joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e9e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x44eacb
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x44eaba
jg 0x44ea20
test edx, edx
je 0x44eaba
nop dword [eax]
call fcn.00440430
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x44ea77
jg 0x44ea37
test esi, esi
je 0x44ea77
cmp ebx, eax
jg 0x44ea47
jl 0x44ea41
cmp edi, esi
jae 0x44ea47
mov esi, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0xc]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [esp + 0x18]
call fcn.004be060
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x10]
jmp 0x44ea9c
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x44eab4
mov eax, dword [esp + 0x10]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [esp + 0xc]
add eax, esi
mov dword [esp + 0x10], eax
test ebx, ebx
jg 0x44ea20
jl 0x44eab4
test edi, edi
jne 0x44ea20
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x44eaed
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x44eaef
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x44eba5
jg 0x44eb0a
test esi, esi
je 0x44eba5
test eax, eax
jl 0x44eb53
jg 0x44eb14
test ebx, ebx
je 0x44eb53
cmp edi, eax
jg 0x44eb24
jl 0x44eb1e
cmp esi, ebx
jae 0x44eb24
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [esp + 0x14]
push dword [ebp + 8]
call fcn.004be060
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov dword [esp + 0x10], edx
mov eax, dword [ecx + 0x2c]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x44eb5a
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test edi, edi
jl 0x44eba5
jg 0x44eb64
test esi, esi
je 0x44eba5
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x44eba5
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x44eb90
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [esp + 0x1c]
call fcn.004d5a2c
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44ef20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x53e754]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x44ef50
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6894
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x44ef8c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x44ef8c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6894
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x44f075
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x44efb4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x44efe7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004cbb96
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6894
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x44f075
cmp eax, 1
jle 0x44f048
cmp eax, 3
jne 0x44f075
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.004cbb96
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6894
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x44f065
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004cc064
add esp, 0x10
cmp edi, eax
jne 0x44f075
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x44ef77
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a6894
mov esp, ebp
pop ebp
ret 4
Function at 0x44f5f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x53e754]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x44f693
cmp byte [esi + 0x3d], 0
je 0x44f693
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x44f649
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x44f65b
sub eax, 1
je 0x44f65f
sub eax, 2
je 0x44f693
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6894
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x44f67c
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004cc064
add esp, 0x10
cmp edi, eax
jne 0x44f649
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a6894
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004a6894
mov esp, ebp
pop ebp
ret
Function at 0x450d70
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f64e0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x53e754]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov byte [ebp - 0x44], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x44]
mov edx, esi
call fcn.00424170
add esp, 4
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00439a80
