joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53eef0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x7a9040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
movsx ecx, byte [eax + 0xb]
test ecx, ecx
jns 0x53ef14
mov ecx, dword [eax + 4]
mov eax, dword [eax]
test ecx, ecx
js 0x53efa2
sete dl
test eax, eax
setne dh
or dh, dl
je 0x53efa2
mov ebx, dword [ebp + 0xc]
lea esi, [ebp - 0x1c]
push ecx
push eax
push esi
call fcn.005d85c0
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x53ef42
mov esi, dword [ebp - 0x1c]
lea edi, [ebp - 0x28]
push ebx
push dword [ebp + 8]
push edi
call fcn.005d85c0
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x53ef5b
mov edi, dword [ebp - 0x28]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x1d], 0
jns 0x53ef76
push dword [ebp - 0x28]
call fcn.006507ee
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x53ef87
push dword [ebp - 0x1c]
call fcn.006507ee
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
ud2

Function at 0x53f020
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x10010
call fcn.00651b20
mov esi, dword [ebp + 8]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1001c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
push edx
push ecx
push ebx
call fcn.005d85c0
add esp, 0xc
test esi, esi
je 0x53f0d9
lea edi, [ebp - 0x1000e]
push 0xfffe
push 0xff
push edi
call fcn.006547d0
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x53f085
mov ebx, dword [ebp - 0x1001c]
push 0x7fff
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
je 0x53f0ab
cmp eax, 0x7fff
jae 0x53f102
push esi
push eax
push edi
call fcn.00535b60
add esp, 0xc
cmp byte [ebp - 0x10011], 0
jns 0x53f0c2
push dword [ebp - 0x1001c]
call fcn.006507ee
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0x10010
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [ebp - 0x10011], 0
js 0x53f0ea
lea eax, [ebp - 0x1001c]
jmp 0x53f0f0
mov eax, dword [ebp - 0x1001c]
xor ecx, ecx
push ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne bl
jmp 0x53f0ab
int3
Function at 0x53f5d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [0x7b270c]
test ebx, ebx
jne 0x53f654
push 0x28
call fcn.006507be
add esp, 4
mov esi, eax
xor edi, edi
mov dword [eax], edi
mov dword [eax + 4], edi
mov byte [eax + 8], 0
push 0xc
call fcn.006507be
add esp, 4
mov dword [esi + 0xc], eax
lea ecx, [eax + 0xc]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x53f65e
mov dword [eax + 8], edi
xorps xmm0, xmm0
movsd qword [eax], xmm0
mov dword [esi + 0x10], ecx
mov eax, esi
add eax, 0x1c
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], 1
mov dword [0x7b270c], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x53f65e
mov edi, eax
push eax
call fcn.0066e7c4
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.0053f660
test ebx, ebx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
Function at 0x549670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov ebx, dword [ebp + 8]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0x30
ja 0x5497a5
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x20]
movdqu xmmword [eax], xmm0
movdqu xmmword [eax - 0x10], xmm0
movdqu xmmword [eax - 0x20], xmm0
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xfc]
mov dword [ebp - 0x44], eax
call dword [0x7a29f4]
lea eax, [ebp - 0x40]
push esi
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x7a29f4]
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x7a29f4]
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
test ebx, ebx
je 0x549741
xor eax, eax
mov cl, byte [edi + eax]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp ebx, eax
jne 0x549735
push 1
call fcn.00613d80
add esp, 4
