joyce8/EMBER2024-capa huggingface dataset:
Function at 0x21016b70
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x2107dc44
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp dword [ebp + 8], 0
je 0x21016ba2
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x21016bab
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x2107dc44
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esp, ebp
pop ebp
ret

Function at 0x21016e34
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x210], 0
jmp 0x21016e68
mov eax, dword [ebp - 0x210]
add eax, 1
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp - 0x218]
mov edx, dword [ebp - 0x210]
cmp edx, dword [ecx]
jge 0x21016f86
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x218]
call fcn.2101709b
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x21016e9f
jmp 0x21016e59
push 0x104
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp - 0x210]
push edx
mov ecx, dword [ebp - 0x218]
call fcn.21017119
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.210153c3
add esp, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x21c], ecx
cmp dword [ebp - 0x21c], 0
je 0x21016ee7
cmp dword [ebp - 0x21c], 2
je 0x21016f03
jmp 0x21016f3a
push 0
lea edx, [ebp - 0x208]
push edx
call fcn.21014f29
add esp, 8
test eax, eax
je 0x21016f01
jmp 0x21016e59
jmp 0x21016f3a
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.21014f29
add esp, 8
test eax, eax
je 0x21016f3a
push 0
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp - 0x20c]
push edx
call fcn.2101495a
add esp, 0xc
cmp eax, 1
jne 0x21016f3a
jmp 0x21016e59
push 1
lea eax, [ebp - 0x208]
push eax
call fcn.2101666b
add esp, 8
push 0
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x214]
add ecx, eax
mov dword [ebp - 0x214], ecx
push 0x80
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x21016e59
mov eax, dword [ebp - 0x214]
mov esp, ebp
pop ebp
ret 8
Function at 0x21016f92
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
jmp 0x21016fb4
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
cmp edx, dword [ecx]
jge 0x21017007
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.2101709b
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x21016fd5
jmp 0x21016fab
cmp dword [ebp + 8], 0
je 0x21016ff3
push 1
mov ecx, dword [ebp - 4]
push ecx
call fcn.2101666b
add esp, 8
mov edx, dword [ebp - 0xc]
add edx, eax
mov dword [ebp - 0xc], edx
jmp 0x21017005
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov dword [ebp - 0xc], ecx
jmp 0x21016fab
mov ecx, dword [ebp - 0x10]
call fcn.21017018
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x21018745
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2107a32b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
lea ecx, [ebp - 0x44]
call fcn.210496b0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov word [eax], 0
mov ecx, dword [0x2108bf94]
push ecx
push 0x80000002
lea edx, [ebp - 0x44]
push edx
call fcn.2104abba
add esp, 0xc
test eax, eax
je 0x210187ab
push 0
push 0x104
mov eax, dword [ebp + 8]
push eax
push str.Common_Programs
lea ecx, [ebp - 0x44]
call fcn.2104a941
mov ecx, dword [ebp + 8]
xor edx, edx
mov dx, word [ecx]
mov dword [ebp - 0x48], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.21049735
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x21018a2f
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2107a38a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
lea ecx, [ebp - 0x44]
call fcn.210496b0
mov dword [ebp - 4], 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
lea eax, [ebp - 0x44]
push eax
call fcn.2104abba
add esp, 0xc
test eax, eax
je 0x21018aca
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x44]
call fcn.2104a156
mov dword [ebp - 0x4c], eax
jmp 0x21018a93
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x44]
call fcn.2104a705
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x21018aca
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.2105e86f
add esp, 8
test eax, eax
jne 0x21018ac8
mov dword [ebp - 0x50], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.21049735
mov eax, dword [ebp - 0x50]
jmp 0x21018ae3
jmp 0x21018a84
mov dword [ebp - 0x54], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.21049735
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x210202b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2107a90c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0x18
call fcn.210501f0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
mov dword [eax], 0x2107dc94
push 0x208
call fcn.2106e07d
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 4], edx
push 0x104
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x208
call fcn.2106e07d
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 8]
mov word [edx], 0
push 0x208
call fcn.2106e07d
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0xc]
mov word [eax], 0
push 0x208
call fcn.2106e07d
add esp, 4