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call fcn.00419480
test bl, bl
je 0x450e40
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x450dde
mov eax, dword [esi]
push 0
push 0
push 3
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x450e47
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x450e4e
cmp eax, 3
je 0x450e4e
cmp eax, 0x20
je 0x450e13
cmp eax, 5
je 0x450e4e
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.00432fe0
mov dword [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x450e2c
mov eax, dword [eax]
mov edx, eax
mov ecx, str.Skipping_log_file_because_it_was_in_use__file:__s_
call fcn.00441e50
lea ecx, [ebp - 0x28]
call fcn.00419480
xor al, al
jmp 0x450ed9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x450e58
mov ecx, dword [esi]
call fcn.0043cb70
or eax, edx
jne 0x450ed7
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.00432fe0
mov dword [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x450e7a
mov eax, dword [eax]
mov edx, eax
mov ecx, str.Deleting_log_file_because_it_was_empty__file:__s_
call fcn.00441e50
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.00419480
cmp byte [esi + 0x18], 0
je 0x450e40
mov ecx, esi
call fcn.00439e20
test al, al
jne 0x450e40
mov edx, esi
lea ecx, [ebp - 0x40]
call fcn.00432fe0
mov dword [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x450ebf
mov eax, dword [eax]
mov edx, eax
mov ecx, str.Couldnt_delete_empty_file__file:__s_
call fcn.00426560
lea ecx, [ebp - 0x40]
call fcn.00419480
xor al, al
jmp 0x450ed9
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a6894
mov esp, ebp
pop ebp
ret
Function at 0x457e50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ef8c0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x53e754]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
mov edi, edx
sbb ecx, ecx
xor al, al
and ecx, 0xfffffffc
push edx
mov ecx, dword [ecx + esi + 0x30]
rep stosb byte es:[edi], al
call fcn.004736c0
add esp, 4
mov dword [ebp - 4], 1
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x457ebf
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x457ed0
push 0x48
push esi
call fcn.004a68a5
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4581a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f73f0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x53e754]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
mov edi, edx
sbb ecx, ecx
xor al, al
and ecx, 0xfffffffc
push edx
mov ecx, dword [ecx + esi + 0x30]
rep stosb byte es:[edi], al
call fcn.004736c0
mov dword [ebp - 4], 1
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
mov edi, edx
sbb ecx, ecx
xor al, al
and ecx, 0xfffffffc
push edx
mov ecx, dword [ecx + esi + 0x20]
rep stosb byte es:[edi], al
call fcn.004736c0
add esp, 8
mov dword [ebp - 4], 2
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x458227
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x458238
push 0x40
push esi
call fcn.004a68a5
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x459b70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f7728
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x53e754]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0xf
mov byte [ebp - 0x6c], 0
lea eax, [ebp - 0x74]
mov dword [ebp - 4], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], 0x40
mov dword [ebp - 0x78], 1
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push str.MachineGuid
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test esi, esi
jne 0x459c2e
test eax, eax
jne 0x459c2e
lea ecx, [ebp - 0x54]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x459c18
sub ecx, edx
lea eax, [ebp - 0x54]
push ecx
push eax
lea ecx, [ebp - 0x6c]
call fcn.00418ea0
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0
lea edx, [ebp - 0x6c]
cmp dword [ebp - 0x58], 0x10
mov ecx, edi
cmovae edx, dword [ebp - 0x6c]
call fcn.00439c70
mov edx, dword [ebp - 0x58]
cmp edx, 0x10
jb 0x459ce6
mov ecx, dword [ebp - 0x6c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x459cdc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x459d04
jmp 0x459cdc
push edx
push ecx
call fcn.004a68a5
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a6894
mov esp, ebp
pop ebp
ret
call fcn.004c6faf
call fcn.004c6faf
int3
Function at 0x45ecd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x811c9dc5
push esi
mov dword [ebp - 8], ecx
xor esi, esi
push edi
lea ecx, [ebx + 4]
mov edx, ebx
cmp ecx, ebx
sbb edi, edi
and edi, 0xfffffffc
add edi, 4
cmp ebx, ecx
ja 0x45ed13
nop dword [eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
inc esi
imul eax, ecx, 0x1000193
cmp esi, edi
jne 0x45ed00
mov esi, dword [ebp - 8]
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0xc]
and ecx, eax
mov esi, dword [esi + 4]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
nop dword [eax]
cmp edi, esi
jne 0x45ed38
mov ecx, esi
jmp 0x45ed3d
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x45ed50
mov ecx, dword [eax + 8]
cmp ecx, dword [ebx]
je 0x45ed4c
mov eax, dword [eax]
jmp 0x45ed30
cmp eax, esi
jne 0x45ed9a
mov esi, dword [esi]
lea eax, [ebp - 0xc]
push ecx
push eax
push ecx
mov edi, dword [esi + 4]
push edi
push esi
mov dword [ebp - 0xc], ebx
call fcn.0045ffd0
mov ebx, dword [ebp - 8]
mov edx, eax
mov ecx, 0x71c71c6
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x45eda6
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0045fb90
mov eax, dword [ebp - 0x10]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.0048faed
int3
Function at 0x460000
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov edx, 0x811c9dc5
push ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 4], ecx
push edi
lea esi, [eax + 8]
xor edi, edi
lea ecx, [esi + 4]
cmp ecx, esi
sbb ebx, ebx
and ebx, 0xfffffffc
add ebx, 4
cmp esi, ecx
ja 0x460043
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, edx
inc edi
imul edx, ecx, 0x1000193
cmp edi, ebx
jne 0x460030
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
and ecx, edx
mov edx, dword [ebx + 0xc]
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x46007c
cmp ecx, eax
jne 0x460074
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x460084
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x460084
cmp ecx, eax
jne 0x460084
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.0045f570
mov eax, dword [ebp - 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4607bb
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x53e754]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
lea ecx, [ebp - 0x10]
push edi
call fcn.00460447
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push esi
mov eax, 0x4000
push eax
push eax
push 1
push esi
push 0x40080003
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [ebx + 8], eax
cmp eax, 0xffffffff
jne 0x460804
mov dword [ebx + 8], esi
jmp 0x460858
lea esi, [ebx + 0x14]
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
push dword [ebx + 8]
mov dword [ebx + 0x24], eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x460858
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x460858
push dword [ebx + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
xor eax, eax
lea edi, [ebx + 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push dword [ebx + 8]
call esi
and dword [ebx + 8], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a6894
leave
ret
Function at 0x4736d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
xor cl, cl
mov edx, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 8], eax
push ebp
push esi
push edi
test bl, 3
jne 0x473801
test al, 3
jne 0x473801
mov edi, edx
mov dword [esp + 0x10], 0
shr edi, 2
xor esi, esi
test edi, edi
je 0x4737bc
cmp edi, 8
jb 0x473785
mov ebp, dword [esp + 0x24]
mov ecx, edi
mov dword [esp + 0x14], ebx
and ecx, 0xfffffff8
add eax, 0x10
xorps xmm3, xmm3
sub dword [esp + 0x14], ebp
xorps xmm2, xmm2
mov ebp, dword [esp + 0x14]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, ecx
jb 0x473734
mov eax, dword [esp + 0x24]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd dword [esp + 0x10], xmm2
cmp esi, edi
jae 0x4737c0
mov ebp, ebx
lea ecx, [eax + esi*4]
sub ebp, eax
mov dword [esp + 0x14], ebp
mov ebp, edi
mov ebx, dword [esp + 0x14]
sub ebp, esi
mov esi, edi
mov edi, dword [esp + 0x10]
mov eax, dword [ecx + ebx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
or edi, eax
sub ebp, 1
jne 0x4737a2
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x10], edi
jmp 0x4737c4
xor edi, edi
jmp 0x4737c4
mov edi, dword [esp + 0x10]
shl esi, 2
sub edx, esi
jne 0x4737d8
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
add ebx, esi
mov ebp, dword [esp + 0x24]
mov ecx, eax
shr eax, 0x10
add ebp, esi
shr ecx, 0x18
or cl, al
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x10]
shr eax, 8
or cl, al
mov eax, ebp
or cl, byte [esp + 0x10]
xor edi, edi
test edx, edx
je 0x4738c0
cmp edx, 0x20
jb 0x47389a
mov esi, edx
xorps xmm3, xmm3
and esi, 0xffffffe0
xorps xmm2, xmm2
mov dword [esp + 0x10], esi
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [ebx + edi + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x473835
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or cl, al
mov ebp, dword [esp + 0x14]
cmp edi, edx
jae 0x4738c0
sub ebx, ebp
lea esi, [edi + ebp]
sub edx, edi
nop dword [eax]
mov al, byte [ebx + esi]
lea esi, [esi + 1]
xor al, byte [esi - 1]
or cl, al
sub edx, 1
jne 0x4738b0
pop edi
pop esi
test cl, cl
pop ebp
sete al
pop ebx
add esp, 0xc
ret
Function at 0x487d00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 8]
not eax
push esi
mov esi, dword [esp + 0x10]
push edi
cmp esi, 8
jbe 0x487dd6
test bl, 7
je 0x487d39
nop
movzx ecx, byte [ebx]
dec esi
movzx edx, al
inc ebx
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x504318]
test bl, 7
jne 0x487d20
mov edi, esi
and esi, 7
and edi, 0xfffffff8
add edi, ebx
cmp ebx, edi
jae 0x487dd6
nop dword [eax + eax]
xor eax, dword [ebx]
add ebx, 4
mov dword [esp + 0x18], ebx
add dword [esp + 0x18], 4
mov ebx, dword [ebx]
mov ecx, ebx
shr ecx, 0x10
movzx edx, cl
mov ecx, ebx
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0x504718]
xor edx, dword [ecx*4 + 0x504b18]
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
xor edx, dword [ecx*4 + 0x505718]
mov ecx, eax
shr ecx, 8
movzx ecx, cl
xor edx, dword [ecx*4 + 0x505b18]
mov ecx, ebx
shr ecx, 0x18
xor edx, dword [ecx*4 + 0x504318]
mov ecx, eax
shr ecx, 0x18
movzx eax, al
xor edx, dword [ecx*4 + 0x505318]
movzx ecx, bl
mov ebx, dword [esp + 0x18]
xor edx, dword [ecx*4 + 0x504f18]
xor edx, dword [eax*4 + 0x505f18]
mov eax, edx
cmp ebx, edi
jb 0x487d50
test esi, esi
je 0x487dfa
nop word [eax + eax]
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x504318]
sub esi, 1
jne 0x487de0
pop edi
pop esi
not eax
pop ebx
ret

Function at 0x487e00
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 8]
not eax
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x18]
not esi
cmp edi, 4
jbe 0x487ee6
mov dword [esp + 0x1c], ebx
test bl, 3
je 0x487e58
nop word [eax + eax]
movzx ecx, byte [ebx]
dec edi
movzx edx, al
inc ebx
shrd eax, esi, 8
xor edx, ecx
shr esi, 8
xor eax, dword [edx*8 + 0x506318]
xor esi, dword [edx*8 + 0x50631c]
test bl, 3
jne 0x487e30
mov dword [esp + 0x1c], ebx
mov ebp, edi
xor edx, edx
and ebp, 0xfffffffc
and edi, 3
mov dword [esp + 0x18], edi
lea ecx, [ebx + ebp]
shr ebp, 2
cmp ebx, ecx
cmova ebp, edx
test ebp, ebp
je 0x487ee6
xor edi, edi
mov ebx, dword [ebx]
inc edi
xor ebx, eax
mov eax, ebx
shr eax, 0x10
movzx edx, al
mov eax, ebx
shr eax, 8
movzx ecx, al
mov eax, dword [edx*8 + 0x506b18]
mov edx, dword [edx*8 + 0x506b1c]
xor eax, dword [ecx*8 + 0x507318]
xor edx, dword [ecx*8 + 0x50731c]
mov ecx, ebx
shr ecx, 0x18
xor eax, dword [ecx*8 + 0x506318]
xor edx, dword [ecx*8 + 0x50631c]
movzx ecx, bl
mov ebx, dword [esp + 0x1c]
add ebx, 4
mov dword [esp + 0x1c], ebx
xor eax, dword [ecx*8 + 0x507b18]
xor edx, dword [ecx*8 + 0x507b1c]
xor eax, esi
xor edx, 0
mov esi, edx
cmp edi, ebp
jb 0x487e77
mov edi, dword [esp + 0x18]
test edi, edi
je 0x487f15
nop word [eax + eax]
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx edx, al
shrd eax, esi, 8
xor edx, ecx
shr esi, 8
xor eax, dword [edx*8 + 0x506318]
xor esi, dword [edx*8 + 0x50631c]
sub edi, 1
jne 0x487ef0
not esi
not eax
pop edi
mov edx, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x4a9ee5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4e51a5
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e5121

Function at 0x4e580e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e54cd

Function at 0x4e5819
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e5650

Function at 0x4e97e7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e9481