joyce8/EMBER2024-capa huggingface dataset:
Function at 0x543d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x543d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x543d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x543d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x543d94
push eax
push esi
call fcn.0054620b
add esp, 8
pop esi
ret 0x10

Function at 0x543da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x543e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x543e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x55c320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00545dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x543dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x543e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x543ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x543eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x55c320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00545dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x543eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x543e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x544000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x544131
push esi
call fcn.00547145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00536080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x544131
push 0
push ebp
call fcn.005363a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00536260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x54408b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.005362f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x544121
push 0x55c918
push edi
call fcn.005453f0
push eax
push ebx
push esi
call fcn.00543f60
push 0x55c8f8
push edi
call fcn.005453f0
push eax
push ebx
push esi
call fcn.00543f60
push 0x55c8d8
push edi
call fcn.005453f0
push eax
push ebx
push esi
call fcn.00543f60
push 0x55c8c0
push edi
call fcn.005453f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00543f60
push 0x55c8a0
push edi
call fcn.005453f0
push eax
push ebx
push esi
call fcn.00543f60
push 0x55c888
push edi
call fcn.005453f0
push eax
push ebx
push esi
call fcn.00543f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x5451b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00545140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00545140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00545140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00545140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x545bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x545c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x55787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x545c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x545c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
lea eax, [ebx + 0x59c]
xor esi, 0x3eb0
push edi
mov edi, dword [esp + 0x24]
lea ebp, [ebx - 0x1844]
mov dword [esp + 0x24], eax
xor edi, 0x1995
add eax, 0x20a
xor ebx, 0xf5c
cmp edi, eax
jg 0x40106e
cmp dword [0x4a4d04], 0x107be
jbe 0x401051
xor dword [0x4a4d54], 0xc290c
