joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
test al, 0x10
mov ecx, dword [esp + 0x70]
mov esi, dword [esp + 0x78]
lea ebx, [esp + 0x3c]
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x34], 0
lea ebx, [edx + 0x30]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x38], ecx
je 0x410f7e
mov dword [esp], ecx
call fcn.00493110
mov dword [esp + 8], 0x4a32f6
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00493d00
test al, al
jne 0x410fa0
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp], ebx
call fcn.00492e00
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.00493110
mov dword [esp + 8], 0x4a32f6
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00493d00
test al, al
je 0x410f7e
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.00493110
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.00493110
mov ebp, eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.00493110
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x410f7e
mov eax, dword [esp + 0x4c]
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x410f7e
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x410f7e
cmp byte [ebp], 0
jne 0x411043
add ebp, 1
jmp 0x411039
add ebp, 1
cmp byte [ebp - 1], 0
jne 0x411043
sub ecx, 1
jne 0x411030
jmp 0x410f7e
cmp edx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], edx
jae 0x410f7e
call fcn.00494920
lea edi, [eax + 0xc]
mov ebp, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], esi
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.00492be0
mov ecx, dword [esp + 0x1c]
mov dword [esp], edi
mov dword [esp + 4], ecx
mov dword [esp + 0x14], ecx
call fcn.00492cf0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 8], 0
mov dword [esp], edi
sub ecx, edx
mov dword [esp + 4], ecx
call fcn.00492c00
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.00492bf0
mov dword [esp + 4], ebp
mov dword [esp], ebx
call fcn.00492e40
jmp 0x410f8e
Function at 0x426ab0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
xor edx, edx
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov eax, dword [esi + 8]
mov dword [esi + 4], 0
test eax, eax
jne 0x426ae6
jmp 0x426b50
test edi, edi
mov edx, dword [esi + 4]
mov eax, dword [esi + 8]
je 0x426b20
add edx, edi
cmp edx, eax
mov dword [esi + 4], edx
jae 0x426b20
sub eax, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 1
mov dword [esp + 8], eax
add edx, dword [esi]
mov dword [esp], edx
call sub.msvcrt.dll_fread
mov dword [esp], ebx
mov edi, eax
call sub.msvcrt.dll_ferror
test eax, eax
je 0x426ad3
add esp, 0x10
mov eax, 2
pop ebx
pop esi
pop edi
ret
cmp eax, edx
je 0x426b50
xor eax, eax
mov ecx, dword [esi]
mov dword [esi + 0x14], edx
lea edx, [esi + 0xc]
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], edx
mov dword [esi + 0xc], ecx
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp], ebx
call sub.msvcrt.dll_fgetc
cmp eax, 0xffffffff
mov edx, dword [esi + 4]
setne al
movzx eax, al
jmp 0x426b26
Function at 0x432d00
Capabilities:
Write file on windows

Disassembly:
cmp byte [0x4c2f68], 0
jne 0x432d40
push ebp
push edi
mov ebp, edx
push esi
push ebx
mov ebx, eax
mov esi, ecx
mov edi, ecx
sub esp, 0x18c
mov eax, dword [eax + 4]
test eax, eax
je 0x432d42
cmp eax, 1
je 0x432d52
cmp eax, 2
je 0x432d70
add esp, 0x18c
pop ebx
pop esi
pop edi
