joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50ea00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb8000]
push edi
jmp 0x50ea1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50ea21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50ea10
mov eax, 1
add ebx, ebx
jne 0x50ea33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50ea44
jne 0x50ea63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50ea63
dec eax
add ebx, ebx
jne 0x50ea50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x50ea28
add ebx, ebx
jne 0x50ea5f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x50eab5
xor ecx, ecx
sub eax, 3
jb 0x50ea7b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50eaea
sar eax, 1
mov ebp, eax
jmp 0x50ea86
add ebx, ebx
jne 0x50ea86
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50ea54
inc ecx
add ebx, ebx
jne 0x50ea94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50ea54
add ebx, ebx
jne 0x50eaa1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50ea96
jne 0x50eab2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50ea96
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50ead4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50eac6
jmp 0x50ea16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50ead4
add edi, ecx
jmp 0x50ea16
pop esi
mov edi, esi
mov ecx, 0x3ee5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x50eaf2
cmp byte [edi], 0x11
jne 0x50eaf2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x50eaf7
lea edi, [esi + 0x107000]
mov eax, dword [edi]
or eax, eax
je 0x50eb6f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1449ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x144b68]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50eb24
mov ecx, edi
jns 0x50eb53
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x144b6c]
or eax, eax
je 0x50eb69
mov dword [ebx], eax
add ebx, 4
jmp 0x50eb41
call dword [esi + 0x144b7c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x50eba0
cmp al, 0xef
ja 0x50eb93
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x50eb75
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x50eb82
mov ebp, dword [esi + 0x144b70]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50ebd4
sub esp, 0xffffff80
jmp 0x427f4a
Function at 0x10006540
Capabilities:
Get common file path

Disassembly:
sub esp, 0x804
mov eax, dword [0x1000d004]
xor eax, esp
mov dword [esp + 0x800], eax
push ebp
mov ebp, dword [esp + 0x80c]
lea eax, [esp + 0x204]
push esi
push edi
push 0x200
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x20c]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_strrchr
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov esi, eax
add esp, 8
test esi, esi
je 0x100065db
push str.System
push esi
call edi
add esp, 8
test eax, eax
jne 0x100065ad
push str.System32
push esi
call edi
add esp, 8
test eax, eax
je 0x100065db
lea ecx, [esp + 0x20c]
mov byte [esi], 0
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x100065b8
mov eax, dword [str.Fonts]
mov dword [ecx], eax
mov ax, word [0x10009b24]
mov word [ecx + 4], ax
mov al, byte [0x10009b26]
mov byte [ecx + 6], al
push 0x200
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0xc]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100065f2
sub ecx, edx
cmp ecx, 0x1f9
jbe 0x10006609
mov byte [esp + 0xc], al
jmp 0x10006633
lea ecx, [esp + 0xc]
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x10006610
mov eax, dword [str.Fonts]
mov dword [ecx], eax
mov ax, word [0x10009b24]
mov word [ecx + 4], ax
mov al, byte [0x10009b26]
mov byte [ecx + 6], al
xor ecx, ecx
mov al, byte [esp + ecx + 0x20c]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x40b], al
test al, al
jne 0x10006635
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x210]
push eax
call edi
add esp, 8
test eax, eax
je 0x100066a8
lea edi, [esp + 0x40c]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10006668