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x10]
mov word [ecx], 0
lea edx, [ebp - 0x10]
push edx
push 0x208
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 8]
push ecx
push 1
mov edx, dword [0x2108e7cc]
push edx
push 0
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryW
push 0x104
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 8]
push ecx
push 0x2108d96c
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 8]
push eax
call fcn.210153c3
add esp, 0x10
lea ecx, [ebp - 0x10]
push ecx
push 0x208
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0xc]
push eax
push 1
mov ecx, dword [0x2108e7cc]
push ecx
push 0
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryW
push 0x104
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0xc]
push eax
push 0x2108d970
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0xc]
push edx
call fcn.210153c3
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x208
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x10]
push edx
push 1
mov eax, dword [0x2108e7d0]
push eax
push 0
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryW
test eax, eax
je 0x21020443
push 0x104
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x10]
push edx
push 0x2108d974
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.210153c3
add esp, 0x10
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x14], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x21026514
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
mov dword [ebp - 0x2c4], ecx
cmp dword [ebp + 0xc], 0
je 0x21026652
mov eax, dword [ebp - 0x2c4]
add eax, 0x7c
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2b8], ecx
mov edx, dword [ebp - 0x2b8]
push edx
call fcn.2106d2d1
mov ecx, dword [ebp - 0x2bc]
xor edx, edx
div dword [ecx + 8]
mov dword [ebp - 0x2a8], edx
mov edx, dword [ebp - 0x2bc]
cmp dword [edx + 4], 0
jne 0x2102657d
mov dword [ebp - 0x2a4], 0
jmp 0x21026609
mov eax, dword [ebp - 0x2bc]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x2a8]
mov eax, dword [ecx + edx*4]
mov dword [ebp - 0x2ac], eax
jmp 0x210265a5
mov ecx, dword [ebp - 0x2ac]
mov edx, dword [ecx]
mov dword [ebp - 0x2ac], edx
cmp dword [ebp - 0x2ac], 0
je 0x210265ff
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x2b4], eax
mov ecx, dword [ebp - 0x2b4]
push ecx
mov edx, dword [ebp - 0x2ac]
mov eax, dword [edx + 8]
push eax
call fcn.2105e83a
add esp, 8
mov dword [ebp - 0x2b0], eax
xor ecx, ecx
cmp dword [ebp - 0x2b0], 0
sete cl
and ecx, 0xff
test ecx, ecx
je 0x210265fd
mov edx, dword [ebp - 0x2ac]
mov dword [ebp - 0x2a4], edx
jmp 0x21026609
jmp 0x21026597
mov dword [ebp - 0x2a4], 0
cmp dword [ebp - 0x2a4], 0
jne 0x2102661e
mov dword [ebp - 0x2c0], 0
jmp 0x21026637
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x2a0], ecx
mov dword [ebp - 0x2c0], 1
cmp dword [ebp - 0x2c0], 0
jne 0x21026647
xor eax, eax
jmp 0x21026730
mov eax, dword [ebp - 0x2a0]
jmp 0x21026730
mov edx, dword [ebp - 0x2c4]
cmp dword [edx + 8], 0
jne 0x21026665
xor eax, eax
jmp 0x21026730
lea eax, [ebp - 0x298]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ecx], 0x131
mov edx, dword [ebp - 8]
add edx, 4
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x2c4]
cmp dword [eax + 0x10], 0
je 0x210266bb
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x142
mov edx, dword [ebp - 8]
push edx
call fcn.21003492
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call fcn.2105e7d8
add esp, 4
lea ecx, [eax + eax + 6]
mov dword [ebp - 0x29c], ecx
jmp 0x210266e9
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0x142
mov eax, dword [ebp - 8]
push eax
call fcn.2100338d
add esp, 0x14
mov ecx, dword [ebp - 8]
push ecx
call fcn.2105ed30
add esp, 4
add eax, 5
mov dword [ebp - 0x29c], eax
push 8
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.2105e780
add esp, 0xc
push 0
lea eax, [ebp - 4]
push eax
push 8
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x29c]
push edx
lea eax, [ebp - 0x298]
push eax
mov ecx, dword [ebp - 0x2c4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
cmp dword [ebp - 0x10], 0
jne 0x2102672d
xor eax, eax
jmp 0x21026730
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x210269a1
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
push 0xffffffffffffffff
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x54
call fcn.2106d863
mov dword [ebp - 8], 0x12f
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 4]
push eax
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
cmp dword [ebp - 0x10], 0
jne 0x210269f3
mov eax, 1
jmp 0x21026a5e
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
push ecx
call fcn.21058ce7
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x21026a16
mov eax, 1
jmp 0x21026a5e
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x10], 0
je 0x21026a34
mov eax, dword [ebp - 0x18]
add eax, 0x54
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.21038bc8
add esp, 8
