x13], 1
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00475893
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x46b61b
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [esp + 0x1c]
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 4], eax
xor edi, edi
xor ebx, ebx
inc ebx
push edi
push 0x1028
push ebx
call fcn.004116c4
add esp, 0xc
mov esi, eax
mov dword [eax], ebx
lea ebx, [eax + 4]
mov dword [eax + 4], ebp
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
call ebp
mov dword [esi + 8], eax
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
call ebp
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
mov eax, dword [esp + 0x24]
mov dword [esi + 0x14], eax
lea eax, [esi + 0x2c]
push eax
call fcn.0045b39f
add esp, 4
mov dword [esi + 0x40], edi
mov eax, dword [esp + 0x20]
mov dword [esi + 0x44], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x18], eax
mov eax, dword [0x4c3490]
test eax, eax
jne 0x46b6b5
push 0x420fb8
call fcn.00459964
add esp, 4
mov dword [0x4c3490], eax
push esi
push eax
call fcn.004599fc
add esp, 8
mov eax, esp
push eax
push edi
push ebx
push 0x46b6f1
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x46b6dc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00475893
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46bc9d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
cmp byte [0x4c349c], 0
jne 0x46bd7d
mov byte [0x4c349c], 1
push str.hhctrl.ocx
call fcn.0046cde0
add esp, 4
mov esi, eax
test eax, eax
je 0x46bd2b
push str.HtmlHelpA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c34a0], eax
test eax, eax
je 0x46bd35
cmp byte [0x4c34b1], 0
jne 0x46bd3e
mov byte [0x4c34b1], 1
call fcn.0046bc68
test eax, eax
je 0x46bd3e
push dword [0x4c3498]
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x4c34b4], eax
test eax, eax
je 0x46bd3e
push dword [0x4c3498]
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x46bd3e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x4c34ac], eax
jmp 0x46bd43
mov dword [0x4c34a0], 0
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x46bd7d
mov eax, dword [0x4c34ac]
test eax, eax
jne 0x46bd7d
mov bl, 1
mov eax, 0x4a1ab8
push 0
push dword [eax]
push 0x80000002
call fcn.0046d334
add esp, 0xc
test eax, eax
jne 0x46bd71
test bl, 1
je 0x46bd7d
mov eax, 0x4a1abc
xor ebx, ebx
jmp 0x46bd4e
mov dword [0x4c34a4], eax
mov byte [0x4c34a8], 0
pop esi
pop ebx
ret

Function at 0x46bd80
Capabilities:
Delete file

Disassembly:
sub esp, 0x10
mov eax, dword [0x4c34a4]
test eax, eax
je 0x46bdc1
cmp byte [0x4c34a8], 1
jne 0x46bdc3
movaps xmm0, xmmword [0x4a1ac0]
movups xmmword [esp], xmm0
call dword [0x4c34a0]
sub esp, 0x10
mov eax, dword [0x4c34a4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 4
mov eax, dword [0x4c34a4]
jmp 0x46bdc3
xor eax, eax
mov dword [esp], eax
call fcn.00411739
mov dword [0x4c34a4], 0
mov byte [0x4c34a8], 0
add esp, 0x10
ret
Function at 0x46bdef
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x114
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [0x4c34a4]
test eax, eax
jne 0x46bf63
cmp dword [0x4c34ac], 0
je 0x46bf63
xor esi, esi
cmp byte [0x4c34b8], 0
jne 0x46bf55
mov byte [0x4c34b8], 1
lea edi, [esp + 0xa]
push edi
push 0x106
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x46bf55
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
xor ebp, ebp
push ebp
push ebp
push eax
push edi
push str._sputty__lu__llu.chm
call fcn.0045ad89
add esp, 0x14
mov esi, eax
sub esp, 0x1c
mov dword [esp + 0x18], ebp
movaps xmm0, xmmword [0x4a1ad0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x46beff
mov dword [esp], ebx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x46bf55
push esi
call fcn.00411739
add esp, 4
add ebx, 1
adc ebp, 0
push ebp
push ebx
push dword [esp + 8]
lea eax, [esp + 0x16]
push eax
push str._sputty__lu__llu.chm
call fcn.0045ad89
add esp, 0x14
mov esi, eax
sub esp, 0x1c
movaps xmm0, xmmword [0x4a1ad0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x46be9a
mov edi, eax
mov eax, dword [0x4c34b4]
test eax, eax
je 0x46bf44
mov ebx, dword [0x4c34ac]
xor ebp, ebp
sub eax, ebp
xor edx, edx
mov dword [esp + 4], edx
lea ecx, [ebx + ebp]
push edx
lea edx, [esp + 8]
push edx
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46bfcd
mov eax, dword [esp + 4]
add ebp, eax
inc ebp
mov eax, dword [0x4c34b4]
cmp eax, ebp
ja 0x46bf12
mov dword [0x4c34a4], esi
mov byte [0x4c34a8], 1
xor esi, esi
jmp 0x46bfd4
push esi
call fcn.00411739
add esp, 4
mov eax, dword [0x4c34a4]
test eax, eax
je 0x46bfb4
mov ecx, dword [esp + 0x12c]
mov edi, dword [esp + 0x128]
test ecx, ecx
je 0x46bfa1
push ecx
push eax
push str._s::__s.html_main
call fcn.0045ad89
add esp, 0xc
mov esi, eax
xor eax, eax
push eax
push eax
push esi
push edi
call dword [0x4c34a0]
push esi
call fcn.00411739
add esp, 4
jmp 0x46bfad
xor ecx, ecx
push ecx
push ecx
push eax
push edi
call dword [0x4c34a0]
mov byte [0x4c34b0], 1
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00475893
add esp, 0x114
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.00411739
add esp, 4
cmp edi, 0xffffffff
je 0x46bf5e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x46bf5e