mov ebx, dword [esp + 0x18]
mov ecx, dword [0x49e0e4]
mov eax, dword [ebx + 0xa8]
sub eax, 0x154383
add dword [ecx + 0x5c], eax
jmp 0x4010f5
mov eax, dword [0x4a4dd0]
and eax, ebx
mov dword [esp + 0x14], esi
imul eax, eax, 0x20d8
cmp esi, eax
je 0x4010f1
mov edx, dword [esp + 0x18]
sub ebp, edi
sub ebp, 0x1a8f
mov eax, dword [edx + 0x44]
and eax, dword [edx + 0x78]
sub eax, dword [0x4a4d34]
mov ecx, dword [edx + 0x10]
xor ecx, dword [edx + 0xb0]
push eax
push ebp
xor ecx, 0x14c2
lea eax, [esi + 0x273b]
push ecx
push eax
push 0x4a4cf8
call fcn.004026d1
mov ecx, dword [esp + 0x2c]
add esp, 0x14
mov ebp, eax
mov ecx, dword [ecx + 0x68]
imul ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x4a4dd0]
mov eax, dword [esp + 0x14]
and ecx, ebx
imul ecx, ecx, 0x20d8
add eax, 4
mov dword [esp + 0x14], eax
cmp eax, ecx
jne 0x401083
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
add eax, 0xfffffbb5
cmp ebp, eax
jg 0x401137
lea eax, [edi + 0x1844]
push eax
mov eax, esi
xor eax, 0x964
push eax
lea eax, [esi + 0x6a4]
push eax
lea eax, [ebp + 0x1995]
push eax
push esi
push 0x4a4cf8
call fcn.0040af98
add esp, 0x18
mov dword [ebx + 0x9c], 0x480d18
lea eax, [edi + 0x192f]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x402d75
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push edi
lea edx, [eax - 0x291]
lea ecx, [eax - 0x91e]
lea ebp, [eax + 0x20a]
mov dword [esp + 0x28], ecx
lea edi, [eax - 0x1de0]
lea eax, [ebp - 0x6bb]
cmp edx, eax
je 0x402e6c
push esi
mov eax, edi
lea ecx, [ebx - 0x1de0]
mov esi, 0x14c2
xor eax, esi
cmp ecx, eax
jg 0x402e51
mov esi, dword [esp + 0x28]
mov eax, dword [esi + 0x68]
cmp eax, dword [esi + 0x38]
jne 0x402dd8
xor dword [esi + 0xd0], 0x127a5
lea eax, [edi + 0x1995]
xor edi, 0x20d8
push eax
mov eax, dword [esp + 0x30]
xor eax, 0xaaa
push eax
push dword [0x49e0e4]
lea eax, [ebp + 0x124]
push edi
push eax
call fcn.004025dd
mov eax, dword [0x49e0e4]
add esp, 0x14
mov ecx, dword [esi + 0x68]
cmp ecx, dword [eax + 0x98]
jae 0x402e23
mov eax, 0xffffeaf6
sub eax, dword [0x4a4d4c]
add dword [esi + 0x34], eax
mov eax, dword [esi + 0x88]
cmp eax, dword [0x4a4dc4]
jne 0x402e41
mov eax, dword [esi + 0x54]
sub eax, dword [esi + 0x3c]
xor eax, 0x13e7b
add dword [esi + 0x28], eax
jmp 0x402e6b
mov eax, dword [esi + 0x1c]
sub eax, dword [esi + 0x38]
xor eax, 0x98bce
mov dword [esi + 0x50], eax
jmp 0x402e6b
mov eax, dword [esp + 0x28]
or edx, esi
push edx
mov eax, dword [eax]
sub eax, edi
sub eax, ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop edi
pop ebp
lea eax, [ebx - 0x44b]
pop ebx
ret

Function at 0x403017
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
add ecx, 0xffffdf28
push edi
mov edi, dword [esp + 0x1c]
lea eax, [edx - 0xcac]
xor eax, 0x3f83
cmp ecx, eax
jg 0x403137
lea ecx, [edx - 0x62d]
lea eax, [edi + 0xc16]
cmp ecx, eax
jle 0x403137
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
xor ebp, ebp
mov edx, dword [0x49e0e4]
mov ecx, dword [esi + 0xb0]
mov eax, dword [0x4a4dc4]
add eax, 0x12
sub ecx, dword [edx + 0x3c]
add eax, ecx
mov dword [0x4a4dc4], eax
mov eax, dword [esi + 0x9c]
mov ebx, dword [eax + ebp]
add ebp, 4
imul ebx, dword [edx + 0x5c]
mov eax, dword [esi + 0x54]
sub eax, 0x53
or dword [0x4a4d08], eax
mov eax, 0x73fbd
sub eax, dword [esi + 4]
add dword [esi + 0x3c], eax
mov edx, ebx
mov eax, dword [0x49e0e4]
shr edx, 8
mov eax, dword [eax + 0xc]
sub eax, 0x19dd94
add dword [esi + 0xcc], eax
mov eax, dword [0x49e0e4]
mov ecx, dword [eax + 0xa4]
mov eax, dword [0x4a4d58]
mov byte [eax + ecx], dl
inc dword [0x4a4d58]
mov eax, dword [0x4a4d98]
mov ecx, dword [esi + 0xa4]
xor eax, 5
add dword [esi + 0x38], eax
mov eax, dword [0x4a4d58]
mov byte [eax + ecx], bl
inc dword [0x4a4d58]
mov eax, dword [esi + 0xa0]
sub eax, 5
or dword [0x4a4d34], eax
mov eax, dword [0x49e0e4]
mov eax, dword [eax + 0x7c]
add eax, dword [esi + 0xb0]
xor eax, dword [esi + 0x70]
xor eax, 0xfffd43e5
mov dword [esi + 0x70], eax
cmp ebp, 0x1caa0
jl 0x40305a
mov dword [esi + 0x5c], 0xa08ad8f3
mov dword [esi + 0x9c], 0x423c58
pop esi
pop ebp
pop ebx
lea eax, [edi + 0x824]
pop edi
ret
Function at 0x40cb9f
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x18]
add edx, 0x7a9
push ebp
push esi
push edi
lea eax, [ecx + 0x20a]
mov dword [esp + 0x24], edx
mov edi, ebx
lea ebp, [ecx - 0x6c8]
xor eax, 0x3ae6
lea esi, [ebx - 0x411]
xor edi, 0x3392
cmp edx, eax
je 0x40cd5d
mov eax, ebx
xor eax, 0xe26
cmp esi, eax
mov eax, ebp
jge 0x40cc63
xor eax, 0xaf8
xor edx, 0x3c3e
push eax
push 0x4a4cf8
lea eax, [ecx + 0xe33]
xor eax, 0x88f
push eax
push edx
lea eax, [ecx + 0x7f7]
push eax
mov eax, ebx
push ecx
xor eax, 0x3ddf
push eax
call fcn.00402d75
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx + 0xe4]
xor eax, dword [ecx + 0x3c]
add eax, 0x14d54
xor dword [ecx + 0x50], eax
lea eax, [esi + 0x707]
push eax
lea eax, [ebp + 0xdf4]
xor ebp, 0x3384
push eax
mov eax, ebx
xor eax, 0x35fb
push eax
push ebp
push ecx
call fcn.0040269e
add esp, 0x30
mov esi, eax
jmp 0x40cd44
mov ecx, dword [esp + 0x1c]
sub eax, dword [ecx + 0x78]
sub eax, 0x1de0
cmp dword [ecx + 4], eax
jb 0x40cd44
mov eax, dword [0x49e0e4]
mov edx, dword [eax + 0xd8]
mov eax, dword [ecx + 0xc]
add eax, ebx
mov dword [esp + 0x20], edx
xor eax, ebp
cmp edx, eax
je 0x40cd44
mov eax, esi
imul eax, edi
add eax, 0xffffdef2
mov dword [esp + 0x18], eax
imul eax, ebx, 0x1b4f
mov dword [esp + 0x10], eax
mov eax, dword [0x49e0e4]
mov eax, dword [eax + 0x70]
or eax, ebp
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x1c]
lea ecx, [ebx - 0x411]
mov edi, dword [0x49e0e4]
lea esi, [ebx - 0x291d]
mov edx, dword [eax + 0xcc]
add esi, dword [edi + 0xa8]
imul edx, ecx
mov ecx, dword [eax + 0xb4]
xor ecx, 0xc02
and ecx, 0x1ce6
sub edx, dword [eax + 0x54]
mov eax, dword [eax + 0x8c]
or eax, dword [esp + 0x24]
imul eax, eax, 0x250c
push eax
push dword [esp + 0x1c]
push ecx
push edx
push esi
push dword [esp + 0x24]
push edi
call fcn.0040d855
mov ecx, dword [esp + 0x38]
add esp, 0x1c
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
inc eax
mov ecx, dword [ecx + 0xc]
add ecx, ebx
mov dword [esp + 0x20], eax
xor ecx, ebp
cmp eax, ecx
jne 0x40ccae
lea esi, [ebx - 0x411]
lea eax, [ebx + 0x2f6]
cmp esi, eax
je 0x40cd5d
mov eax, dword [0x49e0e4]
add dword [eax + 0xbc], 0xfffff778
pop edi
pop esi
pop ebp
lea eax, [ebx - 0xe8e]
pop ebx
pop ecx
ret
Function at 0x40d855
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
add eax, 0x1279
mov ecx, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
lea ebx, [edx - 0x634]
mov dword [esp + 0xc], eax
lea ebp, [ecx - 0x178]
push edi
lea edi, [ecx - 0x250c]
lea eax, [esi + 0x4d3]
xor esi, 0x1995
mov dword [esp + 0x2c], eax
lea eax, [edx - 0x7b6]
mov dword [esp + 0x20], eax
lea eax, [edx - 0x4b2]
mov dword [esp + 0x24], eax
xor eax, 0x7ae
cmp dword [esp + 0x2c], eax
je 0x40d93c
mov eax, edi
lea ecx, [ebx + 0x270]
xor eax, 0x1fea
push eax
lea eax, [esi + 0x249c]
push eax
push ecx
push 0x4a4cf8
push ecx
lea eax, [edx - 0xd90]
push eax
lea eax, [esi + 0x1718]
push eax
call fcn.0040aeaf
mov edx, dword [esp + 0x48]
mov esi, eax
mov ecx, edx
lea eax, [ebx - 0x539]
xor ecx, 0x3bbf
xor edx, 0x3f66
push ecx
push dword [0x49e0e4]
lea ecx, [esi + 0xfda]
push ecx
mov ecx, dword [esp + 0x48]
add ecx, 0xa55
push ecx
push eax
push edx
call fcn.0040cd69
xor dword [esp + 0x60], 0x3953
add esp, 0x34
add esi, 0xc4c
mov dword [esp + 0x24], eax
xor ebp, 0x3bd0
mov edx, dword [esp + 0x10]
lea ecx, [ebp + 0x24b]
cmp edx, ecx
jle 0x40da52
lea eax, [ebp + 0x151]
cmp dword [esp + 0x20], eax
je 0x40d99c
push 0x4a4cf8
mov eax, ebx
xor edi, 0x210e
xor eax, 0x388
xor edx, 0xb28
push eax
push edi
lea eax, [ebx - 0x75c]
push eax
push edx
push ebp
call fcn.004014ba
mov ecx, dword [esp + 0x30]
add esp, 0x18
mov eax, dword [ecx + 0x1c]
add eax, 0x78d28
xor dword [ecx + 0xe4], eax
jmp 0x40da52
mov ebp, dword [esp + 0x20]
mov eax, ebp
or eax, 0x1718
imul eax, eax, 0x1fea
cmp edi, eax
jg 0x40da52
mov eax, dword [0x49e0e4]
mov edi, dword [esp + 0x2c]
or esi, edi
mov ecx, dword [0x4a4d98]
xor esi, 0x210e
mov edx, dword [0x4a4de8]
add ecx, 0x1e68
mov eax, dword [eax + 0x90]
add edx, 0x1e68
add eax, edi
and eax, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x28]
push esi
push ecx
push 0x4a4cf8
add eax, 0x1ce6
push eax
push 0
push edx
call fcn.00403017
mov edx, dword [esp + 0x34]
add esp, 0x1c
mov ecx, ebp
mov esi, 0x1b4f
and ecx, 0x2410
or ebp, ebx
or ecx, esi
push ecx
mov ecx, dword [edx + 0x3c]
or ecx, eax
mov eax, dword [edx + 0xb4]
xor eax, 0x4d9
sub ecx, esi
push ecx
push eax
mov eax, dword [0x4a4d34]
imul eax, dword [0x4a4d90]
push ebp
push eax
mov eax, dword [edx + 0x38]
imul eax, dword [0x4a4db8]
xor eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebp
lea eax, [ebx + 0x5a1]
pop ebx
pop ecx
ret
Function at 0x40da5e
Capabilities:
Suspend thread

Disassembly:
push ecx
push ecx
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x14]
add ecx, 0xffffda29
xor ebx, 0x3d48
push esi
mov eax, ebx
mov dword [esp + 0x18], ebx
mov esi, edx
xor eax, 0xf48
push edi
xor esi, 0x592
lea edi, [edx + 0x38e]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
cmp ecx, eax
jge 0x40db7e
lea eax, [edx + 0x80f]
cmp esi, eax
jg 0x40daf6
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx + 0xbc]
add eax, dword [ecx + 0x34]
mov dword [ecx + 0xb8], eax
mov eax, dword [ecx + 0xa0]
cmp eax, dword [ecx + 0xd8]
ja 0x40dadb
xor dword [ecx + 0x7c], 0x17b7f
jmp 0x40db7e
mov eax, dword [0x49e0e4]
mov eax, dword [eax + 0xb4]
add eax, dword [ecx + 0x54]
xor eax, 0x43053
mov dword [ecx + 0x4c], eax
jmp 0x40db7e
mov edx, dword [0x49e0e4]
push ebp
mov ebp, esi
mov eax, dword [edx + 0xa0]
imul eax, esi
cmp esi, eax
jbe 0x40db7d
mov ecx, dword [edx + 0x3c]
mov eax, dword [esp + 0x34]
mov edi, dword [eax + 0xb4]
mov eax, dword [eax + 0x7c]
sub eax, ecx
cmp edi, eax
jb 0x40db66
mov esi, dword [esp + 0x34]
lea eax, [ebx + 0x1ce6]
mov dword [esp + 0x1c], eax
mov ebx, eax
mov eax, dword [esi + 0x7c]
or eax, 0x1e68
sub eax, 0x1844
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [0x49e0e4]
inc edi
mov eax, dword [esi + 0x7c]
sub eax, dword [edx + 0x3c]
cmp edi, eax
jae 0x40db32
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x20]
mov ecx, dword [edx + 0xa0]
add ebp, 4
imul ecx, esi
cmp ebp, ecx
mov ecx, dword [edx + 0x3c]
ja 0x40db0f
mov edi, dword [esp + 0x14]
pop ebp
xor edi, 0x3db3
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
ret
Function at 0x40deee
Capabilities:
Create pipe

Disassembly:
push ecx
xor dword [esp + 0xc], 0xbfe
push ebx
mov ebx, dword [esp + 0x14]
mov edx, ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor edx, 0x1e68
lea ebp, [ebx - 0x1e68]
mov dword [esp + 0xc], edx
xor ebx, 0x3af4
push edi
mov edi, dword [esp + 0x28]
lea ecx, [esi - 0x4ff]
lea eax, [edx + 0x2394]
mov dword [esp + 0x20], ecx
xor esi, 0x3837
cmp ebp, eax
jg 0x40dfac
mov edx, dword [0x4a4d48]
xor ebp, 0x1844
jmp 0x40df7c
mov ecx, dword [ecx + 0xa8]
mov eax, dword [0x4a4d60]
add ecx, dword [edi + 0xa0]
add eax, 0xffe74bac
add eax, ecx
mov dword [0x4a4d60], eax
mov eax, edx
imul eax, edx
push 0x53
add dword [edi + 0xbc], eax
pop eax
sub eax, dword [edi + 0x54]
add dword [0x4a4d4c], eax
inc edx
mov ecx, dword [0x49e0e4]
cmp edx, dword [ecx + 0x58]
jbe 0x40df47
mov eax, dword [0x4a4d3c]
sub eax, dword [edi + 0xa8]
mov edx, dword [esp + 0x10]
xor eax, 0xffe74bb4
imul eax, dword [ecx + 0xbc]
mov dword [ecx + 0xbc], eax
mov ecx, dword [esp + 0x20]
lea eax, [ebx - 0xc58]
cmp esi, eax
jle 0x40dff2
mov eax, dword [edi + 0xbc]
mov dword [0x4a4d5c], eax
lea eax, [ecx - 0xee]
push eax
lea eax, [esi + 0xb3d]
push eax
lea eax, [ebp + 0x30b]
push eax
lea eax, [esi - 0x6c8]
push eax
push dword [0x49e0e4]
call fcn.004026d1
add esp, 0x14
mov esi, eax
jmp 0x40e094
mov ebx, dword [edi + 0x10]
mov ecx, dword [0x4a4da0]
jmp 0x40e083
mov eax, dword [edi + 0x28]
add eax, dword [edi + 0xa0]
add eax, dword [esp + 0x20]
cmp dword [0x4a4d90], eax
jne 0x40e07c
imul eax, esi, 0x1b4f
xor dword [esp + 0x1c], eax
mov eax, edx
imul eax, edx
or eax, dword [edi + 0x2c]
push eax
mov eax, dword [0x4a4d70]
or eax, dword [esp + 0x24]
or eax, ebp
push eax
mov eax, dword [edi + 0xd8]
add eax, 0x2c13
or eax, 0x273b
push eax
mov eax, dword [edi + 0x54]
or eax, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
add eax, edx
push eax
mov eax, dword [0x49e0e4]
mov eax, dword [eax + 0x38]
and eax, ebp
push eax
mov eax, dword [edi + 0xa0]
sub eax, edx
push eax
mov eax, esi
or eax, 0x20d8
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ecx, dword [0x4a4da0]
mov edx, dword [esp + 0x10]
add ebx, 3
mov eax, ecx
or eax, esi
add eax, 0x1b4f
cmp ebx, eax
jb 0x40e000
xor esi, 0x91f
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40e19f
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov edx, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
lea ecx, [edx + 0x750]
add esi, 0xffffe4b1
mov dword [esp + 0xc], ecx
push edi
mov edi, dword [esp + 0x18]
lea ebx, [edx - 0x1718]
mov ebp, esi
mov dword [esp + 0x20], esi
lea eax, [esi + 0x1e68]
cmp ecx, eax
jne 0x40e292
lea eax, [esi + 0x249c]
cmp ebx, eax
jge 0x40e292
lea eax, [ebx + 0x210e]
mov esi, 0x1de0
push eax
lea eax, [ebp + 0x250c]
xor ecx, 0x3af4
push eax
mov eax, ebp
xor eax, esi
push eax
lea eax, [ebx + 0x14c2]
push eax
push ecx
mov eax, ebx
xor eax, 0x1995
push eax
push edi
call fcn.0040d855
xor eax, 0x30cb
mov dword [esp + 0x2c], eax
mov eax, ebp
add eax, 0x210e
push eax
lea eax, [ebx + 0x291d]
push eax
mov eax, ebx
xor eax, esi
push eax
mov eax, ebx
xor eax, 0x192f
push edi
push eax
call fcn.0040cb9f
mov edx, dword [esp + 0x4c]
mov esi, eax
push dword [0x49e0e4]
mov eax, ebp
lea ecx, [edx - 0x7df]
push ecx
lea ecx, [eax + 0x1e68]
push ecx
lea ecx, [eax + 0x1ce6]
push ecx
lea ecx, [edx + 0x4c9]
push ecx
call fcn.0040deee
mov edx, dword [esp + 0x68]
sub eax, 0xdf4
add esp, 0x44
mov dword [esp + 0x20], eax
xor esi, 0x3392
xor ebp, 0x14c2
lea ecx, [esi - 0x589]
cmp dword [esp + 0x10], ecx
jg 0x40e30c
push edi
mov eax, ebp
xor eax, 0x3115
push eax
push edx
lea eax, [ebp + 0x1115]
push eax
mov eax, dword [esp + 0x30]
add eax, 0x217
push eax
lea eax, [ebx + 0x250c]
xor ebx, 0x210e
push eax
push ebx
call fcn.0040da5e
mov eax, dword [0x4a4da8]
add esp, 0x1c
add eax, 0x40
add eax, dword [edi + 0x38]
push eax
mov eax, dword [0x49e0e4]
push 0x3000
push dword [eax + 0x4c]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add eax, 0x1800
xor esi, 0x3392
mov dword [edi + 0xac], eax
sub esi, 0x24b
jmp 0x40e3b6
mov ecx, dword [0x49e0e4]
mov eax, dword [ecx + 0x3c]
sub eax, 0x250c
cmp esi, eax
je 0x40e37e
imul eax, dword [edi + 0x3c], 0x1995
push 0x1067
push 0x3e24
push 0x1099
push 0x3d9d
xor eax, dword [0x4a4d3c]
xor eax, 0x2c13
push 0x28b0
mov dword [0x4a4d3c], eax
call fcn.0040b000
mov dword [0x4a4e5c], eax
add esp, 0x14
imul eax, dword [0x4a4dac], 0x250c
xor eax, dword [edi + 0x90]
push eax
mov eax, dword [edi + 0xd8]
or eax, dword [edi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
jmp 0x40e3b6
imul eax, dword [edi + 0xa0], 0x2409
add eax, 0x1b4f
cmp esi, eax
jb 0x40e3b6
mov eax, dword [edi + 0x54]
xor ebp, 0x1de0
sub eax, ebx
add eax, dword [0x4a4d90]
push eax
mov eax, dword [ecx + 0xf0]
add eax, 0x1ce6
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_HeapCreate]
xor esi, 0x16b
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret