joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011c0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x40d004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push str.BOE0729
push 0x40bc58
push str._s_hs_sDevice_Parameters
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.004023ca
add esp, 0x18
cmp eax, 0x100
jl 0x40121c
mov eax, dword [0x40ea38]
or eax, 0xfffffffe
mov dword [0x40ea38], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004020bf
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x108]
push ecx
push 2
push 0
lea edx, [ebp - 0x104]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40125f
add eax, 0xfffffffe
cmp eax, 1
jbe 0x40124c
or dword [0x40ea38], 0xfffffffe
mov eax, dword [0x40ea38]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004020bf
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x108]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteTreeA]
push str.EDID_OVERRIDE
push eax
call esi
test eax, eax
je 0x4012b6
add eax, 0xfffffffe
cmp eax, 1
jbe 0x4012bd
mov ecx, dword [ebp - 0x108]
mov esi, 0xfffffffe
or dword [0x40ea38], esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4012fd
or dword [0x40ea38], esi
mov eax, dword [0x40ea38]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004020bf
mov esp, ebp
pop ebp
ret
or dword [0x40ea38], 1
mov edx, dword [ebp - 0x108]
push str.EDID
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x401311
add eax, 0xfffffffe
cmp eax, 1
jbe 0x401318
mov eax, dword [ebp - 0x108]
mov esi, 0xfffffffe
or dword [0x40ea38], esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4012fd
or dword [0x40ea38], esi
mov eax, dword [0x40ea38]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004020bf
mov esp, ebp
pop ebp
ret
or dword [0x40ea38], 1
mov ecx, dword [ebp - 0x108]
push str.EDID_RECOVERY
push ecx
call esi
test eax, eax
je 0x40133b
add eax, 0xfffffffe
cmp eax, 1
jbe 0x401342
or dword [0x40ea38], 0xfffffffe
jmp 0x401342
or dword [0x40ea38], 1
mov eax, dword [ebp - 0x108]
call fcn.00401e40
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004020bf
mov esp, ebp
pop ebp
ret
Function at 0x401360
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x40d004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push str.BOE0729
push 0x40bc58
push str._s_hs
mov ebx, 0x100
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.004023ca
add esp, 0x14
cmp eax, ebx
jl 0x4013b8
mov eax, dword [0x40ea38]
or eax, 0xfffffffe
mov dword [0x40ea38], eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004020bf
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x108]
push ecx
push 8
push 0
lea edx, [ebp - 0x104]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4013ea
add eax, 0xfffffffe
cmp eax, 1
jbe 0x4014dc
jmp 0x4014d5
mov eax, dword [ebp + 8]
sub eax, 0
push esi
push edi
je 0x4014a0
dec eax
je 0x40144c
dec eax
jne 0x4014c2
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
xor esi, esi
lea ebx, [ebx]
mov edx, dword [ebp - 0x108]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x104]
push ecx
push esi
push edx
mov dword [ebp - 0x10c], ebx
call edi
test eax, eax
jne 0x401490
lea eax, [ebp - 0x104]
push eax
call fcn.004011c0
add esp, 4
inc esi
jmp 0x401410
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
xor esi, esi
mov eax, dword [ebp - 0x108]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x104]
push edx
push esi
push eax
mov dword [ebp - 0x10c], ebx
call edi
test eax, eax
jne 0x401490
lea ecx, [ebp - 0x104]
push ecx
call section..text
add esp, 4
inc esi
jmp 0x401454
cmp eax, 0x103
je 0x4014c2
or dword [0x40ea38], 0xfffffffe
jmp 0x4014c2
mov edx, dword [ebp - 0x108]
push edx
lea ecx, [ebp - 0x104]
xor edx, edx
call fcn.00401df0
add esp, 4
cmp eax, 1
jne 0x4014c2
or dword [0x40ea38], eax
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
test eax, eax
je 0x4014dc
or dword [0x40ea38], 0xfffffffe
mov ecx, dword [ebp - 4]
mov eax, dword [0x40ea38]
xor ecx, ebp
pop ebx
call fcn.004020bf
mov esp, ebp
pop ebp
ret
Function at 0x4018f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x40d004]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, str.Default_Monitor
mov eax, str.BOE0729
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401930
test dl, dl
je 0x40192c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401930
add eax, 2
add ecx, 2
test dl, dl
jne 0x401910
xor eax, eax
jmp 0x401935
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4019fe
lea eax, [ebp - 0x108]
push eax
push 8
push 0
push str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be10318