Function at 0x46bff2
Capabilities:
Delete file

Disassembly:
sub esp, 0x10
cmp byte [0x4c34b0], 1
jne 0x46c012
movaps xmm0, xmmword [0x4a1ac0]
movups xmmword [esp], xmm0
call dword [0x4c34a0]
sub esp, 0x10
mov eax, dword [0x4c34a4]
test eax, eax
je 0x46c031
cmp byte [0x4c34a8], 1
jne 0x46c031
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
ret
add esp, 0x10
ret
Function at 0x46ccd5
Capabilities:
Get session user name

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 4], eax
cmp byte [0x4c3cd4], 0
je 0x46ccf7
mov ecx, dword [0x4c3cd0]
jmp 0x46cd36
push str.secur32.dll
call fcn.0046cde0
add esp, 4
mov esi, eax
push str.sspicli.dll
call fcn.0046cde0
add esp, 4
test esi, esi
je 0x46cd27
push str.GetUserNameExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
jmp 0x46cd29
xor ecx, ecx
mov dword [0x4c3cd0], ecx
mov byte [0x4c3cd4], 1
test ecx, ecx
je 0x46cd83
xor esi, esi
mov edi, esp
mov dword [edi], esi
mov ebx, 8
push edi
push esi
push ebx
call ecx
push esi
push 1
push dword [edi]
call fcn.004116c4
add esp, 0xc
mov esi, eax
push edi
push eax
push ebx
call dword [0x4c3cd0]
test al, al
je 0x46cd7a
push 0x40
push esi
call fcn.00478ff0
add esp, 8
test eax, eax
je 0x46cdcc
mov byte [eax], 0
jmp 0x46cdcc
push esi
call fcn.00411739
add esp, 4
xor eax, eax
mov edi, esp
mov dword [edi], eax
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x46cd9a
mov eax, dword [esp]
jmp 0x46cda6
mov dword [esp], 0x100
mov eax, 0x100
push 0
push 1
push eax
call fcn.004116c4
add esp, 0xc
mov esi, eax
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x46cdcc
push esi
call fcn.00411739
add esp, 4
xor esi, esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00475893
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x46cde0
Capabilities:
Get common file path

