joyce8/EMBER2024-capa huggingface dataset:
Function at 0x551a80
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x7aa024]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov edx, 0x20019
or edx, dword [ebp + 0x10]
push esi
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x551b44
xor eax, eax
lea edx, [ebp - 0x1c]
mov dword [edx], eax
mov ecx, dword [esi]
sub esp, 0x30
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
xorps xmm0, xmm0
movups xmmword [esp + 0x14], xmm0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x551b3c
mov eax, dword [ebp - 0x1c]
sub eax, 1
setb dl
mov dword [esi + 4], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x551b4a
test dl, dl
jne 0x551b4a
lea edx, [ebp - 0x14]
mov dword [edx], 0x104
xor ebx, ebx
dec ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
lea ebx, [esi + 8]
xor edi, edi
lea edx, [ebp - 0x1c]
push edx
push edi
push edi
push edi
lea edx, [ebp - 0x14]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x551b50
jmp 0x551b4a
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi], 0
mov word [esi + 8], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x551bb0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x551c0e
sub eax, 1
setb dl
mov dword [esi + 4], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x551c0e
test dl, dl
jne 0x551c0e
lea edx, [ebp - 0x14]
mov dword [edx], 0x104
xor edi, edi
dec edi
lea ebx, [ebp - 0x1c]
mov dword [ebx], edi
mov dword [ebx + 4], edi
lea edi, [esi + 8]
xor edx, edx
push ebx
push edx
push edx
push edx
lea edx, [ebp - 0x14]
push edx
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x551c14
mov word [esi + 8], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x552210
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7bc368]
mov ecx, dword [0x7ae174]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x552241
movzx eax, word [0x7bc344]
cmp eax, 9
jne 0x55228c
xor eax, eax
inc eax
pop ebp
ret
push 0x7bc368
call fcn.0064cde7
add esp, 4
cmp dword [0x7bc368], 0xffffffff
jne 0x552230
xorps xmm0, xmm0
movups xmmword [0x7bc354], xmm0
movups xmmword [0x7bc344], xmm0
mov dword [0x7bc364], 0
push 0x7bc344
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x7bc368
call fcn.0064ce5d
add esp, 4
jmp 0x552230
test eax, eax
je 0x55223f
cmp eax, 6
jne 0x55229c
mov eax, 2
jmp 0x55223f
cmp eax, 0xc
jne 0x5522a8
mov eax, 3
jmp 0x55223f
mov eax, 4
jmp 0x55223f
Function at 0x555f50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x556042
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x301
mov dword [esp + 0x54], ecx
mov eax, dword [eax]
mov dword [esp + 0x60], eax
sar eax, 0x1f
mov dword [esp + 0x64], eax
xor eax, eax
dec eax
lea ecx, [esp + 0x48]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [esp], ecx
call fcn.005f3000
mov eax, dword [0x7bc5f0]
mov ecx, dword [0x7ae174]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x5560be
mov dword [esp], 0x746a04
call fcn.005f3c30
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
xor ebx, ebx
mov dword [esp + 0x40], ebx
mov dword [esp], edi
lea edi, [esp + 0x50]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
pxor xmm0, xmm0
movdqu xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x73eac0]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.0057a240
sub esp, 0x44
cmp byte [edi], 0
jne 0x5560a6
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.0064d372
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + ebx*8 + 0x60]
test esi, esi
je 0x5560b2
lea ecx, [esi + 0x5c]
call fcn.005d62e0
lea ecx, [esi + 0x28]
call fcn.005d1080
mov ecx, esi
call fcn.005d6460
mov dword [esp], esi
call fcn.0064cd6e
jmp 0x5560b2
mov esi, dword [esp + ebx*8 + 0x60]
test esi, esi
je 0x5560b2
mov eax, dword [esi]
mov edi, dword [eax]
