joyce8/EMBER2024-capa huggingface dataset:
Function at 0x652b80
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x770000
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x1c], edi
mov ecx, dword [edi + 0x5e4]
call fcn.0060ba90
lea eax, [esp + 0xc]
mov ecx, edi
push eax
call fcn.0064cd10
push dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], 0
call fcn.00667f90
cmp byte [esp + 0x34], 0
movzx eax, word [eax + 0xe]
mov dword [esp + 0x20], eax
je 0x652beb
inc eax
mov dword [esp + 0x20], eax
mov ecx, edi
call fcn.0064eb10
push 0x3d
call fcn.006f888a
mov esi, eax
add esp, 4
lea eax, [esi + 0x1f]
cmp esi, 0x79a66f
ja 0x652c34
cmp eax, 0x79a650
jb 0x652c34
mov edi, 0x79a650
mov ecx, esi
sub edi, esi
mov edx, 0x20
mov edi, edi
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
xor al, 0x65
mov byte [ecx - 1], al
dec edx
jne 0x652c20
mov edi, dword [esp + 0x1c]
jmp 0x652c5f
mov eax, 0x79a650
movdqu xmm0, xmmword [eax]
mov eax, 0x79a660
pxor xmm0, xmmword [str.eeeeeeeeeeeeeeee]
movdqu xmmword [esi], xmm0
movdqu xmm0, xmmword [eax]
pxor xmm0, xmmword [str.eeeeeeeeeeeeeeee]
movdqu xmmword [esi + 0x10], xmm0
mov ecx, dword [edi + 0x5e4]
push esi
call fcn.0060bf50
push 0x3d
push 0
push esi
call fcn.006f87a0
push esi
call fcn.006f8852
movzx eax, word [edi + 0x5d4]
add esp, 0x10
mov ecx, dword [edi + 0x5e4]
push eax
call fcn.0060bfa0
lea eax, [esp + 0x14]
mov ecx, edi
push eax
call fcn.0064c6b0
push dword [esp + 0x20]
mov ecx, dword [edi + 0x5e4]
mov byte [esp + 0x30], 1
call fcn.0060c150
push dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
call fcn.00667f90
push dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov esi, eax
call fcn.00667f90
movzx ecx, word [esi + 8]
push ecx
mov ecx, dword [edi + 0x5e4]
push dword [eax + 4]
call fcn.0060c0d0
mov ecx, dword [edi + 0x5e4]
call fcn.0060b6b0
mov ecx, edi
mov esi, eax
call fcn.00675510
movdqu xmm0, xmmword [esi]
movdqu xmmword [eax], xmm0
movdqu xmm0, xmmword [esi + 0x10]
movdqu xmmword [eax + 0x10], xmm0
mov ecx, dword [edi + 0x5e4]
call fcn.0070ffc0
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 0
call fcn.0070ffc0
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0070ffc0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 4
Function at 0x6534a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7700f0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x40], eax
push esi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x5c]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00612320
add esp, 8
mov dword [esp + 0x54], 0
call fcn.006098d0
push eax
lea ecx, [esp + 0x14]
call fcn.00503e70
lea eax, [esp + 0x2c]
mov byte [esp + 0x54], 1
push eax
lea ecx, [esp + 0x14]
call fcn.00504050
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esi + 0x14]
call fcn.006543e0
push dword [esp + 0xc]
lea eax, [esp + 0xc]
push dword [esp + 0xc]
lea ecx, [esi + 0x14]
push eax
call fcn.00448e40
lea ecx, [esp + 0x10]
mov byte [esp + 0x54], 0
call fcn.0061b700
lea ecx, [esp + 0x2c]
mov dword [esp + 0x54], 0xffffffff
call fcn.0061b700
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x50
ret 4

Function at 0x65a170
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x770c48
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, ecx
lea esi, [ebp + 4]
mov dword [esi], 0
mov dword [esp + 0x14], esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor bh, bh
mov dword [esi], 0
cmp dword [ebp], 0xffffffff
mov dword [esp + 0x20], 0
setne bl
call edi
mov dword [esi], eax
test bl, bl
je 0x65a1e3
push 0xc1e
call fcn.00606650
mov ecx, eax
call fcn.00606640
mov ecx, eax
call fcn.005fca70
jmp 0x65a254
cmp byte [esp + 0x2c], 0
mov eax, reloc.WS2_32.dll_getsockopt
push 0x80
push dword [esp + 0x2c]
mov edi, bind
cmovne edi, eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.00665db0
push 0
push edi
mov edi, dword [esp + 0x30]
mov eax, dword [eax + 0x44]
push 2
push 0
push 0
push 0xc0000000
push edi
call eax
mov dword [ebp], eax