bt eax, 0x19
jae 0x5497ba
not eax
test eax, 0x12000000
jne 0x5497a9
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00415510
add esp, 0xc
mov eax, 0x413f50
mov ecx, 0x4133c0
mov dword [esi + 0xf4], ecx
mov dword [esi + 0xf8], eax
lea eax, [ebp - 0x20]
movups xmm0, xmmword [eax]
mov eax, dword [ebp - 0x44]
movups xmmword [eax], xmm0
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x549791
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.00415200
jmp 0x549769
bt eax, 9
jae 0x5497db
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.004162a0
add esp, 0xc
xor eax, eax
mov ecx, 0x416350
jmp 0x549776
push esi
push 0x100
lea eax, [ebp - 0x40]
push eax
call fcn.006a8940
add esp, 0xc
mov eax, 0x6a94d0
mov ecx, 0x6a8850
jmp 0x549776
Function at 0x54fa10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.005f35e0
Function at 0x55b3d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x55b4a9
cmp dword [esi], 0
jne 0x55b4a9
cmp dword [esi + 0xc], 0
jne 0x55b4a9
xor eax, eax
cmp dword [esi + 4], 0
jne 0x55b4a9
mov ebx, dword [edi]
cmp eax, ebx
je 0x55b433
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x55b479
lea eax, [ebx + 1]
cmp eax, 2
jb 0x55b429
mov dword [esi], ebx
call fcn.005e4650
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp dword [esi + 4], ebx
je 0x55b466
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x55b490
lea eax, [ebx + 1]
cmp eax, 2
jb 0x55b45c
mov dword [esi + 4], ebx
call fcn.005e4650
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005e4650
push dword [esi]
call fcn.005cf200
add esp, 4
mov dword [esi], 0
jmp 0x55b41a
call fcn.005e4650
push dword [esi + 4]
call fcn.005cf200
add esp, 4
mov dword [esi + 4], 0
jmp 0x55b44c
mov ecx, esi
call fcn.006c95d0
mov eax, dword [esi]
jmp 0x55b404

Function at 0x5642a0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x7abe2c]
cmp eax, 0xffffffff
je 0x5642c0
push ebp
mov ebp, esp
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
ret

Function at 0x5642d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x7abe2c]
cmp eax, 0xffffffff
je 0x564391
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x564391
mov eax, dword [0x7beb6c]
mov ecx, dword [0x7ad2c4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x56439b
mov edi, dword [0x7beb68]
push edi
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x5643e9
mov ecx, dword [0x7bdb60]
inc ecx
xor edx, edx
lea eax, [ecx + edx]
movzx eax, al
mov ebx, eax
shl ebx, 4
cmp dword [ebx + 0x7bdb64], 0
jne 0x5643f5
lea ecx, [ebx + 0x7bdb64]
mov dword [ecx], 1
mov edx, dword [ebp + 8]
mov dword [ecx + 4], edx
mov edx, dword [0x7beb64]
inc edx
mov dword [0x7beb64], edx
mov dword [ecx + 0xc], edx
mov dword [0x7bdb60], eax
mov dword [esi], eax
mov eax, dword [ecx + 8]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp dword [esi], 0x100
jae 0x5643e6
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.00564410
jmp 0x5642f5
push 0x7beb6c
call fcn.00650831
add esp, 4
cmp dword [0x7beb6c], 0xffffffff
jne 0x564316
push 4
call fcn.006507be
add esp, 4
mov edi, eax
mov dword [eax], 0
mov ecx, eax
call fcn.005d0780
mov dword [0x7beb68], edi
push 0x7beb6c
call fcn.006508ab
add esp, 4
jmp 0x564316
int3
mov ecx, edi
call fcn.005d0790
jmp 0x56432b
inc edx
cmp edx, 0x100
jne 0x564334
jmp 0x56437b
Function at 0x564410
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x808
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x814], 0xffffffff
mov ecx, dword [0x7abe2c]
mov dword [ebp - 0x814], ecx
cmp ecx, 0xffffffff
je 0x5644bd
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x564506
mov edi, 0x800
lea ebx, [ebp - 0x810]
push edi
push 0
push ebx
call fcn.006547d0