jmp 0x21026a47
mov edx, dword [ebp - 0x18]
add edx, 0x54
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.21038ae8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.2106e0a6
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x2102700a
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov dword [ebp - 0x228], ecx
mov dword [ebp - 8], 0x135
push 0x200
push 0
lea eax, [ebp - 0x214]
push eax
call fcn.2105e780
add esp, 0xc
push 0
lea ecx, [ebp - 4]
push ecx
push 0x200
lea edx, [ebp - 0x214]
push edx
push 4
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x228]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov eax, dword [ebp - 0x228]
cmp dword [eax + 0x10], 0
je 0x210270e8
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x21c], ecx
mov edx, dword [ebp - 0x21c]
push edx
call fcn.2105e7d8
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
lea ecx, [eax + eax + 1]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x228]
add ecx, 0x18
call fcn.2106e81c
mov dword [ebp - 0x218], eax
push 0
mov eax, dword [ebp - 0x21c]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x218]
push edx
call fcn.21003492
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x228]
add ecx, 0x18
call fcn.2106e7f3
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x21c]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0xc], edx
jmp 0x21027163
lea eax, [ebp - 0x214]
mov dword [ebp - 0x220], eax
mov ecx, dword [ebp - 0x220]
push ecx
call fcn.2105ed30
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x228]
add ecx, 0x18
call fcn.2106e81c
mov dword [ebp - 0x218], eax
push 0
mov ecx, dword [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x218]
push eax
call fcn.210032b2
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x228]
add ecx, 0x18
call fcn.2106e7f3
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x220]
lea eax, [edx + ecx + 1]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x228]
mov edx, dword [ebp - 0xc]
mov ax, word [edx]
mov word [ecx + 0x20], ax
mov ecx, dword [ebp - 0xc]
add ecx, 2
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0xc]
add edx, 4
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x228]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x224], ecx
mov edx, dword [ebp - 0x228]
xor eax, eax
mov ax, word [edx + 0x20]
and eax, 0xff
and eax, 0xff
push eax
mov ecx, dword [ebp - 0x228]
xor edx, edx
mov dx, word [ecx + 0x20]
shr edx, 8
and edx, 0xff
push edx
mov eax, dword [ebp - 0x224]
push eax
push str._s_v_d._02d
mov ecx, dword [ebp - 0x228]
add ecx, 0x14
push ecx
call fcn.2106d193
add esp, 0x14
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x210271f6
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
push 0xffffffffffffffff
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x68
call fcn.2106d863
mov dword [ebp - 8], 0x130
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 4]
push eax
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
cmp dword [ebp - 0x10], 0
jne 0x21027248
mov eax, 1
jmp 0x210272b3
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
push ecx
call fcn.21058ce7
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x2102726b
mov eax, 1
jmp 0x210272b3
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x10], 0
je 0x21027289
mov eax, dword [ebp - 0x18]
add eax, 0x68
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.21038bc8
add esp, 8
jmp 0x2102729c
mov edx, dword [ebp - 0x18]
add edx, 0x68
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.21038ae8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.2106e0a6
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x2102757f
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
mov dword [ebp - 0x2c4], ecx
cmp dword [ebp + 0xc], 0
je 0x210276bf
mov eax, dword [ebp - 0x2c4]
add eax, 0x98
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2b8], ecx
mov edx, dword [ebp - 0x2b8]
push edx
call fcn.2106d2d1
mov ecx, dword [ebp - 0x2bc]
xor edx, edx
div dword [ecx + 8]
mov dword [ebp - 0x2a8], edx
mov edx, dword [ebp - 0x2bc]
cmp dword [edx + 4], 0
jne 0x210275ea
mov dword [ebp - 0x2a4], 0
jmp 0x21027676
mov eax, dword [ebp - 0x2bc]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x2a8]
mov eax, dword [ecx + edx*4]
mov dword [ebp - 0x2ac], eax
jmp 0x21027612
mov ecx, dword [ebp - 0x2ac]
mov edx, dword [ecx]
mov dword [ebp - 0x2ac], edx
cmp dword [ebp - 0x2ac], 0
je 0x2102766c
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x2b4], eax
mov ecx, dword [ebp - 0x2b4]
push ecx
mov edx, dword [ebp - 0x2ac]
mov eax, dword [edx + 8]
push eax
call fcn.2105e83a
add esp, 8
mov dword [ebp - 0x2b0], eax
xor ecx, ecx
cmp dword [ebp - 0x2b0], 0
sete cl
and ecx, 0xff
test ecx, ecx
je 0x2102766a
mov edx, dword [ebp - 0x2ac]
mov dword [ebp - 0x2a4], edx
jmp 0x21027676
jmp 0x21027604
mov dword [ebp - 0x2a4], 0
cmp dword [ebp - 0x2a4], 0
jne 0x2102768b
mov dword [ebp - 0x2c0], 0
