joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10288f06
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1031c744
push 0x1031c73c
push str.FlsAlloc
push 0x1e
call fcn.10288d33
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10288f3a
push dword [ebp + 8]
mov ecx, esi
call dword [0x10298854]
call esi
jmp 0x10288f40
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10288f84
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1031c754
push 0x1031c74c
push str.FlsGetValue
push 0x20
call fcn.10288d33
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10288fbb
push dword [ebp + 8]
mov ecx, esi
call dword [0x10298854]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1028a4d9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1028a34a
Function at 0x1028d908
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1028d9a5
push ebx
push esi
call fcn.1028d8d1
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1028b675
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1028d952
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1028d9a4
push edi
push eax
call fcn.102845ec
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1028d972
call fcn.102839f7
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1028d9a3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1028b675
add esp, 0x20
test eax, eax
jne 0x1028d991
push edi
call fcn.102839f7
jmp 0x1028d999
push ebx
call fcn.102839f7
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1028d9a8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1028d9b9
pop esi
ret
push ebx
push edi
push esi
call fcn.1028d8d1
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.102845ec
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1028d9e1
push ebx
push esi
push edi
call fcn.102618f0
add esp, 0xc
push 0
call fcn.102839f7
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1028e12d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1028dc54
Function at 0x1028e636
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1028e5b2
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1028e7ae
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1028e7ae
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1028e75d
jg 0x1028e68f
test eax, eax
je 0x1028e753
push 1
push 0x1000
call fcn.1028437f
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1028e6b5
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x1028e74a
push 0x8000
push ebx
call fcn.1027bcd3
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1028e6e1
jg 0x1028e6dc
cmp ecx, 0x1000
jb 0x1028e6e1
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10282441
add esp, 0x10
cmp eax, 0xffffffff
je 0x1028e726
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1028e6dc
jl 0x1028e70d
test ecx, ecx
jne 0x1028e6ce
push dword [ebp - 0xc]
push ebx
call fcn.1027bcd3
push esi
call fcn.102839f7
add esp, 0xc
xor edi, edi
jmp 0x1028e7bf
cmp byte [edi + 0x24], 0
je 0x1028e73d
cmp dword [edi + 0x20], 5
jne 0x1028e73d
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1028e748
mov edi, dword [edi + 0x18]
jmp 0x1028e74a
xor edi, edi
push esi
call fcn.102839f7
pop ecx
jmp 0x1028e7bf
test ecx, ecx
jg 0x1028e71f
jl 0x1028e75d
test eax, eax
jae 0x1028e71f
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1027b985
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1028e780
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1028e71f
jmp 0x1028e7b7
push ebx
call fcn.1028b03f
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1028e71f
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x1028e7bf
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1028e7bc
mov edi, dword [edi + 0x18]
jmp 0x1028e7bf
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1027b985
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403760
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 1], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00403170
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x403781
mov al, 1
jmp 0x4037e7
mov dword [ebp - 8], 1
mov edx, dword [ebp + 8]
push edx
call fcn.00403100
add esp, 4
movzx eax, al
test eax, eax
je 0x4037c6
mov ecx, dword [ebp + 8]
call fcn.00403d00
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4037b7
mov dword [ebp - 0xc], 1
jmp 0x4037be
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
jmp 0x4037da
mov ecx, dword [ebp + 8]
call fcn.00403d00
push eax
call fcn.0043a7e7
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4037e4
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x404810
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x40492e
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x404848
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00405420
jmp 0x404942
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.00407b40
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x4048dc
jg 0x404870
cmp dword [ebp + 0xc], 0
jbe 0x4048dc
cmp dword [ebp - 8], 0
jl 0x4048dc
jg 0x40487e
cmp dword [ebp - 0xc], 0
jbe 0x4048dc
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x40489c
jl 0x404890
