joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b836c08
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x5b89bae4]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [esp + 0x18], eax
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov eax, dword [ebx + 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x1c]
mov dword [esp + 0x1c], ecx
push ecx
mov dword [esp + 0x10], ebx
add dword [eax + 0x40], 1
adc dword [eax + 0x44], 0
mov edi, dword [ebx + 8]
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x5b89d478]
mov ecx, edi
call esi
push 0x2db39507
push 4
mov edi, eax
lea ecx, [esp + 0x18]
pop edx
mov dword [esp + 0x14], edi
call fcn.5b87468e
mov dword [esp + 0x10], eax
test eax, eax
jne 0x5b836c88
mov eax, 0xad9f007
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x14]
xor esi, esi
and dword [esp + 0x28], esi
and dword [esp + 0x2c], esi
mov dword [esp + 0x18], esi
add edi, eax
xor edx, edx
mov eax, edi
mov dword [esp + 0x24], edi
div dword [ebx + 0x30]
mov edi, dword [esp + 0xc]
mov ebx, edx
lea edx, [esp + 0x28]
imul ebx, ecx
add ebx, dword [edi + 0x2c]
mov eax, dword [ebx]
cmp eax, dword [edx]
jne 0x5b836cc5
mov eax, dword [ebx + 4]
cmp eax, dword [edx + 4]
je 0x5b836d25
push ecx
lea eax, [esp + 0x34]
push ebx
push eax
call fcn.5b886ad0
mov eax, dword [esp + 0x3c]
add esp, 0xc
or eax, dword [esp + 0x34]
je 0x5b836d21
mov edi, dword [edi + 8]
mov eax, dword [edi]
mov esi, dword [eax + 0x14]
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x20]
mov ecx, esi
push dword [esp + 0x28]
call dword [0x5b89d478]
mov ecx, edi
call esi
mov ecx, dword [esp + 0xc]
cmp eax, 0x8007000d
jne 0x5b836d17
mov eax, dword [ecx + 0x1c]
add dword [eax + 0x48], 1
adc dword [eax + 0x4c], 0
xor eax, eax
test eax, eax
js 0x5b836d51
je 0x5b836d40
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0xa
jae 0x5b836d56
mov ebx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x24]
jmp 0x5b836c9a
and dword [ebx], 0
and dword [ebx + 4], 0
mov eax, dword [ecx + 0x1c]
dec dword [eax + 0x78]
xor eax, eax
jmp 0x5b836d59
lfence
jmp 0x5b836d59
xor eax, eax
inc eax
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.5b884340
mov esp, ebp
pop ebp
ret 8
Function at 0x5b836d70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x5b89bae4]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [esp + 0x10], eax
push esi
xor eax, eax
xor ecx, ecx
push edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
cmp dword [ebx + 0x30], eax
jbe 0x5b836e89
cmp byte [ebp + 0xc], 0
je 0x5b836e95
cmp byte [ebx + 0x3c], 0
jne 0x5b836ed5
test edi, edi
je 0x5b836deb
test al, 0xf
jne 0x5b836deb
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x5b89d478]
mov ecx, edi
call esi
test al, al
jne 0x5b836ed5
mov eax, dword [esp + 0x10]
mov ecx, dword [ebx + 0x34]
lea edx, [esp + 0x20]
and dword [esp + 0x20], 0
and dword [esp + 0x24], 0
imul ecx, eax
add ecx, dword [ebx + 0x2c]
mov dword [esp + 0x1c], ecx
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x5b836e14
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
je 0x5b836e73
push dword [ebx + 0x34]
lea eax, [esp + 0x2c]
push ecx
push eax
call fcn.5b886ad0
mov eax, dword [esp + 0x34]
add esp, 0xc
or eax, dword [esp + 0x2c]