jmp 0x210276a4
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x2a0], ecx
mov dword [ebp - 0x2c0], 1
cmp dword [ebp - 0x2c0], 0
jne 0x210276b4
xor eax, eax
jmp 0x2102779d
mov eax, dword [ebp - 0x2a0]
jmp 0x2102779d
mov edx, dword [ebp - 0x2c4]
cmp dword [edx + 8], 0
jne 0x210276d2
xor eax, eax
jmp 0x2102779d
lea eax, [ebp - 0x298]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dword [ecx], 0x132
mov edx, dword [ebp - 8]
add edx, 4
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x2c4]
cmp dword [eax + 0x10], 0
je 0x21027728
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x142
mov edx, dword [ebp - 8]
push edx
call fcn.21003492
add esp, 0x10
mov eax, dword [ebp - 8]
push eax
call fcn.2105e7d8
add esp, 4
lea ecx, [eax + eax + 6]
mov dword [ebp - 0x29c], ecx
jmp 0x21027756
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0x142
mov eax, dword [ebp - 8]
push eax
call fcn.2100338d
add esp, 0x14
mov ecx, dword [ebp - 8]
push ecx
call fcn.2105ed30
add esp, 4
add eax, 5
mov dword [ebp - 0x29c], eax
push 8
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.2105e780
add esp, 0xc
push 0
lea eax, [ebp - 4]
push eax
push 8
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x29c]
push edx
lea eax, [ebp - 0x298]
push eax
mov ecx, dword [ebp - 0x2c4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
cmp dword [ebp - 0x10], 0
jne 0x2102779a
xor eax, eax
jmp 0x2102779d
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x210277a3
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x80], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
cmp dword [ebp + 0x10], 0
je 0x21027894
mov ecx, dword [ebp - 0x80]
add ecx, 0x38
mov dword [ebp - 0x78], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x74], edx
mov eax, dword [ebp - 0x74]
push eax
call fcn.2106d2d1
mov ecx, dword [ebp - 0x78]
xor edx, edx
div dword [ecx + 8]
mov dword [ebp - 0x64], edx
mov edx, dword [ebp - 0x78]
cmp dword [edx + 4], 0
jne 0x210277f7
mov dword [ebp - 0x60], 0
jmp 0x21027856
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x64]
mov eax, dword [ecx + edx*4]
mov dword [ebp - 0x68], eax
jmp 0x21027810
mov ecx, dword [ebp - 0x68]
mov edx, dword [ecx]
mov dword [ebp - 0x68], edx
cmp dword [ebp - 0x68], 0
je 0x2102784f
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
push ecx
mov edx, dword [ebp - 0x68]
mov eax, dword [edx + 8]
push eax
call fcn.2105e83a
add esp, 8
mov dword [ebp - 0x6c], eax
xor ecx, ecx
cmp dword [ebp - 0x6c], 0
sete cl
and ecx, 0xff
test ecx, ecx
je 0x2102784d
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x60], edx
jmp 0x21027856
jmp 0x21027808
mov dword [ebp - 0x60], 0
cmp dword [ebp - 0x60], 0
jne 0x21027865
mov dword [ebp - 0x7c], 0
jmp 0x21027875
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x7c], 1
cmp dword [ebp - 0x7c], 0
jne 0x21027882
xor eax, eax
jmp 0x21027952
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x5c]
mov dword [edx], eax
mov eax, 1
jmp 0x21027952
mov ecx, dword [ebp - 0x80]
cmp dword [ecx + 8], 0
jne 0x210278a4
xor eax, eax
jmp 0x21027952
lea edx, [ebp - 0x54]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov dword [eax], 0x133
mov ecx, dword [ebp - 8]
add ecx, 4
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x80]
cmp dword [edx + 0x10], 0
je 0x210278ee
push 0
mov eax, dword [ebp + 8]
push eax
push 0x20
mov ecx, dword [ebp - 8]
push ecx
call fcn.21003492
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
call fcn.2105e7d8
add esp, 4
lea eax, [eax + eax + 6]
mov dword [ebp - 0x58], eax
jmp 0x21027916
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x20
mov edx, dword [ebp - 8]
push edx
call fcn.2100338d
add esp, 0x14
mov eax, dword [ebp - 8]
push eax
call fcn.2105ed30
add esp, 4
add eax, 5
mov dword [ebp - 0x58], eax
push 8
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.2105e780
add esp, 0xc
push 0
lea edx, [ebp - 4]
push edx
push 8
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
lea edx, [ebp - 0x54]
push edx
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x21027a6c
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 0x10], 0
je 0x21027aaa
cmp dword [ebp + 8], 0
je 0x21027a8f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xb4]
mov dword [eax], edx
cmp dword [ebp + 0xc], 0
je 0x21027aa3
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xb8]
mov dword [eax], edx
mov eax, 1
jmp 0x21027b0c
mov eax, dword [ebp - 0x18]
cmp dword [eax + 8], 0
jne 0x21027ab7
xor eax, eax
jmp 0x21027b0c
mov dword [ebp - 8], 0x134
push 0xc
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.2105e780
add esp, 0xc
push 0
lea edx, [ebp - 4]
push edx
push 0xc
lea eax, [ebp - 0x14]
push eax
push 4
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
cmp dword [ebp + 8], 0
je 0x21027afb
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
cmp dword [ebp + 0xc], 0
je 0x21027b09
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 0xc