mov ecx, edi
call dword [section..00cfg]
mov dword [esp], 1
mov ecx, esi
call edi
sub esp, 4
mov al, byte [esp + ebx + 0x51]
jmp 0x5560ae
mov al, byte [esp + ebx + 0x51]
cmp al, 8
je 0x55607e
cmp al, 9
je 0x556055
inc ebx
movzx eax, byte [esp + 0x50]
cmp ebx, eax
jae 0x556042
jmp 0x5560a6
mov dword [esp], 0x7bc5f0
call fcn.0064cde7
cmp dword [0x7bc5f0], 0xffffffff
jne 0x555fdc
mov dword [esp], 0
mov ecx, 0x7bc3f0
call fcn.00553df0
sub esp, 4
mov dword [esp], 0x7bc5f0
call fcn.0064ce5d
jmp 0x555fdc
Function at 0x556100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [esp + 0x78], eax
test ecx, ecx
je 0x5561f1
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x60], xmm0
mov word [esp + 0x50], 0x701
mov dword [esp + 0x54], ecx
cmp byte [eax + 0xb], 0
jns 0x55614f
mov eax, dword [eax]
mov ebx, dword [ebp + 8]
mov dword [esp + 0x60], eax
xor eax, eax
dec eax
lea ecx, [esp + 0x48]
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [esp], ecx
call fcn.005f3000
mov eax, dword [0x7bc5f0]
mov ecx, dword [0x7ae174]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x55626d
mov dword [esp], 0x746a04
call fcn.005f3c30
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
xor ebx, ebx
mov dword [esp + 0x40], ebx
mov dword [esp], edi
lea edi, [esp + 0x50]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
pxor xmm0, xmm0
movdqu xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x73eac0]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], 0x4d
mov ecx, esi
call fcn.0057a240
sub esp, 0x44
cmp byte [edi], 0
jne 0x556255
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.0064d372
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + ebx*8 + 0x60]
test esi, esi
je 0x556261
lea ecx, [esi + 0x5c]
call fcn.005d62e0
lea ecx, [esi + 0x28]
call fcn.005d1080
mov ecx, esi
call fcn.005d6460
mov dword [esp], esi
call fcn.0064cd6e
jmp 0x556261
mov esi, dword [esp + ebx*8 + 0x60]
test esi, esi
je 0x556261
mov eax, dword [esi]
mov edi, dword [eax]
mov ecx, edi
call dword [section..00cfg]
mov dword [esp], 1
mov ecx, esi
call edi
sub esp, 4
mov al, byte [esp + ebx + 0x51]
jmp 0x55625d
mov al, byte [esp + ebx + 0x51]
cmp al, 8
je 0x55622d
cmp al, 9
je 0x556204
inc ebx
movzx eax, byte [esp + 0x50]
cmp ebx, eax
jae 0x5561f1
jmp 0x556255
mov dword [esp], 0x7bc5f0
call fcn.0064cde7
cmp dword [0x7bc5f0], 0xffffffff
jne 0x55618b
mov dword [esp], 0
mov ecx, 0x7bc3f0
call fcn.00553df0
sub esp, 4
mov dword [esp], 0x7bc5f0
call fcn.0064ce5d
jmp 0x55618b
Function at 0x5599e0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0xc]
movzx ebx, byte [ecx + 0xb]
test bl, bl
jns 0x5599fc
mov ebx, dword [ecx + 4]
mov ecx, dword [ecx]
mov eax, ebx
mov dword [ebp - 0x18], ecx
mov edx, ebx
cmp ebx, 4
jb 0x559a35
mov edx, ebx
mov ecx, dword [ebp - 0x18]
mov eax, ebx
imul esi, dword [ecx], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, esi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x559a0f
cmp edx, 1
je 0x559a58
cmp edx, 3
je 0x559a46
cmp edx, 2
jne 0x559a63
jmp 0x559a4f
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x14]
mov esi, dword [ecx + 4]
xor ecx, ecx
test esi, esi
je 0x559ba6
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov edx, esi
shr edx, 1
and edx, 0x55555555
mov eax, esi
sub eax, edx
mov edx, 0x33333333
mov ecx, esi
mov esi, eax
and esi, edx
shr eax, 2
and eax, edx
add eax, esi
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x30], eax
cmp eax, 1
ja 0x559acc
lea edx, [ecx - 1]
and edx, edi
jmp 0x559ad8
mov edx, edi
cmp edi, ecx
jb 0x559ad8
mov eax, edi
xor edx, edx
div ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x559ba4
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], ecx
mov esi, dword [eax]
test esi, esi
mov ecx, 0