je 0x5b836e73
mov edi, dword [ebx + 8]
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x1c]
mov ecx, esi
call dword [0x5b89d478]
mov ecx, edi
call esi
cmp eax, 0x8007000d
jne 0x5b836ec2
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
and dword [eax], 0
and dword [eax + 4], 0
mov eax, dword [ebx + 0x1c]
dec dword [eax + 0x78]
mov eax, dword [ebx + 0x1c]
add dword [eax + 0x68], 1
adc dword [eax + 0x6c], 0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, dword [ebx + 0x30]
jb 0x5b836db2
cmp byte [ebp + 0xc], 0
je 0x5b836e95
mov eax, dword [ebx + 0x1c]
mov dword [eax + 0x78], ecx
call fcn.5b871dd8
mov ecx, dword [ebx + 0x1c]
push edi
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edx
mov ecx, ebx
call fcn.5b8362cf
test eax, eax
js 0x5b836ebd
mov ecx, ebx
lfence
call fcn.5b836ef5
test eax, eax
jns 0x5b836edc
lfence
jmp 0x5b836ede
test eax, eax
js 0x5b836ebd
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x14]
inc ecx
mov dword [esp + 0xc], ecx
jmp 0x5b836e77
mov eax, 0x80004004
jmp 0x5b836ede
xor eax, eax
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.5b884340
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5b83cb4f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
or dword [ecx], 0xffffffff
mov eax, edx
mov edx, dword [ebp + 8]
or dword [ebp - 8], 0xffffffff
push ebx
push esi
push edi
push ecx
push ecx
xor edi, edi
mov dword [ebp - 0x14], ecx
push edi
push 3
push 1
push SysReAllocStringLen
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], eax
mov dword [eax], edi
call fcn.5b871749
mov esi, dword [ebp - 8]
cmp eax, 0x80070002
je 0x5b83cbce
cmp eax, 0x80070003
je 0x5b83cbce
cmp eax, 0x80070020
je 0x5b83cbce
test eax, eax
js 0x5b83cbd0
lea eax, [ebp - 0xc]
mov dword [ebp - 8], edi
push eax
push esi
mov ebx, edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x5b83cbb9
call fcn.5b87185e
jmp 0x5b83cbbe
mov ebx, dword [ebp - 0xc]
mov eax, edi
test eax, eax
js 0x5b83cbd0
mov eax, dword [ebp - 0x10]
mov dword [eax], ebx
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
jmp 0x5b83cbde
mov eax, edi
mov edi, eax
cmp esi, 0xffffffff
je 0x5b83cbde
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x5b844535
Capabilities:
Check os version

Disassembly:
push 0x12c
mov eax, 0x5b88a0e6
call fcn.5b8878e0
mov edi, ecx
mov dword [ebp - 0x130], edi
xor ebx, ebx
mov dword [ebp - 0x138], edi
mov dword [edi + 4], ebx
mov dword [ebp - 4], ebx
mov dword [edi], 0x5b8017e4
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov byte [ebp - 4], 4
mov byte [edi + 0x18], bl
cmp dword [edi + 8], ebx
je 0x5b844580
call fcn.5b841540
mov dword [edi + 8], ebx
call fcn.5b841530
test eax, eax
js 0x5b844592
mov dword [edi + 8], 0x12345678
mov eax, ebx
push eax
call fcn.5b82c619
mov eax, dword [0x5b896030]
or eax, dword [0x5b896034]
jne 0x5b844718
mov dword [ebp - 0x130], ebx
cmp byte [0x5b89c8cd], al
jne 0x5b844689
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x5b844608
cmp dword [ebp - 0x128], 6
setb al
mov byte [0x5b89c8cc], al
ja 0x5b8445fa
jne 0x5b8445f2
cmp dword [ebp - 0x124], 1
ja 0x5b8445fa
mov dword [ebp - 0x130], ebx
jmp 0x5b844604
mov dword [ebp - 0x130], 1
test al, al
jne 0x5b844682
push 0x5b80c470
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x5b844632
cmp dword [ebp - 0x130], eax
je 0x5b84467b
push 0x5b80c490
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x5b84467b
push 0x5b80c4e0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5b89c8c8], eax
test eax, eax
je 0x5b84467b
push 0x5b80c4ec
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [section..data], eax
test eax, eax
je 0x5b844671
push 0x5b80c4fc
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5b89c8c4], eax
test eax, eax
jne 0x5b844682
mov dword [section..data], 0x5b83ab50
mov byte [0x5b89c8cc], 1
mov byte [0x5b89c8cd], 1
cmp byte [0x5b89c8cc], 0
mov ecx, 0x5b896030
push ecx
jne 0x5b8446b5
mov esi, dword [section..data]
push ecx
push 0x5b83aa10
push 0x5b80c5f8
mov ecx, esi
call dword [0x5b89d478]
call esi
jmp 0x5b8446ec
push ebx
mov eax, ecx
mov dword [ebp - 0x130], ebx
cdq
push ebx
mov dword [0x5b896030], eax
lea eax, [ebp - 0x134]
push eax
push 1
mov dword [0x5b896034], edx
mov edx, 0x5b80c5f8
push edx
push ecx
push 0x5b83a8a0
mov dword [ebp - 0x134], edx
call dword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov ebx, eax
test ebx, ebx
je 0x5b84471a
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b844718
test byte [eax + 0x1c], 1
je 0x5b844718
push ebx
push dword [eax + 0x14]
mov edx, 0x5b811928
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.5b81ae33
test ebx, ebx
sete al
push 0x10
mov byte [edi + 0x18], al
call fcn.5b884410
pop ecx
mov dword [ebp - 0x130], eax
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.5b844d28
mov byte [ebp - 4], 4
test eax, eax
je 0x5b844745
lock inc dword [eax + 4]
mov ecx, dword [edi + 0xc]
mov dword [edi + 0xc], eax
test ecx, ecx
je 0x5b844754
call fcn.5b81d5c0
mov ecx, edi
call fcn.5b844828
mov eax, edi
call fcn.5b887860
ret
Function at 0x5b84f919
Capabilities:
Query environment variable

Disassembly:
push 0x18
mov eax, 0x5b88b08d
call fcn.5b8878a0
mov ebx, ecx
and dword [ebp - 0x18], 0
cmp byte [ebx + 0x50], 0
jne 0x5b84fab5
mov eax, dword [ebx + 8]
mov dl, 1
push dword [ebx + 0x28]
mov byte [ebp - 0xd], 0
push 5
mov ecx, dword [eax + 8]
call fcn.5b8767dd
mov esi, eax
test esi, esi
js 0x5b84f989
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
call fcn.5b841ca0
cmp dword [ebp - 0x14], 0
je 0x5b84fab5
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push 2
push eax
push 0x5b8162f8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x5b84fab5
mov byte [ebp - 0xd], 1
lea edi, [ebx + 0xc]
cmp dword [edi + 0x14], 8
jb 0x5b84f994
mov edi, dword [edi]
cmp esi, 0x800703fa
je 0x5b84f9c9
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b84f9c3
test byte [eax + 0x1c], 1
je 0x5b84f9c3
push esi
push edi
push dword [eax + 0x14]
mov edx, 0x5b816358
push dword [eax + 0x10]
push 0x16
pop ecx
call fcn.5b81ae55
push esi
call fcn.5b82c619
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b84f9ef
test byte [eax + 0x1c], 1
je 0x5b84f9ef
push edi
push dword [eax + 0x14]
mov edx, 0x5b816358
push dword [eax + 0x10]
push 0x17
pop ecx
call fcn.5b81b790
call fcn.5b841c90
test eax, eax
je 0x5b84fa2d
mov edx, dword [ebx + 0x24]
push 0
push ecx
push 0x10
push edi
lea ecx, [ebp - 0x20]
call fcn.5b883d60