add esp, 0xc
lea eax, [ebp - 0x80d]
push eax
push dword [ebp - 0x814]
call fcn.00594da0
add esp, 8
push edi
call fcn.00650823
add esp, 4
mov esi, eax
push edi
push ebx
push eax
call fcn.00654250
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x814]
call fcn.00594da0
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x814]
push esi
call fcn.00594d80
add esp, 4
test al, al
je 0x564509
mov ecx, dword [ebp - 0x814]
cmp ecx, 0xffffffff
je 0x56450c
xor eax, eax
dec eax
lock cmpxchg dword [0x7abe2c], ecx
je 0x564441
push ecx
call fcn.006eb7f0
add esp, 4
mov ecx, dword [0x7abe2c]
mov dword [ebp - 0x814], ecx
jmp 0x564441
int3
int3
push esi
call fcn.00594d80
add esp, 4
test al, al
je 0x564534
cmp dword [ebp - 0x814], 0xffffffff
je 0x564534
push 0xffffffffffffffff
call fcn.006eb7f0
add esp, 4
mov ecx, dword [ebp - 0x814]
jmp 0x5644db
int3

Function at 0x564540
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edi, ecx
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [esp + 0x1c], eax
push dword [0x7abe2c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
and ecx, 3
cmp ecx, 2
je 0x564585
xor esi, esi
and eax, 0xfffffffc
je 0x5645c8
mov ecx, dword [edi]
mov edx, dword [eax + ecx*8 + 4]
cmp edx, dword [edi + 4]
jne 0x5645c8
mov esi, dword [eax + ecx*8]
jmp 0x5645c8
mov dword [esp + 0x14], 0x14
mov dword [esp + 0x10], 0x1dd76000
mov esi, esp
push 0x1fb
push str....._base_threading_thread_local_storage.cc
push 0x78be7b
push esi
call fcn.005e4620
add esp, 4
movsd xmm0, qword [esp + 0x1c]
movsd qword [esp + 4], xmm0
mov dword [esp], esi
call fcn.006a7220
add esp, 0xc
xor esi, esi
mov ecx, dword [esp + 0x1c]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x570e60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [ecx + 0x15bc]
mov ebx, dword [ecx + 0x15c0]
add ebx, eax
mov eax, dword [ecx + 0x15b4]
mov ecx, ebx
sub ecx, eax
cmp ecx, 0x40000001
jb 0x570e96
push dword [ebp + 8]
call fcn.0059dde0
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [esp + 0xc]
test eax, eax
mov ecx, 0x40000000
mov edi, 0xaf000000
cmove edi, ecx
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x54], 0x343677
mov dword [esp + 0x50], 0x6f777369
lea eax, [esp + 0x50]
push eax
call fcn.0047c650
add esp, 4
cmp ebx, edi
jbe 0x570ef6
push ebx
call fcn.0059de10
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 0
mov dword [esp + 0x44], 0x657a69
mov dword [esp + 0x40], 0x735f6176
lea eax, [esp + 0x40]
push eax
call fcn.0047c650
add esp, 4
mov eax, dword [esi + 0x15c4]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x34], 0x20200063
mov dword [esp + 0x30], 0x6f6c6c61
lea eax, [esp + 0x30]
push eax
call fcn.0047c650
add esp, 4
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov eax, dword [esi + 0x15b4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0x20007469
mov dword [esp + 0x10], 0x6d6d6f63
lea eax, [esp + 0x10]
push eax
call fcn.0047c650
add esp, 4
mov esi, dword [ebp + 8]
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0x20202000
mov dword [esp + 0x20], 0x657a6973
lea eax, [esp + 0x20]
push eax
call fcn.0047c650
add esp, 4
mov ecx, dword [0x7c21f4]
test ecx, ecx
je 0x570fc9
call dword [0x7a29f4]
push esi
call ecx
add esp, 4
push esi
call fcn.00559350
int3
Function at 0x5785f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x7a9040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x578620
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x578730
push 0
push eax
push 0x578580
push 0x7c0640
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x578728
cmp dword [0x7c0644], 0
jne 0x57860c
push dword [0x7c0648]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x57860c
mov esi, eax