je 0x559ba6
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 4]
cmp eax, edi
jne 0x559b43
movzx eax, byte [esi + 0x13]
mov ecx, eax
test al, al
jns 0x559b18
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
jne 0x559b60
lea ecx, [esi + 8]
mov edx, dword [ecx]
test al, al
cmovs ecx, edx
jns 0x559b68
test ebx, ebx
je 0x559bb5
push ebx
push dword [ebp - 0x18]
push ecx
call fcn.0064f16d
add esp, 0xc
test eax, eax
jne 0x559b60
jmp 0x559bb5
cmp dword [ebp - 0x30], 1
ja 0x559b4e
and eax, dword [ebp - 0x2c]
jmp 0x559b5b
mov ecx, dword [ebp - 0x1c]
cmp eax, ecx
jb 0x559b5b
xor edx, edx
div ecx
mov eax, edx
cmp eax, dword [ebp - 0x14]
jne 0x559ba4
mov esi, dword [esi]
test esi, esi
jne 0x559b04
jmp 0x559ba4
test eax, eax
je 0x559bb5
mov ecx, dword [ebp - 0x18]
cmp byte [ecx], dl
jne 0x559b60
dec eax
xor ecx, ecx
mov dword [ebp - 0x28], edi
cmp eax, ecx
je 0x559bb5
mov dword [ebp - 0x20], ecx
mov dl, byte [esi + ecx + 9]
mov byte [ebp - 0xd], dl
lea edx, [ecx + 1]
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 0x18]
mov cl, byte [ebp - 0xd]
mov edi, dword [ebp - 0x20]
cmp cl, byte [edx + edi + 1]
mov ecx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
je 0x559b76
jmp 0x559b60
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, esi
jmp 0x559ba6
Function at 0x565bd0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.005ffa00
Function at 0x56e520
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx + 0xb]
test cl, cl
jns 0x56e53c
mov ecx, dword [edx + 4]
mov edx, dword [edx]
mov ebx, ecx
mov dword [ebp - 0x14], edx
mov esi, ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 4
jb 0x56e579
mov ebx, dword [ebp - 0x1c]
mov esi, ebx
mov edx, dword [ebp - 0x14]
imul eax, dword [edx], 0x5bd1e995
mov edi, eax
shr edi, 0x18
xor edi, eax
imul edi, edi, 0x5bd1e995
imul ebx, ebx, 0x5bd1e995
xor ebx, edi
add edx, 4
add esi, 0xfffffffc
cmp esi, 3
ja 0x56e553
mov eax, dword [ebp + 8]
cmp esi, 1
je 0x56e59f
cmp esi, 3
je 0x56e58d
cmp esi, 2
jne 0x56e5aa
jmp 0x56e596
movzx esi, byte [edx + 2]
shl esi, 0x10
xor ebx, esi
movzx esi, byte [edx + 1]
shl esi, 8
xor ebx, esi
movzx edx, byte [edx]
xor edx, ebx
imul ebx, edx, 0x5bd1e995
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 4]
xor esi, esi
test ecx, ecx
je 0x56e679
mov edx, ebx
shr edx, 0xd
xor edx, ebx
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov edx, ecx
shr edx, 1
and edx, 0x55555555
mov eax, ecx
sub eax, edx
mov edx, 0x33333333
mov esi, eax
and esi, edx
shr eax, 2
and eax, edx
add eax, esi
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x30], eax
cmp eax, 1
ja 0x56e6dd
lea edx, [ecx - 1]
and edx, edi
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x56e6d6
mov dword [ebp - 0x18], edx
mov esi, dword [eax]
test esi, esi
je 0x56e6d6
lea eax, [ecx - 1]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [esi + 4]
cmp eax, edi
jne 0x56e6be
movzx eax, byte [esi + 0x13]
mov ecx, eax
test al, al
jns 0x56e64d
mov ecx, dword [esi + 0xc]
cmp ecx, dword [ebp - 0x1c]
jne 0x56e6cc
lea ecx, [esi + 8]
mov edx, dword [ecx]
test al, al
cmovs ecx, edx
jns 0x56e685
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x56e676
push eax
push dword [ebp - 0x14]
push ecx
call fcn.0064f16d
add esp, 0xc
test eax, eax
jne 0x56e6cc
mov eax, dword [ebp + 8]
mov dword [eax], esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 8
test eax, eax
je 0x56e676
mov ecx, dword [ebp - 0x14]
cmp byte [ecx], dl
jne 0x56e6cc
dec eax
xor ecx, ecx
cmp eax, ecx
je 0x56e676
mov dword [ebp - 0x20], ecx
mov cl, byte [esi + ecx + 9]
mov byte [ebp - 0xd], cl
mov ecx, dword [ebp - 0x20]
lea edx, [ecx + 1]
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x14]
mov cl, byte [ebp - 0xd]
mov ebx, dword [ebp - 0x20]
cmp cl, byte [edx + ebx + 1]