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x40489c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00407d40
push eax
call fcn.004015d0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00407bc0
cmp dword [ebp + 0x10], 0
jl 0x40491e
jg 0x4048ea
cmp dword [ebp + 0xc], 0
jbe 0x40491e
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x40491e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0043dd96
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x404942
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00405420
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404950
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x404a76
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x404988
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00405540
jmp 0x404a8a
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.00407c00
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x404a1c
jg 0x4049b0
cmp dword [ebp + 0xc], 0
jbe 0x404a1c
cmp dword [ebp - 8], 0
jl 0x404a1c
jg 0x4049be
cmp dword [ebp - 0xc], 0
jbe 0x404a1c
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x4049dc
jl 0x4049d0
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x4049dc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.00407d60
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004015d0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00407ce0
cmp dword [ebp + 0x10], 0
jl 0x404a66
jg 0x404a2a
cmp dword [ebp + 0xc], 0
jbe 0x404a66
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x404a66
mov ecx, dword [ebp - 4]
call fcn.00407750
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0043e4f8
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x404a8a
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.00405540
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404ee0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x47706c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x2c], ecx
call fcn.004016e0
mov dword [ebp - 0x44], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.00401660
add esp, 8
movzx edx, al
test edx, edx
je 0x404f25
lea eax, [ebp + 8]
push eax
call fcn.00401690
add esp, 4
jmp 0x4050a6
mov ecx, dword [ebp - 0x2c]
call fcn.00407d40
test eax, eax
je 0x404f67
mov ecx, dword [ebp - 0x2c]
call fcn.00407d40
mov esi, eax
mov ecx, dword [ebp - 0x2c]
call fcn.00407cc0
cmp esi, eax
jae 0x404f67
lea ecx, [ebp + 8]
push ecx
call fcn.00401640
add esp, 4
mov bl, al
mov ecx, dword [ebp - 0x2c]
call fcn.00407b70
mov byte [eax], bl
mov eax, dword [ebp + 8]
jmp 0x4050a6
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0x4c], 0
jne 0x404f7a
call fcn.004016e0
jmp 0x4050a6
mov ecx, dword [ebp - 0x2c]
call fcn.00407750
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
jne 0x404fc9
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x4c]
push edx
lea eax, [ebp + 8]
push eax
call fcn.00401640
add esp, 4
movzx ecx, al
push ecx
call fcn.00403000
add esp, 8
movzx edx, al
test edx, edx
je 0x404fb9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
jmp 0x404fc1
call fcn.004016e0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
jmp 0x4050a6
mov dword [ebp - 0x50], 0x20
lea ecx, [ebp + 8]
push ecx
call fcn.00401640
add esp, 4
mov byte [ebp - 0x2e], al
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x2d]
push eax
lea ecx, [ebp - 0x2e]
push ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x40
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x38]
call fcn.00406450
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x4050a1
cmp dword [ebp - 0x34], 1
jle 0x405024
cmp dword [ebp - 0x34], 3
je 0x405071
jmp 0x4050a1
mov ecx, dword [ebp - 0x48]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x38], ecx
je 0x405056
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.0043dd96
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x405056
call fcn.004016e0
jmp 0x4050a6
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2e]
cmp dword [ebp - 0x4c], edx
je 0x40506a
mov eax, dword [ebp + 8]
jmp 0x4050a6
call fcn.004016e0
jmp 0x4050a6
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2e]
push edx
call fcn.00403000
add esp, 8
movzx eax, al
test eax, eax
je 0x405094
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x40], ecx
jmp 0x40509c
call fcn.004016e0
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
jmp 0x4050a6
call fcn.004016e0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f4e5
mov esp, ebp
pop ebp
ret 4
Function at 0x4077e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x47706c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x407807
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x40780e
mov al, 1
jmp 0x4078e2
call fcn.004016e0
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.004016e0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00401660
add esp, 8
movzx eax, al
test eax, eax
je 0x40784a
xor al, al
jmp 0x4078e2
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call fcn.00408f00
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x407886
cmp dword [ebp - 0x30], 1
je 0x40788d
cmp dword [ebp - 0x30], 3
je 0x4078dc
jmp 0x4078e0
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x34], ecx