mov eax, 0x7c064c
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x7c0650]
mov ebx, dword [0x7c0654]
mov eax, dword [0x7c0658]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x7c065c]
mov dword [ebp - 0x20], eax
mov eax, dword [0x7c0660]
mov dword [ebp - 0x24], eax
mov eax, 0x7c064c
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
jne 0x57870e
test ebx, ebx
jne 0x5786fb
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x5786c6
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
jne 0x5786d7
test ebx, ebx
jne 0x5786e8
push esi
call fcn.005464a0
add esp, 4
jmp 0x57860c
mov edi, dword [esi + 8]
call dword [0x7a29f4]
push edi
call ecx
add esp, 4
jmp 0x5786aa
mov edi, dword [esi + 0xc]
call dword [0x7a29f4]
push edi
call ecx
add esp, 4
jmp 0x5786b4
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [0x7a29f4]
push edi
call ebx
add esp, 4
jmp 0x5786b8
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [0x7a29f4]
push edi
call ebx
add esp, 4
jmp 0x5786a3
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [0x7a29f4]
push dword [ebp - 0x18]
call edi
add esp, 4
jmp 0x57869f
call fcn.00665b29
int3
Function at 0x578750
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x578730
push 0
push eax
push 0x578580
push 0x7c0640
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x578818
mov esi, dword [ebp + 0xc]
cmp dword [0x7c0644], 0
jne 0x578826
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x7c0648]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x5787db
push 0x14
push 1
call fcn.00546650
add esp, 8
test eax, eax
je 0x578826
mov edi, eax
push eax
push dword [0x7c0648]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x57881d
mov ebx, dword [ebp + 8]
mov esi, 0x7c064c
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x7c0650], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00665b29
push edi
call fcn.005464a0
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [0x7a29f4]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x578804

Function at 0x579630
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea edx, [ebp - 0x18]
mov dword [edx], eax
mov dword [edx + 4], eax
push 6
push edx
push ecx
call fcn.006303d0
add esp, 0xc
xor esi, esi
test eax, eax
je 0x57968d
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
movzx eax, byte [0x793389]
cmp ebx, eax
jne 0x5796a1
mov esi, 0x79337c
test al, al
je 0x57968d
push ebx
push 0x793380
push edi
call fcn.00652bcd
add esp, 0xc
test eax, eax
jne 0x5796a1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [0x7934b1]
cmp ebx, eax
jne 0x5796c8
mov esi, 0x7934a4
test al, al
je 0x57968d
push ebx
push 0x7934a8
push edi
call fcn.00652bcd
add esp, 0xc
test eax, eax
je 0x57968d
movzx eax, byte [0x79341d]
cmp ebx, eax
jne 0x5796ef
mov esi, 0x793410
test al, al
je 0x57968d
push ebx
push 0x793414
push edi
call fcn.00652bcd
add esp, 0xc
test eax, eax
je 0x57968d
movzx eax, byte [0x7935dd]
cmp ebx, eax
jne 0x579723
mov esi, 0x7935d0
test al, al
je 0x57968d
push ebx
push 0x7935d4
push edi
call fcn.00652bcd
add esp, 0xc
test eax, eax
je 0x57968d
jmp 0x579723
xor esi, esi
jmp 0x57968d
movzx eax, byte [0x793545]
cmp ebx, eax
jne 0x57971c
mov esi, 0x793538
test al, al
je 0x57968d
push ebx
push 0x79353c
push edi
call fcn.00652bcd
add esp, 0xc
test eax, eax
je 0x57968d
jmp 0x57971c
Function at 0x5801f0
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xac
mov edi, dword [ebp + 8]
mov eax, dword [0x7a9040]
xor eax, ebp
mov dword [ebp - 0x10], eax
movaps xmm0, xmmword [0x78f450]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x580220
mov eax, dword [edi]
sub esp, 0x1c
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x110000
call ebx
cmp eax, 0xffffffff
je 0x5802b6
mov esi, eax
lea eax, [ebp - 0xb4]
mov dword [eax], 2
xor edi, edi
push edi
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x5803a8
lea eax, [ebp - 0xb8]
mov dword [eax], edi
push edi
push eax
push 0xc
push dword [ebp + 0x10]
push 0x24
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x58036c
mov bl, 1
cmp dword [ebp - 0xb8], 0xc
jne 0x5803f6
push esi
call fcn.00580d40
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, ebx
add esp, 0xac
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x58031e
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x5802cd
mov eax, dword [edi]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
movaps xmm0, xmmword [0x78f450]
jne 0x580216
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x580365
call fcn.006a5890
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 2
push 0x71
push 0x78f480
call fcn.006a5a40
lea eax, [ebp - 0xa8]
push 0xd
push str.WaitNamedPipe
jmp 0x580355
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x580365
call fcn.006a5890
lea esi, [ebp - 0xb0]
mov ecx, esi
push eax
push 2
push 0x6c
push 0x78f480
call fcn.006a5a40
lea eax, [ebp - 0xa8]
push 0xa
push 0x78f4ca
push eax
call fcn.005b72e0
add esp, 0xc
mov ecx, esi
call fcn.006a5aa0
xor ebx, ebx
jmp 0x58029f
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x5803ef
call fcn.006a5890
lea edi, [ebp - 0xb0]
mov ecx, edi
push eax
push 2
push 0x88
push 0x78f480
call fcn.006a5a40
lea eax, [ebp - 0xa8]
push 0x11
push 0x78f4fb
jmp 0x5803df
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x5803ef
call fcn.006a5890
lea edi, [ebp - 0xb0]
mov ecx, edi
push eax
push 2
push 0x7a
push 0x78f480
call fcn.006a5a40
lea eax, [ebp - 0xa8]
push 0x17
push 0x78f4e3
push eax
call fcn.005b72e0
add esp, 0xc
mov ecx, edi
call fcn.006a5aa0
xor ebx, ebx
jmp 0x580296
push 2
call fcn.005e3f20
add esp, 4
test al, al
je 0x5803ef
lea edi, [ebp - 0xb0]
mov ecx, edi
push 2
push 0x8c
push 0x78f480
call fcn.0053b2e0
lea eax, [ebp - 0xa8]
push 0x1c
push str.TransactNamedPipe:_expected
push eax
call fcn.005b72e0
add esp, 0xc
mov ecx, eax
push 0xc
call fcn.005b6be0
push 0xb
push str.__observed
push eax
call fcn.005b72e0
add esp, 0xc
mov ecx, eax
push dword [ebp - 0xb8]
call fcn.0047d0c0
mov ecx, edi
call fcn.0053b7a0
jmp 0x5803ef
Function at 0x580470
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x12c
mov esi, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov ecx, dword [0x7a9040]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
xor ecx, ecx
dec ecx
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], ecx
test al, al
je 0x58054b
lea ebx, [ebp - 0x120]
xor edi, edi
push 0x110
push edi
push ebx
call fcn.006547d0
add esp, 0xc
mov dword [ebx - 0xc], 0x11c
sub esp, 0x10
movaps xmm0, xmmword [0x73b2b0]
movups xmmword [esp], xmm0
mov ebx, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call ebx
mov ecx, 3
push ecx
push 1
push edx
push eax
call ebx
mov ecx, 3
push ecx
push 0x20
push edx
push eax
call ebx
lea ecx, [ebp - 0x120]
mov dword [ecx - 8], 6
mov dword [ecx - 4], edi
mov word [ecx + 0x108], 0
lea ecx, [ebp - 0x12c]
push edx
push eax
push 0x23
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov ebx, 0x80003
test eax, eax
je 0x580552
lea edi, [ebp - 0x138]
mov dword [edi], 0xc
push 0
call fcn.005805a0
add esp, 4
mov dword [edi + 4], eax
mov dword [edi + 8], 1
jmp 0x580552
xor edi, edi
mov ebx, 3
cmp byte [esi + 0xb], 0
jns 0x58055a
mov esi, dword [esi]
sub esp, 0x20
mov dword [esp + 0x1c], edi
movaps xmm0, xmmword [0x78f460]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00650d60
mov eax, esi
add esp, 0x12c
pop esi
pop edi
pop ebx
pop ebp
ret