mov ecx, dword [ebp - 0x28]
je 0x56e693
jmp 0x56e6cc
cmp dword [ebp - 0x30], 1
ja 0x56e6f2
and eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x18]
jne 0x56e6d6
mov esi, dword [esi]
test esi, esi
jne 0x56e639
mov eax, dword [ebp + 8]
xor esi, esi
jmp 0x56e679
mov edx, edi
cmp edi, ecx
jb 0x56e613
mov eax, edi
xor edx, edx
div ecx
jmp 0x56e613
cmp eax, dword [ebp - 0x24]
jb 0x56e6c7
xor edx, edx
div dword [ebp - 0x24]
mov eax, edx
jmp 0x56e6c7
Function at 0x576730
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x576809
cmp dword [esi], 0
jne 0x576809
cmp dword [esi + 0xc], 0
jne 0x576809
xor eax, eax
cmp dword [esi + 4], 0
jne 0x576809
mov ebx, dword [edi]
cmp eax, ebx
je 0x576793
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x5767d9
lea eax, [ebx + 1]
cmp eax, 2
jb 0x576789
mov dword [esi], ebx
call fcn.005e42e0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp dword [esi + 4], ebx
je 0x5767c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jae 0x5767f0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x5767bc
mov dword [esi + 4], ebx
call fcn.005e42e0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.005e42e0
push dword [esi]
call fcn.005f2830
add esp, 4
mov dword [esi], 0
jmp 0x57677a
call fcn.005e42e0
push dword [esi + 4]
call fcn.005f2830
add esp, 4
mov dword [esi + 4], 0
jmp 0x5767ac
mov ecx, esi
call fcn.006d04e0
mov eax, dword [esi]
jmp 0x576764
Function at 0x577a40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp + 0x10]
mov edx, dword [0x7aa024]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], 0
test cl, cl
jne 0x577af4
lea ecx, [ebp - 0x14]
push ecx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x577b4a
mov esi, dword [ebp - 0x14]
xor ebx, ebx
test esi, esi
je 0x577aa2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x577af0
call fcn.005e42e0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, esi
mov esi, dword [ebp + 8]
mov byte [esi], 1
mov dword [esi + 4], 0
cmp ebx, 0xffffffff
je 0x577abd
test ebx, ebx
je 0x577adc
call fcn.005e42e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebx + 1]
cmp eax, 2
jb 0x577ad5
mov dword [esi + 4], ebx
call fcn.005e42e0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x577a99
lea esi, [ebp - 0x14]
push esi
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x577b4a
mov eax, dword [ebp - 0x14]
lea edi, [ebp - 0x18]
mov dword [edi], 0
mov ecx, edi
push eax
call fcn.005dbf50
push esi
push 1
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x577b52
mov eax, dword [ebp - 0x18]
inc eax
cmp eax, 2
jb 0x577a7e
call fcn.005e42e0
push dword [ebp - 0x18]
call fcn.005f2830
add esp, 4
jmp 0x577a7e
mov esi, dword [ebp + 8]
mov byte [esi], 0
jmp 0x577adc
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov eax, dword [ebp - 0x18]
inc eax
cmp eax, 2
jb 0x577b71
call fcn.005e42e0
push dword [ebp - 0x18]
call fcn.005f2830
add esp, 4
mov esi, dword [ebp + 8]
jmp 0x577adc
Function at 0x582820
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x7aa024]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 3
je 0x582850
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x14]
mov dword [eax], 0x582950
push 0
push eax
push 0x5827b0
push 0x7be39c
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x58294b
cmp dword [0x7be3a0], 0
jne 0x58283c
push dword [0x7be3a4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x58283c
mov esi, eax
mov eax, 0x7be3a8
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov edi, dword [0x7be3ac]
mov ebx, dword [0x7be3b0]
mov eax, dword [0x7be3b4]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x7be3b8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x7be3bc]
mov dword [ebp - 0x24], eax
mov eax, 0x7be3a8