je 0x4078bc
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.0043dd96
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x4078bc
xor al, al
jmp 0x4078e2
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x4078d0
mov dword [ebp - 0x38], 1
jmp 0x4078d7
mov dword [ebp - 0x38], 0
mov al, byte [ebp - 0x38]
jmp 0x4078e2
mov al, 1
jmp 0x4078e2
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f4e5
mov esp, ebp
pop ebp
ret
Function at 0x40e0d0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45703b
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x47706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x158], 0
push 0
call fcn.0040d240
add esp, 4
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], edx
lea eax, [ebp - 0x160]
push eax
lea ecx, [ebp - 0x150]
push ecx
call fcn.0040d260
add esp, 8
mov dword [ebp - 0x168], eax
lea edx, [ebp - 0x114]
push edx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x40e17a
push 0x468035
mov ecx, dword [ebp + 8]
call fcn.00404420
mov eax, dword [ebp - 0x158]
or eax, 1
mov dword [ebp - 0x158], eax
mov eax, dword [ebp + 8]
jmp 0x40e274
push str.TrustAgentlogsTAInstall
push 0x104
lea ecx, [ebp - 0x114]
push ecx
call fcn.0043f2a2
add esp, 0xc
push 0
lea edx, [ebp - 0x114]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
test eax, eax
je 0x40e1e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x40e1e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40e1e4
push 0x468036
mov ecx, dword [ebp + 8]
call fcn.00404420
mov eax, dword [ebp - 0x158]
or eax, 1
mov dword [ebp - 0x158], eax
mov eax, dword [ebp + 8]
jmp 0x40e274
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x12c]
call fcn.00404420
mov dword [ebp - 4], 0
mov byte [ebp - 0x151], 0x5c
lea ecx, [ebp - 0x12c]
call fcn.00403ce0
sub eax, 1
push eax
lea ecx, [ebp - 0x12c]
call fcn.00404110
movsx edx, byte [eax]
movsx eax, byte [ebp - 0x151]
cmp edx, eax
je 0x40e241
movzx ecx, byte [ebp - 0x151]
push ecx
push 1
lea ecx, [ebp - 0x12c]
call fcn.00407320
lea edx, [ebp - 0x12c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404330
mov eax, dword [ebp - 0x158]
or eax, 1
mov dword [ebp - 0x158], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.00404250
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041f4e5
mov esp, ebp
pop ebp
ret 4
Function at 0x40f400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x1c], 0xffffffff
je 0x40f41b
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x1c], 0
jne 0x40f423
mov ecx, dword [ebp - 8]
call fcn.0040ee60
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0x10]
push edx
push 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40f4cb
cmp dword [ebp - 0x10], 4
jne 0x40f4cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6d
jne 0x40f469
mov byte [ebp - 1], 1
jmp 0x40f46d
mov byte [ebp - 1], 0
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp - 1]
mov byte [eax], cl
push 0
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.00404070
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004040c0
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40f4c9
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
jne 0x40f4c9
mov ecx, dword [ebp + 8]
call fcn.004040c0
push eax
push str._Receive_succeed_:_s_n
call fcn.0040ede0
add esp, 8
mov al, 1
jmp 0x40f4fa
jmp 0x40f4ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6d
jne 0x40f4e0
mov byte [ebp - 2], 1
jmp 0x40f4e4
mov byte [ebp - 2], 0
mov edx, dword [ebp + 0xc]
mov al, byte [ebp - 2]
mov byte [edx], al
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.00404070
xor al, al
mov esp, ebp
pop ebp
ret 8
Function at 0x40f500
Capabilities:
Connect pipe
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jne 0x40f578
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x40f531
mov byte [ebp - 1], 1
jmp 0x40f535
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov byte [ebp - 2], al
movzx ecx, byte [ebp - 2]
test ecx, ecx
jne 0x40f578
push str.Not_Connect_n
call fcn.0040ede0
add esp, 4
mov ecx, dword [ebp - 8]
call fcn.0040ee60
movzx edx, al
test edx, edx
jne 0x40f578
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x217
je 0x40f578
xor al, al
jmp 0x40f63d
mov ecx, dword [ebp - 8]
call fcn.0040f1e0
movzx eax, al
test eax, eax
jne 0x40f5aa
push str.Not_Init_n
call fcn.0040ede0
add esp, 4
mov ecx, dword [ebp - 8]
call fcn.0040ee60
movzx ecx, al
test ecx, ecx
jne 0x40f5aa
xor al, al
jmp 0x40f63d
mov ecx, dword [ebp + 8]
call fcn.004040c0
push eax
push str._Send_succeed_:_s_n
call fcn.0040ede0
add esp, 8
mov ecx, dword [ebp + 8]
call fcn.00403ce0
mov dword [ebp - 0x14], eax
push 0
lea edx, [ebp - 0x1c]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40f60e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0x18], 0
jne 0x40f60a
mov ecx, dword [ebp - 8]
call fcn.0040f3d0
jmp 0x40f578
xor al, al
jmp 0x40f63d
push 0
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00403ce0
push eax
mov ecx, dword [ebp + 8]
call fcn.004040c0
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40f63b
xor al, al
jmp 0x40f63d
mov al, 1
mov esp, ebp
pop ebp
ret 4