cmp eax, 0xffffffff
jne 0x65a24c
push 0xc1f
call fcn.00606650
mov ecx, eax
call fcn.00606640
mov ecx, eax
call fcn.005fca70
push edi
call fcn.00607da0
add esp, 4
jmp 0x65a24e
mov bh, 1
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi], 0
mov dword [esp + 0x20], 0xffffffff
jne 0x65a265
call edi
mov dword [esi], eax
mov al, bh
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x65a5b0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x770cb8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, ecx
lea esi, [ebp + 4]
mov dword [esi], 0
mov dword [esp + 0x18], esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor bh, bh
mov dword [esi], 0
cmp dword [ebp], 0xffffffff
mov dword [esp + 0x24], 0
setne bl
call edi
mov dword [esi], eax
test bl, bl
jne 0x65a625
push 0xc20
call fcn.00606650
mov ecx, eax
call fcn.00606640
mov ecx, eax
call fcn.005fca70
jmp 0x65a679
mov edi, dword [esp + 0x30]
lea eax, [esp + 0x14]
push 0
push eax
push edi
push dword [esp + 0x38]
mov dword [esp + 0x24], 0
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x65a664
push 0xc21
call fcn.00606650
mov ecx, eax
call fcn.00606640
mov ecx, eax
call fcn.005fca70
jmp 0x65a673
cmp edi, dword [esp + 0x14]
je 0x65a671
push 0xc22
jmp 0x65a64f
mov bh, 1
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi], 0
mov dword [esp + 0x24], 0xffffffff
jne 0x65a68a
call edi
mov dword [esi], eax
mov al, bh
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x665b80
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x665b91
call fcn.00665cf0
mov ebx, dword [esi]
test ebx, ebx
jne 0x665bb9
push 0x11bc
call fcn.00606650
mov ecx, eax
call fcn.00606640
mov ecx, eax
call fcn.005fca70
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret 8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 0x40
push ebx
call edi
test eax, eax
je 0x665bd0
push 0x11bd
jmp 0x665c06
mov eax, 0x5a4d
cmp ax, word [ebx]
je 0x665be1
push 0x11be
jmp 0x665c06
mov esi, dword [ebx + 0x3c]
push 0xf8
add esi, ebx
push esi
call edi
test eax, eax
je 0x665bf9
push 0x11bf
jmp 0x665c06
cmp dword [esi], 0x4550
je 0x665c24
push 0x11c0
call fcn.00606650
mov ecx, eax
call fcn.00606640
mov ecx, eax
call fcn.005fca70
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret 8
mov ecx, dword [esi + 0x78]
mov edi, 0xffff
add ecx, ebx
push ebp
mov dword [esp + 0x10], ecx
mov edx, dword [ecx + 0x1c]
mov eax, dword [ecx + 0x20]
add edx, ebx
mov ebp, dword [ecx + 0x24]
add eax, ebx
add ebp, ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
xor esi, esi
mov edx, edi
mov edi, edi
cmp esi, dword [ecx + 0x18]
jae 0x665ccd
mov eax, dword [eax + esi*4]
mov ecx, dword [esp + 0x20]
add eax, ebx
mov edi, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x665c80
test dl, dl
je 0x665c7c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x665c80
add ecx, 2
add eax, 2
test dl, dl
jne 0x665c60
xor eax, eax
jmp 0x665c85
sbb eax, eax
or eax, 1
test eax, eax
jne 0x665c8e
movzx edi, word [ebp + esi*2]
mov eax, dword [esp + 0x14]
mov edx, 0xffff
mov ecx, dword [esp + 0x10]
inc esi
cmp dx, di
je 0x665c50
movzx eax, di
cmp eax, dword [ecx + 0x14]
jb 0x665cd9
push 0x11c2
call fcn.00606650
mov ecx, eax
call fcn.00606640
mov ecx, eax
call fcn.005fca70
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret 8
cmp dx, di
jne 0x665ca1
push 0x11c1
jmp 0x665cae
mov ecx, dword [esp + 0x18]
pop ebp
pop edi
pop esi
mov eax, dword [ecx + eax*4]
add eax, ebx
pop ebx
add esp, 0xc
ret 8
Function at 0x667700
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x772248
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x30]
lea ecx, [esi + 2]
call fcn.00736fb0
movzx ebp, ax
mov ecx, esi
lea eax, [esp + 0x16]
push eax
call fcn.006752d0
mov ecx, eax
mov dword [esp + 0x28], 0
call fcn.00736fb0
movzx eax, ax
lea ecx, [esp + 0x16]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 0xffffffff
call fcn.0070ffc0
mov ax, word [esi]
mov word [esp + 0x30], ax
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 1