pop ebp
ret
repz ret
mov dword [esp], ebx
call fcn.00432ce0
mov eax, dword [ebx + 4]
cmp eax, 1
jne 0x432d27
add ebx, 8
mov dword [esp + 8], esi
mov dword [esp + 4], ebp
mov dword [esp], ebx
call fcn.0048f670
jmp 0x432d2c
mov eax, dword [ebx]
test eax, eax
je 0x432df0
mov dword [esp + 4], 0x109
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
call fcn.00490e50
cmp eax, 1
jne 0x432d94
cmp byte [ebp], 0xa
je 0x432e11
mov eax, dword [ebx]
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], ebp
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
cmp eax, edi
jae 0x432d2c
mov eax, dword [ebx]
test eax, eax
je 0x432dca
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [ebx], 0
mov eax, dword [ebx + 0x20]
mov dword [ebx + 4], 3
mov edx, dword [eax]
mov dword [esp + 4], str.Disabled_writing_session_log_due_to_error_while_writing
mov dword [esp], eax
call dword [edx]
jmp 0x432d2c
mov dword [esp + 8], 0x37
mov dword [esp + 4], str._MoTTY_logging.c
mov dword [esp], str.ctx__lgfp
call fcn.0049d570
jmp 0x432d76
lea eax, [esp + 0x20]
lea esi, [esp + 0x80]
mov edi, 0x18
mov dword [esp], eax
call fcn.00499930
mov eax, dword [esp + 0x20]
mov dword [esp], esi
mov dword [esp + 8], str._Y__m__d__H:_M:_S
mov dword [esp + 4], 0x18
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_strftime
mov dword [esp + 4], esi
mov dword [esp], str._n__s_
call fcn.00491fc0
mov esi, eax
mov eax, dword [ebx]
mov dword [esp + 8], 0x18
mov dword [esp + 4], 1
mov dword [esp], esi
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], esi
mov dword [esp + 0x1c], eax
call fcn.00493420
mov eax, dword [esp + 0x1c]
jmp 0x432dae
Function at 0x438460
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push edi
xor ecx, ecx
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
mov eax, dword [edx + ecx*4]
mov dword [edi + ecx*4], eax
mov ebx, dword [esi*4 + 0x49f09c]
add ecx, 1
cmp ebx, ecx
jg 0x438475
mov eax, ecx
mov ebp, dword [edi + ecx*4 - 4]
cdq
idiv ebx
test edx, edx
jne 0x43852d
lea esi, [esi]
mov edx, ebp
mov eax, dword [eax*4 + 0x4ac5fc]
ror edx, 8
mov ebp, edx
bswap eax
shr ebp, 0x18
mov dword [esp], eax
movzx ebp, byte [ebp + 0x4ac500]
movzx eax, dl
movzx eax, byte [eax + 0x4ac500]
shl ebp, 0x18
or ebp, eax
movzx eax, dh
shr edx, 0x10
movzx eax, byte [eax + 0x4ac500]
movzx edx, dl
shl eax, 8
or eax, ebp
movzx ebp, byte [edx + 0x4ac500]
shl ebp, 0x10
or ebp, eax
xor ebp, dword [esp]
mov eax, ecx
sub eax, ebx
mov edx, dword [edi + eax*4]
xor edx, ebp
mov dword [edi + ecx*4], edx
mov eax, dword [esi*4 + 0x49f0a8]
add ecx, 1
add eax, 1
imul eax, dword [esi*4 + 0x49f090]
cmp eax, ecx
jle 0x438580
mov ebx, dword [esi*4 + 0x49f09c]
mov eax, ecx
mov ebp, dword [edi + ecx*4 - 4]
cdq
idiv ebx
test edx, edx
je 0x4384a0
cmp edx, 4
jne 0x4384f0
cmp ebx, 6
jle 0x4384f0
mov eax, ebp
mov edx, ebp
shr eax, 0x18
movzx edx, dl
movzx eax, byte [eax + 0x4ac500]
movzx edx, byte [edx + 0x4ac500]
shl eax, 0x18
or eax, edx
mov edx, ebp
shr ebp, 0x10
movzx edx, dh
movzx edx, byte [edx + 0x4ac500]
shl edx, 8
or eax, edx
mov edx, ebp
movzx ebp, dl
movzx edx, byte [ebp + 0x4ac500]
shl edx, 0x10
or eax, edx
mov ebp, eax
jmp 0x4384f0
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4386f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 8
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
mov eax, ebx
lea ebp, [ebx + ebx]
mov esi, ebx
shr al, 7
mov dword [esp], edi
lea ecx, [eax + eax]
add ecx, eax
lea ecx, [ecx + ecx*8]
xor ecx, ebp
mov eax, ecx
shr al, 7
lea edx, [eax + eax]
add edx, eax
lea eax, [ecx + ecx]
lea edx, [edx + edx*8]
xor edx, eax
mov eax, edi
shr al, 1
mov ebp, eax
and ebp, 1
mov eax, ebp
imul eax, ecx
mov ecx, edx
shr cl, 7
mov ebp, eax
mov eax, edi
and eax, 1
imul eax, ebx
xor ebp, eax
mov eax, edi
shr al, 2
and eax, 1
imul eax, edx
xor ebp, eax
lea eax, [ecx + ecx]
add eax, ecx
lea ecx, [eax + eax*8]
lea eax, [edx + edx]
mov edx, edi
shr dl, 3
xor eax, ecx
and edx, 1
mov ecx, esi
imul eax, edx
xor ebp, eax
mov eax, ebp
mov byte [esp + 7], al
mov eax, edi
mov edi, 4
shr al, 4
and eax, 1
mov edx, ecx
add ecx, ecx
shr dl, 7
mov ebp, edx
lea edx, [ebp + ebp]
add edx, ebp
lea edx, [edx + edx*8]
xor ecx, edx
sub edi, 1
jne 0x438783
imul eax, ecx
xor al, byte [esp + 7]
mov edi, 5
mov ecx, ebx
mov byte [esp + 7], al
movzx eax, byte [esp]
shr al, 5
and eax, 1
nop
lea esi, [esi]
mov edx, ecx
add ecx, ecx
shr dl, 7
mov ebp, edx
lea edx, [ebp + ebp]
add edx, ebp
lea edx, [edx + edx*8]
xor ecx, edx
sub edi, 1
jne 0x4387c0
movzx ebp, byte [esp + 7]
mov edi, 6
imul eax, ecx
xor ebp, eax
movzx eax, byte [esp]
shr al, 6
and eax, 1
mov ecx, ebx
add ebx, ebx
shr cl, 7
lea edx, [ecx + ecx]
add edx, ecx
lea edx, [edx + edx*8]
xor ebx, edx
sub edi, 1
jne 0x4387f2
imul eax, ebx
movzx ebx, byte [esp]
mov ecx, 7
mov edx, esi
xor ebp, eax
shr bl, 7
nop
lea esi, [esi]
mov eax, edx
add edx, edx
shr al, 7
mov esi, eax
lea eax, [esi + esi]
add eax, esi
lea eax, [eax + eax*8]
xor edx, eax
sub ecx, 1
jne 0x438820
mov eax, edx
add esp, 8
imul eax, ebx
pop ebx
pop esi
xor eax, ebp
pop edi
pop ebp
ret

Function at 0x438c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x30
mov eax, dword [esp + 0x44]
mov dword [esp + 0x20], 0x90d0b0e
mov dword [esp + 0x24], 0xd0b0e09
mov dword [esp + 0x28], 0xb0e090d
mov dword [esp + 0x2c], 0xe090d0b
mov eax, dword [eax*4 + 0x49f090]
test eax, eax
jle 0x438d03
mov esi, dword [esp + 0x48]
mov dword [esp + 0xc], 0
lea esi, [esi]
lea edi, [edi]
lea eax, [esp + 0x1c]
lea ebx, [esp + 0x20]
mov dword [esp + 8], eax
mov eax, 0xe
xor ebp, ebp
xor edi, edi
mov dword [esp + 4], eax
movzx eax, byte [esi + edi]
add edi, 1
mov dword [esp], eax
call fcn.004386f0
xor ebp, eax
cmp edi, 4
je 0x438cb5
movzx eax, byte [ebx + edi]
jmp 0x438c95
mov ecx, dword [esp + 8]
mov eax, ebp
add ebx, 4
mov byte [ecx], al
lea eax, [esp + 0x30]
add ecx, 1
mov dword [esp + 8], ecx
cmp eax, ebx
je 0x438cd4
movzx eax, byte [ebx]
jmp 0x438c91
xor eax, eax
movzx edx, byte [esp + eax + 0x1c]
mov byte [esi + eax], dl
add eax, 1
cmp eax, 4
jne 0x438cd6
mov edx, dword [esp + 0x44]
add dword [esp + 0xc], 1
add esi, 4
mov eax, dword [esp + 0xc]
cmp dword [edx*4 + 0x49f090], eax
jg 0x438c80
add esp, 0x30
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x438d10
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push edi
xor eax, eax
push esi
push ebx
mov ecx, 0x3c
sub esp, 0x124
lea edi, [esp + 0x34]
mov ebp, dword [esp + 0x138]
mov ebx, dword [esp + 0x148]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
mov dword [esp], ebp
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x144]
mov dword [esp + 4], eax
call fcn.00438460
mov eax, dword [ebx]
mov ecx, dword [esp + 0x140]
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 4]
test ecx, ecx
mov dword [esp + 0x28], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0x2c], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x30], eax
jle 0x438ef3
mov esi, dword [ebp*4 + 0x49f090]
lea ebx, [esp + 0x14]
mov dword [esp + 0xc], 0
mov eax, dword [ebp*4 + 0x49f0a8]
mov edi, dword [esp + 0x13c]
lea edx, [esi*4]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], eax
xor eax, eax
add ecx, edi
test edx, edx
mov edi, edx
jle 0x438f00
nop
lea esi, [esi]
movzx edx, byte [ecx + eax]
mov byte [ebx + eax], dl
add eax, 1
cmp eax, edi
jne 0x438de0
mov edx, dword [esp + 0x10]
test edx, edx
js 0x438eb0
mov dword [esp + 0x138], ebp
mov ebp, dword [esp + 0x10]
test esi, esi
jle 0x438e24
mov eax, ebp
imul eax, esi
lea ecx, [esp + eax*4 + 0x34]
xor eax, eax
mov edx, dword [ebx + eax*4]
xor edx, dword [ecx + eax*4]
mov dword [ebx + eax*4], edx
add eax, 1
cmp eax, esi
jne 0x438e14
test ebp, ebp
je 0x438e90
mov eax, dword [esp + 0x138]
cmp dword [eax*4 + 0x49f0a8], ebp
jg 0x438e82
mov eax, dword [esp + 0x138]
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00438b40
mov eax, dword [esp + 0x138]
mov esi, dword [eax*4 + 0x49f090]
test esi, esi
jle 0x438e7d
lea edi, [ebx + esi*4]
mov eax, ebx
lea ecx, [eax + 4]
movzx edx, byte [eax]
add eax, 1
movzx edx, byte [edx + 0x4ac400]
mov byte [eax - 1], dl
cmp ecx, eax
jne 0x438e65
cmp edi, eax
jne 0x438e62
sub ebp, 1
jmp 0x438e05
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00438c30
jmp 0x438e38
lea edx, [esi*4]
mov ebp, dword [esp + 0x138]
test edx, edx
jle 0x438ede
mov eax, dword [esp + 0x13c]
mov edi, dword [esp + 0xc]
lea ecx, [eax + edi]
xor eax, eax
movzx edx, byte [ebx + eax]
xor dl, byte [esp + eax + 0x24]
mov edi, edx
movzx edx, byte [ecx + eax]
mov byte [esp + eax + 0x24], dl
mov edx, edi
mov byte [ecx + eax], dl
mov esi, dword [ebp*4 + 0x49f090]
add eax, 1
lea edx, [esi*4]
cmp edx, eax
jg 0x438eb2
add dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x140], eax
jg 0x438dad
add esp, 0x124
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x10]
test eax, eax
js 0x438ede
jmp 0x438dfa
Function at 0x438f10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push ebx
mov edx, 0x38e38e39
sub esp, 0x254
mov ecx, dword [esp + 0x268]
lea ebx, [esp + 0xe8]
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x20], 0x64
mov dword [esp + 0x1c], 0x2d
mov dword [esp + 0x18], 0x48
mov dword [esp + 0x10], 0x2b
lea eax, [ecx + 0xe1f]
mov dword [esp + 0xc], 0x45
mov dword [esp + 8], str._c_c1_d6_c36_c_c8_d6P_c_c
mov dword [esp + 4], 0x168
mov dword [esp], ebx
mov dword [esp + 0x24], eax
mov eax, ecx
sar ecx, 0x1f
imul edx
mov dword [esp + 0x3b], 0x4829452b
mov dword [esp + 0x3f], 0x2e642d25
mov dword [esp + 0x43], 0x3d323a2f
mov dword [esp + 0x47], 0x5f405028
mov byte [esp + 0x4b], 0
mov dword [esp + 0x2c], 0x5f
sar edx, 3
sub edx, ecx
mov dword [esp + 0x14], edx
call fcn.00437e80
mov edx, ebx
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x438fbc
mov ecx, eax
lea esi, [esp + 0x4c]
mov dword [esp + 4], ebx
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
mov dword [esp], esi
cmove edx, ecx
mov ecx, eax
add cl, al
sbb edx, 3
sub edx, ebx
mov dword [esp + 8], edx
call fcn.00437eb0
lea eax, [esp + 0x6c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileA]
sub esp, 4
test eax, eax
lea ecx, [esp + 0x3b]
je 0x43905b
lea ebx, [esp + 0x70]
mov edx, ebx
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x439020
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
mov ecx, eax
add cl, al
lea ecx, [esp + 0x3b]
sbb edx, 3
sub edx, ebx
cmp edx, 0x26
je 0x439090
mov eax, dword [esp + 0x264]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ecx
mov dword [esp], 2
mov dword [esp + 8], eax
mov eax, dword [esp + 0x260]
mov dword [esp + 4], eax
call fcn.00438d10
add esp, 0x254
xor eax, eax
pop ebx
pop esi
ret
xor eax, eax
movzx edx, byte [ebx + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x10
jne 0x439092
movzx eax, byte [esp + 0x94]
mov byte [esp + 0x3b], al
movzx eax, byte [esp + 0x89]
mov byte [esp + 0x3f], al
movzx eax, byte [esp + 0x8c]
mov byte [esp + 0x41], al
movzx eax, byte [esp + 0x90]
mov byte [esp + 0x44], al
movzx eax, byte [esp + 0x84]
mov byte [esp + 0x49], al
jmp 0x43905b
Function at 0x448840
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x448853
mov eax, dword [eax]
mov dword [esp + 4], eax
jmp fcn.00499df0
xor eax, eax
ret

Function at 0x449350
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov eax, 1
push esi
push ebx
sub esp, 0x43c
call fcn.004483f0
cmp eax, 0xffffffff
je 0x4493c6
mov esi, eax
lea ebp, [esp + 0x2c]
lea ebx, [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x449396
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4493ba
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [esp + 0x450]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x400
mov dword [esp + 4], ebx
mov dword [esp], esi
call edi
sub esp, 0x14
test eax, eax
jne 0x449380
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
add esp, 0x43c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4493e0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov eax, 2
sub esp, 0x38
call fcn.004483f0
cmp eax, 0xffffffff
je 0x44942d
mov ebx, eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
add esp, 0x38
pop ebx
ret
Function at 0x451c40
Capabilities:
Create pipe

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x38
mov eax, dword [eax]
cmp dl, 1
lea edx, [esp + 0x24]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0xc
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x1000
mov dword [esp + 0x28], eax
sbb eax, eax
mov dword [esp + 0x1c], edx
and eax, 0xfff80000
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], 0xff
add eax, 0x40080003
mov dword [esp + 8], 8
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
sub esp, 0x20
cmp eax, 0xffffffff
mov dword [ebx + 0xc], eax
setne al
add esp, 0x38
pop ebx
ret

Function at 0x451cc0
Capabilities:
Connect pipe

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x20
test dl, dl
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x451d01
mov eax, dword [ebx + 0x28]
mov esi, dword [ebx + 0xc]
mov edx, dword [eax]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x451dc0
mov dword [esp], eax
call dword [edx + 0x10]
test eax, eax
jne 0x451d91
xor edx, edx
mov eax, ebx
call fcn.00451c40
test al, al
je 0x451d33
lea eax, [ebx + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
sub esp, 8
test eax, eax
jne 0x451cd2
call edi
cmp eax, 0x3e5
mov esi, eax
je 0x451d8a
test eax, eax
je 0x451cd2
cmp eax, 0x217
jne 0x451d37
jmp 0x451cd2
call edi
mov esi, eax
mov dword [esp], esi
call fcn.0049ab10
mov dword [esp], str.Error_while_listening_to_named_pipe:__s
mov dword [esp + 4], eax
call fcn.00491fc0
mov edi, eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.00450b00
mov edx, dword [ebx + 0x28]
mov ecx, dword [edx]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], edx
call dword [ecx]
mov dword [esp], edi
call fcn.00493420
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x451cf4
Function at 0x452aa0
Capabilities:
Create thread

Disassembly:
push esi
push ebx
sub esp, 0x34
mov dword [esp + 8], 0
mov dword [esp + 4], 0x102c
mov dword [esp], 1
call fcn.00493390
mov ebx, eax
mov dword [eax], 0
mov eax, dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 4], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x10
mov dword [ebx + 0x10], eax
cmp dword [0x49f0c0], 0xffffffff
mov eax, dword [esp + 0x44]
mov byte [ebx + 0x16], 0
mov byte [ebx + 0x14], 0
mov byte [ebx + 0x15], 0
mov dword [ebx + 0x1028], eax
mov eax, dword [esp + 0x48]
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 0x4c]
mov dword [ebx + 0x1c], eax
je 0x452b80
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x452410
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x14], eax
lea eax, [ebx + 4]
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
test eax, eax
je 0x452b71
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov byte [ebx + 0x17], 1
add esp, 0x34
mov eax, ebx
pop ebx
pop esi
ret
mov dword [0x4c28b8], 0x4c28b8
mov dword [0x4c28bc], 0x4c28b8
mov dword [esp], 0x4c28a0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x10
mov dword [0x49f0c0], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4528d0
mov dword [esp], eax
call fcn.0040ad30
jmp 0x452b2a
Function at 0x452bf0
Capabilities:
Create thread

Disassembly:
push esi
push ebx
sub esp, 0x34
mov dword [esp + 8], 0
mov dword [esp + 4], 0x102c
mov dword [esp], 1
call fcn.00493390
mov ebx, eax
mov dword [eax], 1
mov eax, dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 4], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x10
mov dword [ebx + 0x10], eax
mov byte [ebx + 0x17], 0
mov eax, dword [esp + 0x48]
mov byte [ebx + 0x16], 0
mov byte [ebx + 0x14], 0
mov byte [ebx + 0x15], 0
mov dword [ebx + 0x18], eax
lea eax, [ebx + 0x30]
mov dword [esp], eax
call fcn.0048f5c0
mov eax, dword [esp + 0x44]
cmp dword [0x49f0c0], 0xffffffff
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x4c], ebx
mov dword [ebx + 0x48], eax
mov eax, dword [esp + 0x4c]
mov dword [ebx + 0x1c], eax
je 0x452ce0
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x452680
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x14], eax
lea eax, [ebx + 4]
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
test eax, eax
je 0x452cd7
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
add esp, 0x34
mov eax, ebx
pop ebx
pop esi
ret
mov dword [0x4c28b8], 0x4c28b8
mov dword [0x4c28bc], 0x4c28b8
mov dword [esp], 0x4c28a0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x10
mov dword [0x49f0c0], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4528d0
mov dword [esp], eax
call fcn.0040ad30
jmp 0x452c90