mov ax, word [0x10009b28]
lea edx, [esp + 0xc]
mov word [edi], ax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x10006681
lea edi, [esp + 0x40c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10006692
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [esp + 0x40c]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x100066b2
mov eax, dword [ebp]
sub esi, ecx
push esi
push ebp
mov eax, dword [eax + 0x2c0]
call eax
mov edi, eax
test edi, edi
je 0x10006709
mov eax, dword [ebp]
push ebx
push 0
push edi
mov eax, dword [eax + 0x2e0]
push ebp
call eax
mov ebx, eax
test ebx, ebx
je 0x10006706
push esi
lea eax, [esp + 0x414]
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp]
add esp, 0xc
mov eax, dword [eax + 0x300]
push 0
push ebx
push edi
push ebp
call eax
mov eax, edi
pop ebx
mov ecx, dword [esp + 0x80c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10007003
add esp, 0x804
ret 8
Function at 0x10006c10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebp
push esi
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 4
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionFontLinkSystemLink
push 0x80000002
mov dword [esp + 0x28], 7
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10006d3c
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x24]
push 0
push esi
mov eax, dword [edi]
push edi
mov eax, dword [eax + 0x294]
call eax
mov ebp, eax
lea eax, [esp + 0x10]
push eax
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push ebp
push dword [esp + 0x20]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x10006d3c
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10006d3c
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x10006cc3
mov eax, dword [edi]
push ebp
push esi
push edi
mov eax, dword [eax + 0x298]
call eax
push dword [esp + 0x10]
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret 0xc
lea eax, [esp + 0x14]
push eax
push ebx
lea eax, [esp + 0x20]
push eax
push 0
push ebp
push dword [esp + 0x24]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ecx, dword [edi]
mov esi, eax
push ebp
push dword [esp + 0x2c]
mov ecx, dword [ecx + 0x298]
push edi
call ecx
push dword [esp + 0x10]
call dword [sym.imp.advapi32.dll_RegCloseKey]
test esi, esi
je 0x10006d11
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x14]
mov ecx, dword [edi]
shr eax, 1
push eax
push ebx
mov eax, dword [ecx + 0x28c]
push edi
call eax
push ebx
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret 0xc

Function at 0x10006d50
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x1000d004]
xor eax, esp
mov dword [esp + 0x9c], eax
push edi
mov edi, dword [esp + 0xa8]
lea eax, [esp + 8]
push 0x98
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 4], 0x9c
lea eax, [esp + 4]
push eax
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
jne 0x10006dad
pop edi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.10007003
add esp, 0xa0
ret
cmp dword [esp + 8], 6
push esi
sbb esi, esi
and esi, 0xfffffffc
add esi, 0x1f8
push esi
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [edi], esi
push 0
push edi
push esi
push 0x29
call dword [sym.imp.user32.dll_SystemParametersInfoW]
mov ecx, dword [esp + 0xa4]
pop esi
pop edi
xor ecx, esp
call fcn.10007003
add esp, 0xa0
ret
Function at 0x10007baf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10007bbe
pop dword [ebp - 0x34]
mov eax, 0x4affdd16
sub eax, 0x3aff6158
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xb4f0b21b
sub dword [ebp - 0x44], 0x669e6cd0
mov dword [ebp - 0x40], 0x82626a4a
sub dword [ebp - 0x40], 0x502f1e05
mov dword [ebp - 0x3c], 0xd4328e13
add dword [ebp - 0x3c], 0x7819b61b
mov dword [ebp - 0x38], 0xf97c08fc
add dword [ebp - 0x38], 0x683f704
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xbb285683
sub dword [ebp - 0x44], 0x46b5ed2d
mov dword [ebp - 0x40], 0x7971e956
sub dword [ebp - 0x40], 0x380587e1
mov dword [ebp - 0x3c], 0xacbff251
sub dword [ebp - 0x3c], 0x495085e5
mov dword [ebp - 0x38], 0xcab15528
add dword [ebp - 0x38], 0x354eaad8
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xbb8c421a
sub eax, 0xab8bc1d2
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3a6be
push 0
call eax
mov ecx, 0x5704
mov ebx, eax
mov edi, 0x85710c7
sub edi, 0xf85616c7
add edi, dword [ebp - 0x34]
mov edx, 0x6ca57f7f
add dword [ebp - 8], 0xbd319611
mov esi, dword [edi]
xor dword [ebp - 0x28], eax
xor esi, edx
sub dword [ebp - 0xc], 0xf9fb445b
mov dword [ebx], esi
add dword [ebp - 8], 0xa3e58559
add ebx, 4
add edi, 0x818aecec
add edi, 0x7e751318
loop 0x10007ccf
add eax, 0xb702fcf8
sub eax, 0xb701ae15
xor ebx, ebx
add ebx, eax
add eax, 0xd1a98b64
sub eax, 0xd1a98b5f
mov ecx, 0x5a378ee0
add ecx, 0xb5c87120
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x1000113f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1000114e
pop dword [ebp - 0x18]
mov eax, 0x1000114e
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x4dde5271
add dword [ebp - 0x28], 0x73f2da
mov dword [ebp - 0x24], 0x8c73d273
sub dword [ebp - 0x24], 0x5a40862e
mov dword [ebp - 0x20], 0x4c4c5440
add dword [ebp - 0x20], 0xffffefee
mov dword [ebp - 0x1c], 0xbc2729f
add dword [ebp - 0x1c], 0xf43d8d61
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x60794321
add dword [ebp - 0x28], 0x13f92635
mov dword [ebp - 0x24], 0x1ff5a95f
add dword [ebp - 0x24], 0x2176b816
mov dword [ebp - 0x20], 0x261a44b4
sub dword [ebp - 0x20], 0xc2aad848
mov dword [ebp - 0x1c], 0xb3977cc2
sub dword [ebp - 0x1c], 0xb3977cc2
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xb9de2513
add eax, 0x56220aed
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x37322
push 0
call eax
mov ecx, 0x8bdfc884
sub ecx, 0x8bdf7dbe
mov ebx, eax
mov edi, 0xe17d72b2
sub edi, 0xd17d10b2
add edi, dword [ebp - 0x18]
mov edx, 0x15664420
add edx, 0xc5a63708
xor dword [ebp - 0x14], 0xa6504019
mov esi, dword [edi]
add dword [ebp - 8], 0x552cf873
sub esi, edx
sub dword [ebp - 0x10], eax
mov dword [ebx], esi
sub dword [ebp - 8], ebx
add ebx, 0xe9845837
sub ebx, 0xe9845833
add edi, 4
loop 0x10001266
add eax, 0xa41fc6ac
sub eax, 0xa41ea8c1
xor ebx, ebx
add ebx, eax
add eax, 0x7114354
add eax, 0xf8eebcb1
mov ecx, 0xb0850e88
sub ecx, 0xa0850e88
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x10001822
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x1000182c
repz ret
jmp fcn.10001bc2
Function at 0x100295e7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x100295f6
pop dword [ebp - 0x14]
mov eax, 0x2dd3b20c
add eax, 0xe22ee3ea
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xab97a250
sub dword [ebp - 0x24], 0x5d455d05
mov dword [ebp - 0x20], 0x4ccb28ad
add dword [ebp - 0x20], 0xe5682398
mov dword [ebp - 0x1c], 0x847765aa
sub dword [ebp - 0x1c], 0x382b217c
mov dword [ebp - 0x18], 0x40f25dc1
sub dword [ebp - 0x18], 0x40f25dc1
lea eax, [ebp - 0x24]
push eax
mov eax, 0xc85c0670
add eax, 0x47a8c870
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x63131eb9
add dword [ebp - 0x24], 0x115f4a9d
mov dword [ebp - 0x20], 0x44747fb6
add dword [ebp - 0x20], 0xfcf7e1bf
mov dword [ebp - 0x1c], 0x4ac823a1
sub dword [ebp - 0x1c], 0xe758b735
mov dword [ebp - 0x18], 0xf4f69d9f
sub dword [ebp - 0x18], 0xf4f69d9f
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x129894a7
add eax, 0xfd6c39dd
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x45f8d
push 0
call eax
mov ecx, 0xa8ceba06
add ecx, 0x5731a6f0
mov ebx, eax
mov esi, 0x1005b400
add esi, dword [ebp - 0x14]
mov edi, 0x79c988cd
sub edi, 0x4484d6cb
add dword [ebp - 8], 0xf105e62
mov edx, dword [esi]
add edx, edi
sub dword [ebp - 0x10], 0x34ed9fab
mov dword [ebx], edx
xor dword [ebp - 8], edi
add ebx, 0xcedd2bfc
add ebx, 0x3122d408
add esi, 0xbd7a99d0
add esi, 0x42856634
loop 0x10029712
add eax, 0x76144bc0
add eax, 0x89ed2aeb
mov ebx, eax
add eax, 0xd5e391f
add eax, 0xf2a1c6e6
mov ecx, 0x2d075e5c
add ecx, 0xe2f8a1a4
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x1000f188
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1000f197
pop dword [ebp - 0x40]
mov eax, 0x1000f197
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x369bd
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x4149ba7e
add ecx, 0xbeb6839f
xor edi, edi
add edi, eax
mov esi, 0xf15bf088
add esi, 0x1ea59578
add esi, dword [ebp - 0x40]
mov ebx, 0xeddc81e3
add ebx, 0x7bafe97
add dword [ebp - 0x3c], 0x104a3c2a
mov edx, dword [esi]
xor edx, ebx
add dword [ebp - 0x10], 0xccc979ae
mov dword [edi], edx
sub dword [ebp - 0x34], eax
add edi, 0x342d364c
sub edi, 0x342d3648
add esi, 4
loop 0x1000f1ee
add eax, 0xf8ea843b
sub eax, 0xf8e998f4
mov ebx, eax
add eax, 0x52593454
add eax, 0xada6cbb1
mov ecx, 0x810d88b1
sub ecx, 0x710d88b1
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x2a8563c2
Capabilities:
Check if file exists

Disassembly:
push 0x64
mov eax, 0x2a982cdf
call fcn.2a84a73f
mov ebx, ecx
cmp dword [ebx + 4], 0xffffffff
jne 0x2a856503
push 0xffffffffffffffff
lea edi, [ebx + 0xc]
push 0x2a98b17c
mov ecx, edi
call fcn.2a863ee0
mov eax, dword [ebx]
push 0
push 0xffffffffffffffff
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2a9884bc]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x54]
call fcn.2a84a6ed
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
mov ecx, edi
call fcn.2a8c938e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.2a84cb09
lea ecx, [ebp - 0x4c]
call fcn.2a84cb2b
push edi
lea ecx, [ebp - 0x3c]
call fcn.2a851f08
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 1
call fcn.2a8c9bbe
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
call fcn.2a8ca4aa
mov esi, eax
mov dword [ebp - 0x18], vtable.RSSecurityUtilsWin::CLocalFreeGuard.0
pop ecx
mov dword [ebp - 0x14], esi
mov ecx, dword [ebx + 8]
xor edi, edi
mov byte [ebp - 4], 3
cmp dword [ecx], edi
jne 0x2a8564c8
lea ecx, [ebp - 0x3c]
call fcn.2a8c9bbe
push edi
push 0x40110000
push 3
lea ecx, [ebp - 0x24]
push ecx
push edi
push 0xc0000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
jne 0x2a8564c8
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x2a85651f
cmp eax, 0xe7
jne 0x2a856509
lea ecx, [ebp - 0x3c]
call fcn.2a8c9bbe
push 0x4e20
push eax
call dword [sym.imp.kernel32.dll_WaitNamedPipeA]
test eax, eax
je 0x2a85652e
mov eax, dword [ebx + 8]
cmp dword [eax], edi
je 0x2a85646e
cmp dword [ebx + 4], 0xffffffff
je 0x2a8564e4
push edi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 2
push eax
push dword [ebx + 4]
call dword [sym.imp.kernel32.dll_SetNamedPipeHandleState]
mov byte [ebp - 4], 6
test esi, esi
je 0x2a8564f3
push esi
call dword [sym.imp.kernel32.dll_LocalFree]
lea ecx, [ebp - 0x2c]
call fcn.2a84cb09
lea ecx, [ebp - 0x34]
call fcn.2a84cb2b
call fcn.2a84aa52
ret
push edi
push 0xffffffffffffffff
push str.Problem_Opening_channel
lea ecx, [ebp - 0x54]
call fcn.2a84a6ed
mov byte [ebp - 4], 4
jmp 0x2a856542
lea ecx, [ebp - 0x70]
call fcn.2a85615f
push 0x2a9f0450
jmp 0x2a856553
push edi
push 0xffffffffffffffff
push str.Problem_Opening_channel__all_pipe_instances_are_busy
lea ecx, [ebp - 0x54]
call fcn.2a84a6ed
mov byte [ebp - 4], 5
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x70]
call fcn.2a863ee0
push 0x2a9f04a8
lea eax, [ebp - 0x70]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a8567ed
Capabilities:
Read file on windows

Disassembly:
push 0x5c
mov eax, 0x2a982d4d
call fcn.2a84a73f
mov edi, ecx
xor ebx, ebx
lea eax, [ebp - 0x30]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
je 0x2a856959
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x2a856943
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
je 0x2a8568c5
cmp eax, 0x6d
je 0x2a8568f3
push ebx
push 0xffffffffffffffff
push str.Read_Error
lea ecx, [ebp - 0x48]
call fcn.2a84a6ed
mov byte [ebp - 4], 4
jmp 0x2a85696d
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
cmp eax, 1
je 0x2a8568d7
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x2a8568c5
cmp eax, 0xffffffff
je 0x2a856902
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x2a856888
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, ebx
je 0x2a85690b
sub eax, 1
jne 0x2a85683a
lea ecx, [ebp - 0x68]
call fcn.2a85607f
push 0x2a9f04c4
jmp 0x2a85697e
mov dword [ebp - 4], 2
jmp 0x2a85694a
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
test eax, eax
jne 0x2a856943
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x6d
je 0x2a8568f3
push ebx
push 0xffffffffffffffff
push str.unexpected_error
lea ecx, [ebp - 0x48]
call fcn.2a84a6ed
mov byte [ebp - 4], 3
jmp 0x2a85696d
mov dword [ebp - 4], 5
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a84aa52
ret 8
push ebx
push 0xffffffffffffffff
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.2a84a6ed
mov byte [ebp - 4], 1
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x68]
call fcn.2a863ee0
push 0x2a9f04a8
lea eax, [ebp - 0x68]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a856988
Capabilities:
Read file on windows

Disassembly:
push 0x58
mov eax, 0x2a982d88
call fcn.2a84a73f
mov edi, ecx
xor ebx, ebx
lea eax, [ebp - 0x30]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
je 0x2a856a94
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x2a856a7e
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x2a856a63
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, ebx
je 0x2a856a2b
sub eax, 1
jne 0x2a8569d5
lea ecx, [ebp - 0x64]
call fcn.2a85607f
push 0x2a9f04c4
jmp 0x2a856ab9
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
test eax, eax
jne 0x2a856a7e
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x6d
je 0x2a856a19
push ebx
push 0xffffffffffffffff
push str.unexpected_error
lea ecx, [ebp - 0x48]
call fcn.2a84a6ed
mov byte [ebp - 4], 2
jmp 0x2a856aa8
cmp eax, 0x6d
je 0x2a856a19
push ebx
push 0xffffffffffffffff
push str.Read_Error
lea ecx, [ebp - 0x48]
call fcn.2a84a6ed
mov byte [ebp - 4], 3
jmp 0x2a856aa8
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a84aa52
ret 8
push ebx
push 0xffffffffffffffff
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.2a84a6ed
mov byte [ebp - 4], 1
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.2a863ee0
push 0x2a9f04a8
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a856af3
Capabilities:
Write file on windows

Disassembly:
push 0x74
mov eax, 0x2a982dbb
call fcn.2a84a73f
mov edi, ecx
cmp dword [edi + 4], 0xffffffff
je 0x2a856c2d
xor ebx, ebx
lea eax, [ebp - 0x30]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
jne 0x2a856b6f
push ebx
push esi
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.2a84a6ed
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x64]
call fcn.2a863ee0
push 0x2a9f04a8
jmp 0x2a856c3a
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x2a856bc4
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x2a856bda
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, ebx
je 0x2a856bb1
sub eax, 1
jne 0x2a856b6f
jmp 0x2a856c2d
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
push esi
mov dword [ebp - 4], 3
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a84aa52
ret 8
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xe8
je 0x2a856c1e
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xe9
je 0x2a856c1e
push ebx
push 0xffffffffffffffff
push str.Connection_Closed
lea ecx, [ebp - 0x48]
call fcn.2a84a6ed
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x80]
call fcn.2a863ee0
push 0x2a9f04a8
lea eax, [ebp - 0x80]
jmp 0x2a856c3d
lea ecx, [ebp - 0x80]
call fcn.2a85607f
push 0x2a9f04c4
jmp 0x2a856c19
lea ecx, [ebp - 0x64]
call fcn.2a85607f
push 0x2a9f04c4
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3