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
cmp dword [0x4c3cf4], 0
jne 0x46ce3d
push dword [0x4c3cf8]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, dword [0x4c3cf8]
jb 0x46ce3d
xor edi, edi
inc edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
push edi
push eax
push edi
push 0x4c3cf8
push dword [0x4c3cf4]
call fcn.00411745
add esp, 0x18
mov dword [0x4c3cf4], eax
push dword [0x4c3cf8]
push eax
call ebx
cmp eax, dword [0x4c3cf8]
jae 0x46ce0f
push 0
push esi
push 0x4b0151
push dword [0x4c3cf4]
call fcn.0045ae09
add esp, 0x10
mov esi, eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push esi
call fcn.00411739
add esp, 4
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x46d334
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [0x4c1074]
xor ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
test ebx, ebx
je 0x46d377
lea ecx, [esp + 0xc]
push ecx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
xor edi, edi
mov esi, 0
test eax, eax
jne 0x46d3f9
mov eax, dword [esp + 0xc]
lea ecx, [esp + 4]
xor esi, esi
lea ebp, [esp + 8]
push ecx
push esi
push ebp
push esi
push dword [esp + 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46d3e9
cmp dword [esp + 8], 1
mov edi, 0
jne 0x46d3eb
mov eax, dword [esp + 4]
inc eax
xor esi, esi
push esi
push 1
push eax
call fcn.004116c4
add esp, 0xc
mov edi, eax
mov eax, dword [esp + 4]
mov ecx, esp
mov dword [ecx], eax
push ecx
push edi
push ebp
push esi
push dword [esp + 0x40]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46d3eb
cmp dword [esp + 8], 1
jne 0x46d3eb
mov eax, dword [esp]
cmp eax, dword [esp + 4]
ja 0x46d3eb
mov byte [edi + eax], 0
mov esi, edi
xor edi, edi
test ebx, ebx
je 0x46d3f9
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.00411739
add esp, 4
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00475893
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46f6ff
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x270
mov edi, dword [esp + 0x284]
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0x26c], eax
lea esi, [esp + 0x25]
push 0x107
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call fcn.00485930
add esp, 4
mov word [esp + eax + 0x25], 0x2a5c
mov byte [esp + eax + 0x27], 0
lea ebx, [esp + 0x12c]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x46f779
mov esi, eax
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x140
push ebx
call edi
add esp, 8
push ebx
push esi
call ebp
test eax, eax
jne 0x46f75f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, esp
mov dword [ecx], eax
push 4
push ecx
call edi
add esp, 8
lea esi, [esp + 5]
push 0x20
push esi
call fcn.0046f5f0
add esp, 8
test al, al
je 0x46f7b4
mov ebx, 0x20
push ebx
push esi
call edi
add esp, 8
push ebx
push esi
call fcn.0046d418
add esp, 8
push edi
call fcn.004723b8
add esp, 4
mov ecx, dword [esp + 0x26c]
xor ecx, esp
call fcn.00475893
add esp, 0x270
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x46f7d6
Capabilities:
Get memory capacity

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0x50], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
lea edi, [esp + 0x2c]
mov dword [edi], eax
mov esi, 4
push esi
push edi
push 9
call fcn.00442ac8
add esp, 0xc
call dword [sym.imp.USER32.dll_GetCapture]
mov dword [edi], eax
push esi
push edi
push 0xa
call fcn.00442ac8
add esp, 0xc
call dword [sym.imp.USER32.dll_GetClipboardOwner]
mov dword [edi], eax
push esi
push edi
push 0xb
call fcn.00442ac8
add esp, 0xc
push 0x1cbf
call dword [sym.imp.USER32.dll_GetQueueStatus]
lea ecx, [esp + 0x28]
mov dword [ecx], eax
push esi
push ecx
push 0xc
call fcn.00442ac8
add esp, 0xc
lea esi, [esp + 0x20]
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
push esi
push 0xd
call fcn.00442ac8
add esp, 0xc
mov edi, esp
push edi
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, 0x20
push eax
push edi
push 6
call fcn.00442ac8
add esp, 0xc
lea ebx, [esp + 0x48]
lea ebp, [esp + 0x40]
lea esi, [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea edi, [esp + 0x30]
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov eax, 0x20
push eax
push edi
push 0xe
call fcn.00442ac8
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov eax, 0x20
push eax
push edi
push 0xf
call fcn.00442ac8
add esp, 0xc
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00475893
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46f998
Capabilities:
Compare security identifiers

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x20]
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 8], eax
push 9
push str..pipe_
push esi
call fcn.004859c0
add esp, 0xc
test eax, eax
je 0x46f9d6
push 0x18
push str..._windows_winnpc.c
push str.strncmp_pipename___.pipe___9___0
call fcn.0048233d
add esp, 0xc
lea eax, [esi + 9]
push 0x5c
push eax
call fcn.00478ff0
add esp, 8
test eax, eax
je 0x46f9fc
push 0x19
push str..._windows_winnpc.c
push str.strchr_pipename__9_____NULL
call fcn.0048233d
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 0x1c
movaps xmm0, xmmword [0x4a1d20]
movups xmmword [esp + 4], xmm0
mov ebp, esi
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x40000000
call edi
cmp eax, 0xffffffff
jne 0x46fa63
call ebx
cmp eax, 0xe7
jne 0x46faaa
push 0
mov esi, ebp
push ebp
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
test eax, eax
jne 0x46fa08
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0046cf7c
add esp, 4
push eax
push esi
push str.Error_waiting_for_named_pipe__s:__s
jmp 0x46fac0
mov esi, eax
call fcn.00470b53
test eax, eax
je 0x46faca
mov edi, eax
mov eax, esp
xor ecx, ecx
lea edx, [esp + 4]
push eax
push ecx
push ecx
push ecx
push edx
push 1
push 6
push esi
call dword [0x4c4434]
test eax, eax
je 0x46fae8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0046cf7c
add esp, 4
push eax
push str.Unable_to_get_named_pipe_security_information:__s
jmp 0x46fb18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0046cf7c
add esp, 4
push eax
push ebp
push str.Unable_to_open_named_pipe__s:__s
call fcn.0045ad89
add esp, 0xc
jmp 0x46fb20
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0046cf7c
add esp, 4
push eax
push str.Unable_to_get_user_SID:__s
jmp 0x46fb18
push edi
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x46fb02
push dword [esp]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x46fb29
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebp
push str.Owner_of_named_pipe__s_is_not_us
call fcn.0045ad89
add esp, 8
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
xor esi, esi
dec esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00475893
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46fba0
Capabilities:
Create pipe

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0xc], eax
xor ebx, ebx
push ebx
push 0x34
push 1
call fcn.004116c4
add esp, 0xc
mov esi, eax
mov dword [eax + 0x30], 0x4a1d30
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], ebx
mov dword [eax], ebx
push ebp
call fcn.0045add3
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 4], ebx
mov dword [esi + 0x24], ebx
push 9
push str..pipe_
push ebp
call fcn.004859c0
add esp, 0xc
test eax, eax
je 0x46fc17
push 0xd7
push str..._windows_winnps.c
push str.strncmp_pipename___.pipe___9___0
call fcn.0048233d
add esp, 0xc
lea ebp, [esi + 0x2c]
lea ebx, [esi + 4]
mov eax, dword [esp + 0x24]
add eax, 9
push 0x5c
push eax
call fcn.00478ff0
add esp, 8
test eax, eax
je 0x46fc4a
push 0xd8
push str..._windows_winnps.c
push str.strchr_pipename__9_____NULL
call fcn.0048233d
add esp, 0xc
mov edi, esi
add edi, 0x30
push ebp
push ebx
push esi
push 0xc0000000
call fcn.00470c93
add esp, 0x10
test al, al
je 0x46fd12
mov eax, esp
mov dword [eax], 0xc
mov ecx, dword [esi]
mov dword [eax + 4], ecx
xor ecx, ecx
mov dword [eax + 8], ecx
mov edx, dword [esi + 8]
sub esp, 0x20
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
movaps xmm0, xmmword [0x4a1d50]
movups xmmword [esp + 4], xmm0
mov dword [esp], edx
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x46fcee
xorps xmm0, xmm0
movups xmmword [esi + 0x10], xmm0
mov dword [esi + 0x20], 0
sub esp, 0x10
movaps xmm0, xmmword [0x49a4e0]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x20], eax
push esi
push 0x46fd27
push eax
call fcn.0046b7fc
add esp, 0xc
mov dword [esi + 0x24], eax
mov ecx, esi
xor edx, edx
call fcn.0046fd33
jmp 0x46fd12
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0046cf7c
add esp, 4
push eax
push dword [esp + 0x28]
push str.unable_to_create_named_pipe__s:__s
call fcn.0045ad89
add esp, 0xc
mov dword [ebp], eax
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00475893
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret