joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461f80
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [esp + 0x140]
lea edi, [esp + 0x1b]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1c
mov dword [esp], 0
mov dword [esp + 4], edi
lea esi, [ebx + 8]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
sub esp, 0x10
test eax, eax
mov dword [ebx], esi
jne 0x461fe0
mov eax, 0x2e
mov dword [ebx + 4], 1
mov word [ebx + 8], ax
add esp, 0x12c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call sub.msvcrt.dll_strstr
cmp eax, 0xf
mov ebp, eax
mov dword [esp + 0x14], eax
ja 0x462014
cmp eax, 1
jne 0x462050
movzx edx, byte [esp + 0x1b]
mov byte [ebx + 8], dl
mov dword [ebx + 4], eax
mov byte [esi + eax], 0
add esp, 0x12c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x14]
mov dword [esp + 4], 0
mov ecx, ebx
mov dword [esp], eax
call fcn.006cfa40
sub esp, 8
mov esi, eax
mov dword [ebx], eax
mov eax, dword [esp + 0x14]
mov dword [ebx + 8], eax
mov dword [esp], esi
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
call sub.msvcrt.dll_putchar
mov eax, dword [esp + 0x14]
mov esi, dword [ebx]
jmp 0x462000
test eax, eax
je 0x462000
jmp 0x462038
Function at 0x46fb70
Capabilities:
Query environment variable

Disassembly:
push edi
xor eax, eax
mov ecx, 0x41
sub esp, 0x128
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x1c]
mov dword [esp + 8], 0x104
mov dword [esp], str._PROGRAMFILES_NVIDIA_CorporationNVSMI_nvml.dll
mov dword [esp + 4], edi
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
sub esp, 0xc
mov dword [esp], edi
mov dword [esp + 4], 0x7dd424
call fcn.004cc5d0
test eax, eax
sete al
add esp, 0x128
pop edi
ret

Function at 0x481ad0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 8], 0x3000
mov dword [esp], 0
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
sub esp, 0x10
add esp, 0x1c
ret
Function at 0x4b90e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea eax, [ecx + 0x10]
cmp edx, eax
jae 0x4b9104
lea eax, [edx + 0x10]
cmp ecx, eax
jb 0x4b9195
mov edi, ecx
mov dword [esp + 0xc], 0
shr edi, 3
and edi, 1
je 0x4b9128
mov eax, dword [edx]
xor dword [ecx], eax
mov eax, dword [edx + 4]
xor dword [ecx + 4], eax
mov dword [esp + 0xc], 1
mov eax, 0x80
mov dword [ebp + 8], ecx
xor ebx, ebx
sub eax, edi
shl edi, 3
mov dword [esp + 8], eax
shr eax, 1
lea esi, [ecx + edi]
mov dword [esp + 4], eax
mov ecx, dword [esp + 4]
add edi, edx
xor eax, eax
lea esi, [esi]
movdqu xmm0, xmmword [edi + eax]
add ebx, 1
pxor xmm0, xmmword [esi + eax]
movaps xmmword [esi + eax], xmm0
add eax, 0x10
cmp ebx, ecx
jb 0x4b9150
mov edi, dword [esp + 8]
mov ebx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, edi
and eax, 0xfffffffe
add ebx, eax
cmp edi, eax
je 0x4b918d
lea eax, [ecx + ebx*8]
mov ecx, dword [edx + ebx*8]
xor dword [eax], ecx
mov edx, dword [edx + ebx*8 + 4]
xor dword [eax + 4], edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
mov esi, esi
lea edi, [edi]
mov ebx, dword [edx + eax*8]
xor dword [ecx + eax*8], ebx
mov ebx, dword [edx + eax*8 + 4]
xor dword [ecx + eax*8 + 4], ebx
add eax, 1
cmp eax, 0x80
jne 0x4b91a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4cb630
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov dword [esp + 4], 0x4cb300
mov dword [esp], 0x7e2064
call fcn.004e34e0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
call dword [sym.imp.KERNEL32.DLL_CreateIoCompletionPort]
sub esp, 0x10
test eax, eax
mov dword [ebx + 0x1c], eax
je 0x4cb810
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
lea ebp, [ebx + 0x70]
mov dword [esp], ebx
call fcn.004e41e0
lea eax, [ebx + 0x68]
mov dword [ebx + 4], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], eax
lea eax, [ebx + 8]
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x10]
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x54], 0
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x18], 0
mov dword [esp], ebp
call fcn.004e36c0
test eax, eax
mov esi, eax
je 0x4cb762
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
sub esp, 4
mov dword [ebx + 0x1c], 0xffffffff
mov eax, esi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebx + 0x88]
mov dword [esp + 8], 0x4c9180
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.004cb0e0
test eax, eax
mov esi, eax
jne 0x4cb840
mov eax, dword [ebx + 0xb4]
test al, 0x20
je 0x4cb7c0
mov edx, eax
and edx, 0xffffffdf
test al, 1
mov dword [ebx + 0xb4], edx
jne 0x4cb8b0
and eax, 0x40
mov ecx, eax
mov eax, edx
test ecx, ecx
je 0x4cb7c0
mov edx, dword [ebx + 0x8c]
sub dword [edx + 4], 1
nop
lea esi, [esi]
or al, 0x80
mov dword [ebx + 0xb4], eax
mov dword [esp], 0x7e2040
call fcn.004e3720
mov edi, dword [0x7e205c]
cmp edi, dword [0x7e2058]
mov eax, dword [0x7e2060]
je 0x4cb850
mov dword [eax + edi*4], ebx
add edi, 1
mov dword [esp], 0x7e2040
mov dword [0x7e205c], edi
call fcn.004e3770
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp + 0x40], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004cc7f0
mov dword [esp], 0x7e2040
mov esi, 0xe
call fcn.004e3770
mov esi, esi
lea edi, [edi]
mov dword [esp], ebp
call fcn.004e3700
jmp 0x4cb742
add edi, 8
mov eax, dword [0x7e2060]
lea ecx, [edi*4]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 0x1c], ecx
call fcn.004c9630
test eax, eax
je 0x4cb826
mov edx, dword [0x7e2058]
mov dword [0x7e2060], eax
cmp edi, edx
jle 0x4cb89d
mov ecx, dword [esp + 0x1c]
lea edx, [eax + edx*4]
add ecx, eax
nop
lea esi, [esi]
mov dword [edx], 0
add edx, 4
cmp ecx, edx
jne 0x4cb890
mov dword [0x7e2058], edi
mov edi, dword [0x7e205c]
jmp 0x4cb7e7
mov eax, edx
jmp 0x4cb7c0
Function at 0x4cce20
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov esi, edx
mov ebx, eax
sub esp, 0x2c
mov dword [esp], eax
call sub.msvcrt.dll_wcstombs
test eax, eax
je 0x4cce67
lea ebp, [eax - 1]
mov ecx, eax
movzx eax, word [ebx + ebp*2]
cmp ax, 0x5c
je 0x4cceb1
cmp ax, 0x2f
jne 0x4cce63
jmp 0x4cceb1
sub ebp, 1
movzx eax, word [ebx + ebp*2]
cmp ax, 0x2f
je 0x4cceb1
cmp ax, 0x5c
je 0x4cceb1
test ebp, ebp
jne 0x4cce50
test esi, esi
je 0x4cce9d
mov dword [esp], 0x20a
call fcn.004c95e0
test eax, eax
mov dword [esi], eax
je 0x4ccf59
mov dword [esp + 4], eax
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
sub esp, 8
test eax, eax
je 0x4ccf42
mov dword [esp], ebx
call sub.msvcrt.dll__wopen
mov dword [edi], eax
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
test ebp, ebp
je 0x4cce67
test esi, esi
je 0x4ccefb
lea eax, [ebp + ebp + 4]
mov dword [esp + 0x1c], ecx
mov dword [esp], eax
mov dword [esp + 0x18], eax
call fcn.004c95e0
test eax, eax
mov dword [esi], eax
je 0x4ccf59
lea edx, [ebp + 1]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 8], edx
call fcn.00548250
mov eax, dword [esi]
mov edx, dword [esp + 0x18]
xor ecx, ecx
mov word [eax + edx - 2], cx
mov ecx, dword [esp + 0x1c]
mov edx, ecx
sub edx, ebp
lea esi, [edx + edx]
mov dword [esp + 0x18], edx
mov dword [esp], esi
call fcn.004c95e0
test eax, eax
mov dword [edi], eax
je 0x4ccf59
mov edx, dword [esp + 0x18]
mov dword [esp], eax
lea ecx, [edx - 1]
lea edx, [ebx + ebp*2 + 2]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call fcn.00548250
mov eax, dword [edi]
xor edx, edx
mov word [eax + esi - 2], dx
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi]
mov dword [esp], eax
call fcn.004c95f0
mov dword [esi], 0
mov eax, 0xffffffff
jmp 0x4ccf3a
mov dword [esp + 4], 0x751b04
mov dword [esp], 0xe
call fcn.004cc730
lea esi, [esi]
Function at 0x4ce870
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x7c
mov esi, dword [esp + 0x90]
mov eax, dword [esi + 0xf4]
cmp eax, 0xffffffff
jne 0x4ce8a2
mov dword [esi + 0x48], 0xfffff00d
mov dword [esi + 0xf0], 6
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esi + 0x110]
mov ecx, dword [esi + 0x114]
mov dword [esp], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ecx
call dword [sym.imp.msvcrt.dll__iob]
cmp eax, 0xffffffff
mov ebp, eax
je 0x4cea81
mov ecx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov edx, ecx
mov ecx, ebx
not ecx
not edx
mov eax, ecx
or eax, edx
jne 0x4ce9a3
mov dword [esp + 0x38], 0
mov dword [esp + 0x2c], 0
or ecx, edx
xor ebx, ebx
xor edi, edi
mov dword [esp + 0x28], ecx
jmp 0x4ce908
cmp dword [esi + 0x108], ebx
jbe 0x4ce963
mov edx, dword [esp + 0x28]
test edx, edx
je 0x4ce924
xor edx, edx
mov eax, edi
add eax, dword [esp + 0x30]
adc edx, dword [esp + 0x34]
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], edx
mov eax, dword [esi + 0x10c]
mov ecx, dword [esp + 0x2c]
lea eax, [eax + ebx*8]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x4c]
add ebx, 1
mov dword [esp + 0xc], ecx
mov edx, dword [eax]
mov dword [esp + 8], edx
mov eax, dword [eax + 4]
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
sub esp, 0x14
add edi, dword [esp + 0x4c]
test eax, eax
mov edx, edi
jne 0x4ce900
mov ecx, eax
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x4cea40
or ecx, edx
je 0x4cea20
cmp edx, 0xffffffff
mov dword [esi + 0x48], edx
jne 0x4ce89a
call dword [sym.imp.msvcrt.dll___doserrno]
mov eax, dword [eax]
mov dword [esi + 0xf0], eax
mov dword [esp], eax
call fcn.004cc7f0
mov dword [esi + 0x48], eax
jmp 0x4ce89a
lea eax, [esp + 0x50]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
sub esp, 0x14
test eax, eax
setne al
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x3c]
movzx eax, al
mov dword [esp + 0x38], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x2c], eax
jmp 0x4ce8f4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x26
jne 0x4ceaa0
mov dword [esi + 0x48], 0
jmp 0x4ce89a
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp], ebp
mov dword [esp + 8], edx
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
sub esp, 0x14
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
jmp 0x4ce971
mov dword [esi + 0xf0], 6
mov dword [esp], 6
call fcn.004cc7f0
mov dword [esi + 0x48], eax
jmp 0x4ce89a
mov dword [esi + 0xf0], eax
mov dword [esp], eax
call fcn.004cc7f0
mov dword [esi + 0x48], eax
jmp 0x4ce89a
Function at 0x4ceac0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x7c
mov esi, dword [esp + 0x90]
mov eax, dword [esi + 0xf4]
cmp eax, 0xffffffff
jne 0x4ceaf2
mov dword [esi + 0x48], 0xfffff00d
mov dword [esi + 0xf0], 6
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esi + 0x110]
mov ecx, dword [esi + 0x114]
mov dword [esp], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ecx
call dword [sym.imp.msvcrt.dll__iob]
cmp eax, 0xffffffff
mov ebp, eax
je 0x4cecd1
mov ecx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov edx, ecx
mov ecx, ebx
not ecx
not edx
mov eax, ecx
or eax, edx
jne 0x4cebf3
mov dword [esp + 0x38], 0
mov dword [esp + 0x2c], 0
or ecx, edx
xor ebx, ebx
xor edi, edi
mov dword [esp + 0x28], ecx
jmp 0x4ceb58
cmp dword [esi + 0x108], ebx
jbe 0x4cebb3
mov edx, dword [esp + 0x28]
test edx, edx
je 0x4ceb74
xor edx, edx
mov eax, edi
add eax, dword [esp + 0x30]
adc edx, dword [esp + 0x34]
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], edx
mov eax, dword [esi + 0x10c]
mov ecx, dword [esp + 0x2c]
lea eax, [eax + ebx*8]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x4c]
add ebx, 1
mov dword [esp + 0xc], ecx
mov edx, dword [eax]
mov dword [esp + 8], edx
mov eax, dword [eax + 4]
mov dword [esp], ebp
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
sub esp, 0x14
add edi, dword [esp + 0x4c]
test eax, eax
mov edx, edi
jne 0x4ceb50
mov ecx, eax
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x4cec90
or ecx, edx
je 0x4cec70
cmp edx, 0xffffffff
mov dword [esi + 0x48], edx
jne 0x4ceaea
call dword [sym.imp.msvcrt.dll___doserrno]
mov eax, dword [eax]
mov dword [esi + 0xf0], eax
mov dword [esp], eax
call fcn.004cc7f0
mov dword [esi + 0x48], eax
jmp 0x4ceaea
lea eax, [esp + 0x50]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebp
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
sub esp, 0x14
test eax, eax
setne al
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x3c]
movzx eax, al
mov dword [esp + 0x38], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x2c], eax
jmp 0x4ceb44
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esi + 0xf0], eax
mov dword [esp], eax
call fcn.004cc7f0
mov dword [esi + 0x48], eax
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp], ebp
mov dword [esp + 8], edx
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
sub esp, 0x14
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
jmp 0x4cebc1
mov dword [esi + 0xf0], 6
mov dword [esp], 6
call fcn.004cc7f0
mov dword [esi + 0x48], eax
jmp 0x4ceaea
Function at 0x4d64a0
Capabilities:
Resolve dns

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx + 0x24]
lea edx, [ebx + 0x24]
mov dword [ebx + 0x24], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
sub esp, 0x10
mov dword [esp], eax
call fcn.004d63d0
mov dword [ebx + 0x2c], eax
add esp, 0x18
pop ebx
ret
Function at 0x4d7450
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
push edi
mov edi, eax
push esi
push ebx
mov esi, edx
mov ebx, ecx
sub esp, 0x2c
test byte [edx + 0x2d], 8
je 0x4d75e0
mov eax, dword [esp + 0x40]
mov edx, dword [ebx + 0x3c]
test eax, eax
jne 0x4d750e
cmp edx, 0xffffffff
je 0x4d7497
mov dword [esp + 8], 0x323
mov dword [esp + 4], str.src_win_pipe.c
mov dword [esp], str.req__pipeHandle__INVALID_HANDLE_VALUE
call fcn.0053e6a0
mov eax, dword [esi + 0x98]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10000
mov dword [esp + 0x10], 0x10000
mov dword [esp + 0xc], 0xff
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000003
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CreateNamedPipeW]
sub esp, 0x20
cmp eax, 0xffffffff
mov dword [ebx + 0x3c], eax
je 0x4d759b
mov ecx, eax
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
mov edx, esi
mov eax, edi
call fcn.004d71d0
test eax, eax
jne 0x4d7585
mov edx, dword [ebx + 0x3c]
cmp edx, 0xffffffff
je 0x4d7624
lea eax, [ebx + 0x20]
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.KERNEL32.DLL_ConnectNamedPipe]
sub esp, 8
test eax, eax
je 0x4d7560
add dword [esi + 0x3c], 1
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [sym.imp.KERNEL32.DLL_GetLastError]
call ebp
cmp eax, 0x3e5
je 0x4d7551
call ebp
cmp eax, 0x217
jne 0x4d7601
mov dword [ebx + 0x20], 0
jmp 0x4d75b4
mov eax, dword [ebx + 0x3c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebx + 0x3c], 0xffffffff
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.DLL_GetLastError]
call ebp
test eax, eax
jle 0x4d7620
call ebp
movzx eax, ax
or eax, 0x80070000
mov dword [ebx + 0x20], eax
mov eax, dword [edi + 0x28]
mov dword [ebx + 0x38], 0
test eax, eax
je 0x4d7650
mov edx, dword [eax + 0x38]
mov dword [ebx + 0x38], edx
mov dword [eax + 0x38], ebx
mov dword [edi + 0x28], ebx
add dword [esi + 0x3c], 1
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x320
mov dword [esp + 4], str.src_win_pipe.c
mov dword [esp], 0x752174
call fcn.0053e6a0
jmp 0x4d7467
mov eax, dword [ebx + 0x3c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebx + 0x3c], 0xffffffff
sub esp, 4
call ebp
test eax, eax
jg 0x4d75a7
lea esi, [esi]
call ebp
jmp 0x4d75b1
mov dword [esp + 8], 0x33b
mov dword [esp + 4], str.src_win_pipe.c
mov dword [esp], str.req__pipeHandle___INVALID_HANDLE_VALUE
call fcn.0053e6a0
mov edx, dword [ebx + 0x3c]
jmp 0x4d7517
mov dword [ebx + 0x38], ebx
mov dword [edi + 0x28], ebx
add dword [esi + 0x3c], 1
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4d9320
Capabilities:
Create pipe

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [esp + 0x58]
mov esi, dword [esp + 0x5c]
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x54]
or edi, 0x40080000
jmp 0x4d9359
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xe7
je 0x4d9356
cmp eax, 5
jne 0x4d9450
add ebx, 1
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 8], str._pipeuv_p__lu
mov dword [esp + 4], ebp
mov dword [esp], esi
call fcn.004d9150
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10000
mov dword [esp + 0x10], 0x10000
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_CreateNamedPipeA]
sub esp, 0x20
cmp eax, 0xffffffff
je 0x4d9340
mov ecx, eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], 0
mov dword [esp + 0x28], ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x50]
mov eax, dword [eax + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.DLL_CreateIoCompletionPort]
sub esp, 0x10
test eax, eax
mov ecx, dword [esp + 0x28]
je 0x4d9420
mov eax, dword [esp + 0x54]
mov dword [esp + 0x28], ecx
call fcn.004d7de0
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x28]
xor edx, edx
mov dword [eax + 0x94], ecx
add esp, 0x3c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x2c], ecx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
sub esp, 4
mov edx, dword [esp + 0x28]
add esp, 0x3c
pop ebx
pop esi
mov eax, edx
pop edi
pop ebp
ret
add esp, 0x3c
mov edx, eax
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret

Function at 0x4da7b0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
cmp dword [esp + 0x1c], 1
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
je 0x4da7d5
mov eax, 0x32
pop ebx
pop esi
ret
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], ebx
pop ebx
pop esi
jmp fcn.004d84c0
Function at 0x4dd170
Capabilities:
Terminate process

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x34
cmp edx, 2
je 0x4dd1d5
jg 0x4dd1c0
test edx, edx
jne 0x4dd1ca
lea eax, [esp + 0x2c]
mov dword [esp + 0x1c], edx
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
sub esp, 8
test eax, eax
mov edx, dword [esp + 0x1c]
je 0x4dd210
cmp dword [esp + 0x2c], 0x103
mov eax, 0xfffff038
cmove eax, edx
add esp, 0x34
pop ebx
pop esi
ret
cmp edx, 9
je 0x4dd1d5
cmp edx, 0xf
je 0x4dd1d5
add esp, 0x34
mov eax, 0xfffff02a
pop ebx
pop esi
ret
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov edx, eax
sub esp, 8
xor eax, eax
test edx, edx
jne 0x4dd1b2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
mov esi, eax
je 0x4dd224
mov dword [esp], esi
call fcn.004cc7f0
add esp, 0x34
pop ebx
pop esi
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], eax
call fcn.004cc7f0
add esp, 0x34
pop ebx
pop esi
ret
lea eax, [esp + 0x2c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
sub esp, 8
test eax, eax
je 0x4dd1fe
cmp dword [esp + 0x2c], 0x103
mov eax, 0xfffff038
jne 0x4dd1b2
jmp 0x4dd1fe

Function at 0x4dfcf0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x1c
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x2c]
test al, 1
jne 0x4dfd60
test eax, 0x10000
je 0x4dfd70
mov edx, dword [edx + 8]
cmp edx, 0xc
je 0x4dfd50
cmp edx, 0xe
je 0x4dfd41
cmp edx, 7
mov eax, 0xfffff008
je 0x4dfd3d
mov dword [esp + 8], 0xc8
mov dword [esp + 4], str.src_win_stream.c
mov dword [esp], 0x7531bd
call fcn.0053e6a0
mov eax, 0xfffff02a
add esp, 0x1c
ret
add esp, 0x1c
jmp 0x4e9890
add esp, 0x1c
jmp 0x4e1c80
mov eax, 0xfffff00d
jmp 0x4dfd3d
mov eax, 0xfffff031
jmp 0x4dfd3d
sub esp, 0x3c
mov eax, dword [esp + 0x40]
mov edx, dword [eax + 0x88]
test edx, edx
jne 0x4e1d00
lea edx, [esp + 0x2c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x44]
mov dword [esp + 4], edx
mov eax, dword [eax + 0x90]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_WSASend]
sub esp, 0x1c
cmp eax, 0xffffffff
mov edx, dword [esp + 0x2c]
je 0x4e1ce2
mov eax, edx
add esp, 0x3c
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp], eax
call fcn.004cc7f0
mov edx, eax
add esp, 0x3c
mov eax, edx
ret
mov edx, 0xfffff008
jmp 0x4e1cdc
push esi
push ebx
sub esp, 0x24
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov esi, dword [esp + 0x38]
mov edx, dword [eax + 0x88]
test edx, edx
jne 0x4e98e3
lea edx, [esp + 0x1c]
mov ecx, esi
mov dword [esp], edx
mov edx, ebx
call fcn.004e5c60
test eax, eax
jne 0x4e98d1
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.004cac10
add esp, 0x24
pop ebx
pop esi
ret
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.004cc7f0
add esp, 0x24
pop ebx
pop esi
ret
mov eax, 0xfffff008
jmp 0x4e98cb
Function at 0x4e0560
Capabilities:
Set socket configuration

Disassembly:
push esi
push ebx
mov esi, eax
sub esp, 0x34
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], 4
mov dword [esp + 8], 8
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xffff
mov dword [esp], esi
call ebx
sub esp, 0x14
cmp eax, 0xffffffff
je 0x4e05df
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x4e05b2
add esp, 0x34
xor eax, eax
pop ebx
pop esi
ret
lea eax, [esp + 0x28]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 3
mov dword [esp + 4], 6
mov dword [esp], esi
mov dword [esp + 0xc], eax
call ebx
sub esp, 0x14
cmp eax, 0xffffffff
jne 0x4e05aa
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add esp, 0x34
pop ebx
pop esi
ret