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x5828e4
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ecx, edi
call dword [section..00cfg]
push dword [ebp - 0x18]
call edi
add esp, 4
test ebx, ebx
je 0x5828f9
mov edi, dword [esi + 4]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x58290f
mov edi, dword [esi + 8]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
mov ecx, dword [ebp - 0x20]
test ecx, ecx
mov ebx, dword [ebp - 0x24]
je 0x582928
mov edi, dword [esi + 0xc]
call dword [section..00cfg]
push edi
call ecx
add esp, 4
test ebx, ebx
je 0x58293d
mov edi, dword [esi + 0x10]
mov ecx, ebx
call dword [section..00cfg]
push edi
call ebx
add esp, 4
push esi
call fcn.00618240
add esp, 4
jmp 0x58283c
call fcn.006626d0
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x7be3a4], eax
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov dword [0x7be3a0], ecx
pop ebp
ret
Function at 0x582970
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [eax], 0x582950
push 0
push eax
push 0x5827b0
push 0x7be39c
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x582a43
mov esi, dword [ebp + 0xc]
cmp dword [0x7be3a0], 0
jne 0x582a51
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [0x7be3a4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x582a06
push 0x14
call fcn.00618210
add esp, 4
test eax, eax
je 0x582a51
mov edi, eax
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
push eax
push dword [0x7be3a4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x582a48
mov ebx, dword [ebp + 8]
mov esi, 0x7be3a8
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x7be3ac], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.006626d0
push edi
call fcn.00618240
add esp, 4
mov ecx, dword [ebp + 0x10]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
xor esi, esi
jmp 0x582a2f
Function at 0x583d80
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x24], edx
mov eax, dword [0x7aa024]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea esi, [ebp - 0x18]
mov dword [esi], eax
mov dword [esi + 4], eax
push 6
push esi
push ecx
call fcn.006188f0
add esp, 0xc
mov dword [ebp - 0x20], 0
test eax, eax
je 0x583e05
push esi
call fcn.005f77c0
add esp, 4
movzx ebx, byte [0x79b7b9]
cmp eax, ebx
jne 0x583e1a
mov edi, eax
push esi
call fcn.006188b0
add esp, 4
mov dword [ebp - 0x1c], 0x79b7ac
test bl, bl
je 0x583df5
push edi
push 0x79b7b0
push eax
call fcn.0064f16d
add esp, 0xc
test eax, eax
jne 0x583e1a
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0064d372
mov eax, dword [ebp - 0x20]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
call fcn.005f77c0
add esp, 4
movzx ebx, byte [0x79b841]
cmp eax, ebx
jne 0x583e57
mov edi, eax
push esi
call fcn.006188b0
add esp, 4
mov dword [ebp - 0x1c], 0x79b834
test bl, bl
je 0x583df5
push edi
push 0x79b838
push eax
call fcn.0064f16d
add esp, 0xc
test eax, eax
je 0x583df5
push esi
call fcn.005f77c0
add esp, 4
movzx ebx, byte [0x79b8c9]
cmp eax, ebx
jne 0x583e9c
mov edi, eax
push esi
call fcn.006188b0
add esp, 4
mov dword [ebp - 0x1c], 0x79b8bc
test bl, bl
je 0x583df5
push edi
push 0x79b8c0
push eax
call fcn.0064f16d
add esp, 0xc
test eax, eax
je 0x583df5
push esi
call fcn.005f77c0
add esp, 4
movzx ebx, byte [0x79b951]
cmp eax, ebx
jne 0x583ee1
mov edi, eax
push esi
call fcn.006188b0
add esp, 4
mov dword [ebp - 0x1c], 0x79b944
test bl, bl
je 0x583df5
push edi
push 0x79b948
push eax
call fcn.0064f16d
add esp, 0xc
test eax, eax
je 0x583df5
push esi
call fcn.005f77c0
add esp, 4
movzx ebx, byte [0x79b9dd]
cmp eax, ebx
jne 0x583e05
mov edi, eax
push esi
call fcn.006188b0
add esp, 4
mov dword [ebp - 0x1c], 0x79b9d0
test bl, bl
je 0x583df5
push edi
push 0x79b9d4
push eax
call fcn.0064f16d
add esp, 0xc
test eax, eax
je 0x583df5
jmp 0x583e05