push eax
lea ecx, [esp + 0x34]
call fcn.006752d0
push dword [esp + 0x18]
mov ecx, edi
mov byte [esp + 0x2c], 2
call fcn.00669030
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 1
mov bl, al
call fcn.0070ffc0
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.0070ffc0
movzx ecx, bl
mov al, 1
and ecx, 7
add ecx, 2
shl al, cl
movzx eax, al
test bl, 0x20
je 0x6677d2
sub eax, 2
sub eax, ebp
add eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4

Function at 0x667da0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x772551
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0
push eax
call fcn.006680d0
movzx ecx, word [eax + 4]
push ecx
mov ecx, dword [eax]
mov dword [esp + 0x2c], 1
call fcn.00667f90
lea ecx, [esp + 0x10]
movzx eax, word [eax + 0x10]
push eax
call fcn.00670930
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 3
call fcn.0070ffc0
mov ax, word [esp + 0x10]
mov word [esp + 0xc], ax
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 4
lea eax, [esi + 4]
mov dword [esi], edi
push eax
call fcn.006752d0
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.0070ffc0
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 1
mov byte [esp + 0x28], 0
call fcn.0070ffc0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4
Function at 0x668240
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x772551
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0
push eax
call fcn.006680d0
movzx ecx, word [eax + 4]
push ecx
mov ecx, dword [eax]
mov dword [esp + 0x2c], 1
call fcn.00667f90
movzx eax, word [eax + 2]
mov word [esp + 0x10], ax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 3
call fcn.0070ffc0
movzx eax, word [esp + 0x10]
mov word [esp + 0xc], ax
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 4
lea eax, [esi + 4]
mov dword [esi], edi
push eax
call fcn.006752d0
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 3
call fcn.0070ffc0
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 1
mov byte [esp + 0x28], 0
call fcn.0070ffc0
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 4

Function at 0x66ac10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x772c26
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x79b114
mov dword [esp + 0x14], 1
call fcn.0066ae90
lea ecx, [esi + 0x38]
mov byte [esp + 0x14], 0
mov dword [ecx], vtable.YS0073::YS0081_unsigned_char_.0
call fcn.0040bf60
lea ecx, [esi + 0x30]
call fcn.0066ba00
push dword [esi + 0x30]
call fcn.006f75a9
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x66add0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x772cc8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x2c]
movzx esi, ax
add esi, 7
and esi, 0xfffffffc
push esi
call fcn.006f888a
push esi
mov ebx, eax
push 0
push ebx
call fcn.006f87a0
mov cx, word [esp + 0x38]
add esp, 0x10
mov word [ebx], cx
mov word [ebx + 2], si
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 0
mov esi, dword [edi + 0x30]
lea eax, [esp + 0x10]
push eax
lea ecx, [edi + 0x30]
mov dword [esp + 0x24], 0
push dword [esi + 4]
push esi
call fcn.0066ab20
mov edx, eax
mov ecx, 0xffffffe
mov eax, dword [edi + 0x34]
sub ecx, eax
cmp ecx, 1
jae 0x66ae68
push str.list_T__too_long
call fcn.006f2a33
inc eax
mov dword [edi + 0x34], eax
mov dword [esi + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x66afa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x772d03
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x40]
call fcn.0066ae90
push 0x24
call fcn.006f7558
add esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 0x38], 0
test eax, eax
je 0x66affe
mov ecx, eax
call fcn.00509f90
jmp 0x66b000
xor eax, eax
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], 0xffffffff
mov dword [edi + 0x24], eax
call fcn.00503eb0
mov esi, dword [esp + 0x44]
mov edi, dword [edi + 0x24]
or esi, 0x8000
cmp dword [esp + 0x24], 0
mov dword [esp + 0x38], 1
je 0x66b03e
lea eax, [esp + 0x10]
push eax
lea ecx, [edi + 4]
call fcn.00503f80
push 0
push esi
mov ecx, edi
call fcn.0050a120
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.0061b700
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x30
ret 8

Function at 0x66c250
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x772ea8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0066bba0
mov eax, dword [esp + 0x1c]
push 0x10
push esi
mov dword [esp + 0x1c], 0
movdqu xmm0, xmmword [eax]
movdqu xmmword [esi + 0x10], xmm0
movdqu xmm0, xmmword [eax + 0x10]
movdqu xmmword [esi + 0x20], xmm0
movdqu xmm0, xmmword [eax + 0x20]
movdqu xmmword [esi + 0x30], xmm0
movdqu xmm0, xmmword [eax + 0x30]
movdqu xmmword [esi + 0x40], xmm0
call fcn.00633780
mov ecx, eax
call fcn.00633610
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x670040
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push dword [esp + 0x20]
mov ebp, ecx
xor bl, bl
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x670089
push 0x10ea
call fcn.00606650
mov ecx, eax
call fcn.00606640
mov ecx, eax
call fcn.005fca70
pop edi
pop ebp
mov al, bl
pop ebx
add esp, 0xc
ret 4
push esi
push edi
call fcn.006f888a
add esp, 4
mov esi, eax
push esi
push edi
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x6700c2
push 0x10eb
call fcn.00606650
mov ecx, eax
call fcn.00606640
mov ecx, eax
call fcn.005fca70
jmp 0x670104
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], 0
push eax
push 0x77e884
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x6700f2
push 0x10ec
jmp 0x6700ad
mov ecx, dword [esp + 0x14]
mov bl, 1
mov eax, dword [ecx + 8]
mov dword [ebp], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp + 4], eax
test esi, esi
je 0x670111
push esi
call fcn.006f8852
add esp, 4
pop esi
pop edi
pop ebp
mov al, bl
pop ebx
add esp, 0xc
ret 4

Function at 0x670120
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x7734f3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x10], ebx
mov dword [ebx + 0x18], 0xf
mov dword [ebx + 0x14], 0
mov byte [ebx + 4], 0
mov dword [ebx], vtable.wbs::StringBase_char_.0
mov dword [ebx + 0x34], 0xf
mov dword [ebx + 0x30], 0
mov byte [ebx + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [ebx + 0x1c], vtable.wbs::StringBase_char_.0
mov esi, dword [esp + 0x24]
push 2
push esi
mov byte [esp + 0x24], 1
call fcn.004f5e20
lea eax, [esi + 2]
push eax
lea ecx, [ebx + 0x1c]
call fcn.004f5a60
mov eax, ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x679e80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x774748
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov eax, dword [esp + 0x80]
mov esi, dword [esp + 0x78]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x1c], esi
cmp esi, eax
je 0x67a052
lea ebx, [esi + 0x44]
mov dword [esp + 0x18], ebx
cmp ebx, eax
je 0x67a052
lea ebp, [ebx - 0x44]
push ebx
lea ecx, [esp + 0x24]
mov edi, ebx
call fcn.0067b1a0
lea eax, [esp + 0x20]
mov dword [esp + 0x70], 0
push esi
push eax
call dword [esp + 0x1c]
add esp, 8
test al, al
je 0x679f48
push dword [esp + 0x1c]
lea eax, [ebp + 0x88]
push eax
push ebx
push esi
call fcn.0067a3c0
add esp, 0x10
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.004f59b0
lea eax, [esp + 0x3c]
push eax
lea ecx, [esi + 0x1c]
call fcn.004f59b0
lea eax, [esp + 0x58]
push eax
lea ecx, [esi + 0x38]
call fcn.0042f5c0
jmp 0x679fc2
lea eax, [esp + 0x20]
mov esi, ebp
push ebp
push eax
call dword [esp + 0x1c]
add esp, 8
test al, al
je 0x679f98
mov ebx, dword [esp + 0x14]
nop
push esi
mov ecx, edi
call fcn.004f59b0
lea eax, [esi + 0x1c]
push eax
lea ecx, [edi + 0x1c]
call fcn.004f59b0
lea eax, [esi + 0x38]
push eax
lea ecx, [edi + 0x38]
call fcn.0042f5c0
mov edi, esi
lea eax, [esp + 0x20]
sub esi, 0x44
push esi
push eax
call ebx
add esp, 8
test al, al
jne 0x679f60
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x20]
mov ecx, edi
push eax
call fcn.004f59b0
lea eax, [esp + 0x3c]
push eax
lea ecx, [edi + 0x1c]
call fcn.004f59b0
lea eax, [esp + 0x58]
push eax
lea ecx, [edi + 0x38]
call fcn.0042f5c0
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x58]
mov dword [esp + 0x70], 0xffffffff
test eax, eax
je 0x679ff3
push eax
call fcn.006f75a9
add esp, 4
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
cmp dword [esp + 0x54], 0x10
mov dword [esp + 0x3c], vtable.wbs::StringBase_char_.0
jb 0x67a00e
push dword [esp + 0x40]
call fcn.006f75a9
add esp, 4
cmp dword [esp + 0x38], 0x10
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
mov dword [esp + 0x20], vtable.wbs::StringBase_char_.0
jb 0x67a03e
push dword [esp + 0x24]
call fcn.006f75a9
add esp, 4
add ebx, 0x44
add ebp, 0x44
mov dword [esp + 0x18], ebx
cmp ebx, dword [esp + 0x7c]
jne 0x679ee3
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x60
ret
Function at 0x67bde0
Capabilities:
Query service status

Disassembly:
sub esp, 0x2c
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push ebx
push esi
push bind
push eax
push dword [ecx]
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x67be37
push 0x11d1
call fcn.00606650
mov ecx, eax
call fcn.00606640
mov ecx, eax
call fcn.005fca70
pop esi
mov al, bl
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x2c
ret 4
lea eax, [esp + 8]
mov dword [esp + 0xc], 0
push eax
push 0x24
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0
push eax
xorps xmm0, xmm0
push 0
push esi
movdqu xmmword [esp + 0x24], xmm0
movdqu xmmword [esp + 0x34], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x67be89
push 0x11d2
call fcn.00606650
mov ecx, eax
call fcn.00606640
mov ecx, eax
call fcn.005fca70
jmp 0x67be9f
cmp dword [esp + 8], 0x24
je 0x67be97
push 0x11d3
jmp 0x67be74
cmp dword [esp + 0x10], 4
sete bl
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [esp + 0x30]
mov al, bl
pop esi
pop ebx
xor ecx, esp
call fcn.006f7ca4
add esp, 0x2c
ret 4
Function at 0x67de10
Capabilities:
Get hostname
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x774ed9
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], ebx
mov dword [ebx + 0x18], 0xf
mov dword [ebx + 0x14], 0
mov byte [ebx + 4], 0
mov dword [ebx], vtable.wbs::StringBase_char_.0
lea eax, [esp + 0x18]
mov dword [esp + 0x5c], 0
push 0x40
mov dword [esp + 0x30], 1
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x20], 0x40
call fcn.006f2a95
push dword [esp + 0x1c]
mov esi, eax
call fcn.006f8afe
mov ecx, dword [esp + 0x24]
add esp, 8
mov eax, ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x5c], 1
jmp 0x67dee0
mov edi, ecx
cmp ecx, eax
jbe 0x67df06
push ecx
call fcn.006f2a95
push dword [esp + 0x1c]
mov esi, eax
call fcn.006f8afe
mov eax, dword [esp + 0x24]
add esp, 8
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push eax
push esi
push dword [esp + 0x70]
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
test eax, eax
je 0x67df4e
xor edx, edx
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
inc eax
mov dword [esp + 0x28], eax
cmp eax, 0x64
ja 0x67df73
cmp edx, 0xea
je 0x67df44
cmp edx, 0x7a
je 0x67df44
cmp edx, 0x6f
jne 0x67df73
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
jmp 0x67dee0
call ebp
mov edx, eax
mov dword [esp + 0x14], edx
cmp edx, 0xea
jne 0x67df20
mov ecx, dword [esp + 0x1c]
cmp edi, ecx
jb 0x67df24
lea ecx, [ecx*2 + 1]
mov dword [esp + 0x1c], ecx
jmp 0x67df24
test edx, edx
jne 0x67df88
push dword [esp + 0x18]
mov ecx, ebx
mov dword [esp + 0x2c], edx
call fcn.004f5a60
jmp 0x67dff1
push 6
push 0x79b560
lea ecx, [esp + 0x40]
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
call fcn.00409620
mov dword [esp + 0x34], vtable.wbs::StringBase_char_.0
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x40]
mov byte [esp + 0x64], 2
push eax
lea ecx, [ebx + 4]
call fcn.004094b0
push dword [esp + 0x14]
mov ecx, ebx
call fcn.00426780
cmp dword [esp + 0x4c], 0x10
mov dword [esp + 0x34], vtable.wbs::StringBase_char_.0
jb 0x67dff1
push dword [esp + 0x38]
call fcn.006f75a9
add esp, 4
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x67e002
push ecx
call fcn.006f8afe
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x4c
ret