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401982
add eax, 0xfffffffe
cmp eax, 1
jbe 0x4019fe
or dword [0x40ea38], 0xfffffffe
mov eax, dword [0x40ea38]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004020bf
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
xor esi, esi
lea esp, [esp]
mov eax, dword [ebp - 0x108]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x10c]
push ecx
lea edx, [ebp - 0x104]
push edx
push esi
push eax
mov dword [ebp - 0x10c], 0x100
call edi
test eax, eax
jne 0x4019d3
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x104]
call fcn.004014f0
add esp, 4
inc esi
jmp 0x401990
mov esi, 0xfffffffe
cmp eax, 0x103
je 0x4019e5
or dword [0x40ea38], esi
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4019fc
or dword [0x40ea38], esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [0x40ea38]
xor ecx, ebp
call fcn.004020bf
mov esp, ebp
pop ebp
ret
Function at 0x45d7f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x35000]
push edi
jmp 0x45d80a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45d811
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45d800
mov eax, 1
add ebx, ebx
jne 0x45d823
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45d818
jne 0x45d834
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45d818
xor ecx, ecx
sub eax, 3
jb 0x45d848
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45d8ba
mov ebp, eax
add ebx, ebx
jne 0x45d853
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45d860
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45d884
inc ecx
add ebx, ebx
jne 0x45d870
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45d865
jne 0x45d881
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45d865
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45d8a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45d895
jmp 0x45d806
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45d8a4
add edi, ecx
jmp 0x45d806
pop esi
lea edi, [esi + 0x5b000]
mov eax, dword [edi]
or eax, eax
je 0x45d903
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5d22c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5d298]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45d8c1
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5d2a0]
or eax, eax
je 0x45d8fd
mov dword [ebx], eax
add ebx, 4
jmp 0x45d8de
call dword [esi + 0x5d29c]
mov ebp, dword [esi + 0x5d2a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45d937
sub esp, 0xffffff80
jmp 0x4017c0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x7f2d428e
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
mov eax, 0x80
push eax
push 3
push edi
push 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x7f2d42c5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
ret 4

Function at 0x7f2d42d2
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0x7f
mov eax, dword [0x7f30b094]
mov dword [ebp - 4], eax
jne 0x7f2d42ef
mov dword [ebp + 8], 0x409
push 6
lea eax, [ebp - 0xc]
push eax
push 0x1004
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x7f2d4312
lea eax, [ebp - 0xc]
push eax
call fcn.7f2d4078
jmp 0x7f2d4317
mov eax, dword [0x7f30bac8]
mov ecx, dword [ebp - 4]
call fcn.7f2fed53
leave
ret 4

Function at 0x7f2d4328
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0x7f
mov eax, dword [0x7f30b094]
mov dword [ebp - 4], eax
jne 0x7f2d4345
mov dword [ebp + 8], 0x409
push 6
lea eax, [ebp - 0xc]
push eax
push 0xb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x7f2d4365
lea eax, [ebp - 0xc]
push eax
call fcn.7f2d4078
jmp 0x7f2d436a
mov eax, dword [0x7f30b084]
mov ecx, dword [ebp - 4]
call fcn.7f2fed53
leave
ret 4
Function at 0x7f2db38e
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.7f2fec90
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x7f2db3ed
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x7f30bacc]
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jae 0x7f2db3f1
xor eax, eax
jmp 0x7f2db439
test eax, eax
je 0x7f2db420
cmp esi, edi
jbe 0x7f2db40a
push 0x4000
mov eax, esi
sub eax, edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 4
push 0x1000
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x7f30bacc]
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7f2ded3d
Capabilities:
Check if file exists
Enumerate gui resources
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x7f30bacc], 0
je 0x7f2ded78
mov eax, dword [0x7f30b99c]
test eax, eax
jne 0x7f2ded67
push 0x7f2d2ca8
call fcn.7f2d4139
test eax, eax
mov dword [0x7f30b99c], eax
je 0x7f2ded6a
pop ebp
jmp eax
push 0x7f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebp
ret 8
pop ebp
jmp fcn.7f2de006

Function at 0x7f2deec3
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x7f30bacc], 0
push ebx
push esi
push edi
je 0x7f2deef1
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
jmp 0x7f2def6f
mov ebx, dword [ebp + 8]
cmp ebx, 0xffff
jbe 0x7f2def56
push ebx
call fcn.7f2daf04
mov edi, eax
mov eax, dword [0x7f30b088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d55af
test eax, eax
mov esi, dword [0x7f30b088]
je 0x7f2def36
mov eax, esi
imul eax, edi
test eax, eax
je 0x7f2def36
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fec90
mov ebx, esp
jmp 0x7f2def38
xor ebx, ebx
xor eax, eax
cmp ebx, eax
je 0x7f2def56
imul esi, edi
push eax
push eax
push esi
push ebx
push edi
push dword [ebp + 8]
push eax
push dword [0x7f30bac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x7f2df189
Capabilities:
Copy file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x7f30bacc], 0
push ebx
push esi
push edi
je 0x7f2df1b1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x7f2df33e
mov eax, dword [ebp + 8]
cmp eax, 0xffff
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, 0x7f2d2cc0
jbe 0x7f2df273
push eax
call fcn.7f2daf04
mov esi, eax
mov eax, dword [0x7f30b088]
inc esi
imul eax, esi
pop ecx
push eax
call fcn.7f2d55af
test eax, eax
je 0x7f2df202
mov eax, dword [0x7f30b088]
imul eax, esi
test eax, eax
je 0x7f2df202
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fec90
mov dword [ebp - 4], esp
jmp 0x7f2df206
and dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x7f2df276
xor eax, eax
cmp dword [0x7f30bacc], eax
mov dword [ebp - 0xc], eax
jne 0x7f2df224
cmp byte [0x7f30b08d], al
mov dword [ebp - 8], eax
je 0x7f2df22b
mov dword [ebp - 8], 0x400
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
test eax, eax
mov eax, dword [0x7f30bac8]
jne 0x7f2df23f
mov eax, dword [0x7f30b084]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [0x7f30b088]
imul ecx, esi
push ebx
push ecx
push dword [ebp - 4]
push esi
push dword [ebp + 8]
push dword [ebp - 8]
push eax
call edi
cmp dword [ebp - 0xc], 0
jne 0x7f2df26f
test eax, eax
je 0x7f2df26f
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x7f2df276
push 0x7b
jmp 0x7f2df267
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0xffff
jbe 0x7f2df32c
push eax
call fcn.7f2daf04
mov esi, eax
mov eax, dword [0x7f30b088]
inc esi
imul eax, esi
pop ecx
push eax
call fcn.7f2d55af
test eax, eax
je 0x7f2df2bc
mov eax, dword [0x7f30b088]
imul eax, esi
test eax, eax
je 0x7f2df2bc
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fec90
mov dword [ebp + 8], esp
jmp 0x7f2df2c0
and dword [ebp + 8], 0
xor eax, eax
cmp dword [ebp + 8], eax
je 0x7f2df32f
cmp dword [0x7f30bacc], eax
mov dword [ebp - 8], eax
jne 0x7f2df2dd
cmp byte [0x7f30b08d], al
mov dword [ebp - 0xc], eax
je 0x7f2df2e4
mov dword [ebp - 0xc], 0x400
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
test eax, eax
mov eax, dword [0x7f30bac8]
jne 0x7f2df2f8
mov eax, dword [0x7f30b084]
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [0x7f30b088]
imul ecx, esi
push ebx
push ecx
push dword [ebp + 8]
push esi
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push eax
call edi
cmp dword [ebp - 8], 0
jne 0x7f2df328
test eax, eax
je 0x7f2df328
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x7f2df32f
push 0x7b
jmp 0x7f2df320
mov dword [ebp + 8], eax
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7f2df56a
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [0x7f30bacc], ebx
push esi
push edi
je 0x7f2df58e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x7f2df656
mov edi, dword [ebp + 8]
cmp edi, 0xffff
jbe 0x7f2df63d
push edi
call fcn.7f2daf04
mov esi, eax
mov eax, dword [0x7f30b088]
inc esi
imul eax, esi
pop ecx
push eax
call fcn.7f2d55af
test eax, eax
je 0x7f2df5d4
mov eax, dword [0x7f30b088]
imul eax, esi
cmp eax, ebx
je 0x7f2df5d4
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fec90
mov edi, esp
jmp 0x7f2df5d6
xor edi, edi
cmp edi, ebx
je 0x7f2df643
cmp dword [0x7f30bacc], ebx
mov dword [ebp - 4], ebx
jne 0x7f2df5ee
cmp byte [0x7f30b08d], 0
je 0x7f2df5f3
mov ebx, 0x400
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
test eax, eax
mov eax, dword [0x7f30bac8]
jne 0x7f2df607
mov eax, dword [0x7f30b084]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [0x7f30b088]
imul ecx, esi
push 0x7f2d2cc0
push ecx
push edi
push esi
push dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [ebp - 4], 0
jne 0x7f2df635
test eax, eax
je 0x7f2df635
push 0
jmp 0x7f2df637
push 0x7b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
cmp edi, ebx
jne 0x7f2df64c
cmp dword [ebp + 8], ebx
je 0x7f2df64c
xor eax, eax
jmp 0x7f2df656
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x7f2df665
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x7f30bacc], edi
je 0x7f2df68d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
jmp 0x7f2df82d
mov eax, dword [ebp + 8]
cmp eax, 0xffff
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jbe 0x7f2df746
push eax
call fcn.7f2daf04
mov esi, eax
mov eax, dword [0x7f30b088]
inc esi
imul eax, esi
pop ecx
push eax
call fcn.7f2d55af
test eax, eax
je 0x7f2df6d9
mov eax, dword [0x7f30b088]
imul eax, esi
cmp eax, edi
je 0x7f2df6d9
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fec90
mov dword [ebp - 4], esp
jmp 0x7f2df6dc
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
je 0x7f2df74e
cmp dword [0x7f30bacc], edi
mov dword [ebp - 8], edi
jne 0x7f2df6f5
cmp byte [0x7f30b08d], 0
je 0x7f2df6fa
mov edi, 0x400
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
test eax, eax
mov eax, dword [0x7f30bac8]
jne 0x7f2df70e
mov eax, dword [0x7f30b084]
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [0x7f30b088]
imul ecx, esi
push 0x7f2d2cc0
push ecx
push dword [ebp - 4]
push esi
push dword [ebp + 8]
push edi
push eax
call ebx
cmp dword [ebp - 8], 0
jne 0x7f2df742
test eax, eax
je 0x7f2df742
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
jmp 0x7f2df749
push 0x7b
jmp 0x7f2df738
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jne 0x7f2df75a
cmp dword [ebp + 8], edi
je 0x7f2df75a
xor eax, eax
jmp 0x7f2df82d
mov eax, dword [ebp + 0xc]
cmp eax, 0xffff
jbe 0x7f2df80d
push eax
call fcn.7f2daf04
mov esi, eax
mov eax, dword [0x7f30b088]
inc esi
imul eax, esi
pop ecx
push eax
call fcn.7f2d55af
test eax, eax
je 0x7f2df7a0
mov eax, dword [0x7f30b088]
imul eax, esi
cmp eax, edi
je 0x7f2df7a0
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fec90
mov dword [ebp + 8], esp
jmp 0x7f2df7a3
mov dword [ebp + 8], edi
cmp dword [ebp + 8], edi
je 0x7f2df815
cmp dword [0x7f30bacc], edi
mov dword [ebp - 8], edi
jne 0x7f2df7bc
cmp byte [0x7f30b08d], 0
je 0x7f2df7c1
mov edi, 0x400
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
test eax, eax
mov eax, dword [0x7f30bac8]
jne 0x7f2df7d5
mov eax, dword [0x7f30b084]
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [0x7f30b088]
imul ecx, esi
push 0x7f2d2cc0
push ecx
push dword [ebp + 8]
push esi
push dword [ebp + 0xc]
push edi
push eax
call ebx
cmp dword [ebp - 8], 0
jne 0x7f2df809
test eax, eax
je 0x7f2df809
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
jmp 0x7f2df810
push 0x7b
jmp 0x7f2df7ff
mov dword [ebp + 8], eax
cmp dword [ebp + 8], edi
jne 0x7f2df81e
cmp dword [ebp + 0xc], edi
jne 0x7f2df753
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7f2dfab4
Capabilities:
Create mailslot

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x7f30bacc], 0
push ebx
push esi
push edi
je 0x7f2dfad9
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
jmp 0x7f2dfb4e
mov ebx, dword [ebp + 8]
cmp ebx, 0xffff
jbe 0x7f2dfb3e
push ebx
call fcn.7f2daf04
mov edi, eax
mov eax, dword [0x7f30b088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d55af
test eax, eax
mov esi, dword [0x7f30b088]
je 0x7f2dfb1e
mov eax, esi
imul eax, edi
test eax, eax
je 0x7f2dfb1e
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fec90
mov ebx, esp
jmp 0x7f2dfb20
xor ebx, ebx
xor eax, eax
cmp ebx, eax
je 0x7f2dfb3e
imul esi, edi
push eax
push eax
push esi
push ebx
push edi
push dword [ebp + 8]
push eax
push dword [0x7f30bac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x7f2dfc00
Capabilities:
Create pipe

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x7f30bacc], 0
push ebx
push esi
push edi
je 0x7f2dfc34
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
jmp 0x7f2dfcb5
mov ebx, dword [ebp + 8]
cmp ebx, 0xffff
jbe 0x7f2dfc99
push ebx
call fcn.7f2daf04
mov edi, eax
mov eax, dword [0x7f30b088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d55af
test eax, eax
mov esi, dword [0x7f30b088]
je 0x7f2dfc79
mov eax, esi
imul eax, edi
test eax, eax
je 0x7f2dfc79
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fec90
mov ebx, esp
jmp 0x7f2dfc7b
xor ebx, ebx
xor eax, eax
cmp ebx, eax
je 0x7f2dfc99
imul esi, edi
push eax
push eax
push esi
push ebx
push edi
push dword [ebp + 8]
push eax
push dword [0x7f30bac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x20