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebx + 8]
mov eax, dword [ecx + 8]
mov edx, dword [esi + 8]
mov dword [esi + 8], eax
mov dword [ecx + 8], edx
test ecx, ecx
je 0x5b84f935
call fcn.5b827311
jmp 0x5b84f935
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebx + 0x24]
push 0x10
pop ecx
call fcn.5b883d36
push 1
push eax
push edi
mov edx, esi
lea ecx, [ebp - 0x24]
call fcn.5b8837ec
or dword [ebp - 0x18], 1
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x24]
test esi, esi
je 0x5b84fa7d
cmp byte [ebp - 0xd], 0
mov edx, dword [ebx + 8]
mov eax, dword [esi + 8]
mov ecx, dword [edx + 8]
mov dword [edx + 8], eax
mov dword [esi + 8], ecx
jne 0x5b84fa7d
or dword [ebp - 4], 0xffffffff
mov ecx, esi
jmp 0x5b84fa23
call fcn.5b842f6a
test eax, eax
je 0x5b84faaa
cmp eax, 1
jne 0x5b84fa90
mov eax, 0x80070002
cmp byte [ebp - 0xd], 0
jne 0x5b84faaa
push eax
call fcn.5b82c619
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x5b84f935
jmp 0x5b84fa79
test esi, esi
je 0x5b84fab5
mov ecx, esi
call fcn.5b827311
call fcn.5b887840
ret
Function at 0x5b859be2
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x5b859d35
mov edx, 0x10000000
cmp eax, 0x7c
je 0x5b859d35
cmp eax, 0x29
jne 0x5b859c1b
cmp dword [esi + 0x10], 0
jne 0x5b859d35
test dword [esi + 0x50], edx
je 0x5b859d3b
cmp eax, 0x2e
jne 0x5b859c36
push 5
lea ecx, [esi + 0x24]
call fcn.5b859e15
mov ecx, esi
call fcn.5b859bb9
jmp 0x5b859d1f
cmp eax, 0x5c
jne 0x5b859c8b
mov ecx, esi
call fcn.5b859bb9
test byte [esi + 0x50], 0x80
je 0x5b859c7f
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x5b859c67
push 4
lea ecx, [esi + 0x24]
call fcn.5b859e15
mov ecx, esi
call fcn.5b859bb9
jmp 0x5b859d26
cmp eax, 0x42
jne 0x5b859c7f
push 4
lea ecx, [esi + 0x24]
call fcn.5b859e15
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x5b859c5b
mov ecx, esi
call fcn.5b85a125
jmp 0x5b859d1f
cmp eax, 0x5b
jne 0x5b859cab
mov ecx, esi
call fcn.5b859bb9
mov ecx, esi
call fcn.5b85a0d9
cmp dword [esi + 0x4c], 0x5d
je 0x5b859c2a
push 4
jmp 0x5b859d3d
cmp eax, 0x28
jne 0x5b859cc8
mov ecx, esi
call fcn.5b859bb9
mov ecx, esi
call fcn.5b85a206
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x5b859d3b
jmp 0x5b859d14
cmp eax, 0x5e
jne 0x5b859cd1
push 2
jmp 0x5b859c53
cmp eax, 0x24
jne 0x5b859cdd
push 3
jmp 0x5b859c53
cmp eax, 0x2a
je 0x5b859d31
cmp eax, 0x2b
je 0x5b859d31
cmp eax, 0x3f
je 0x5b859d31
cmp eax, 0x7b
je 0x5b859d31
cmp eax, 0x7d
jne 0x5b859cfb
test dword [esi + 0x50], edx
je 0x5b859d2d
cmp eax, 0x5d
jne 0x5b859d05
test dword [esi + 0x50], edx
je 0x5b859ca4
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.5b85a3d5
mov bl, 1
mov ecx, esi
call fcn.5b859bb9
test bl, bl
je 0x5b859d26
mov ecx, esi
call fcn.5b85a30b
mov cl, 1
jmp 0x5b859be9
push 6
jmp 0x5b859d3d
push 0xa
jmp 0x5b859d3d
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.5b859761
int3
Function at 0x5b864e8c
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b864ec1
test byte [eax + 0x1c], 8
je 0x5b864ec1
push edi
push ecx
push dword [eax + 0x14]
mov edx, 0x5b816e6c
push dword [eax + 0x10]
push 0xe
pop ecx
call fcn.5b863c33
mov ecx, dword [ebp + 0x18]
movzx ebx, cx
cmp ecx, ebx
jne 0x5b865008
mov eax, dword [ebp + 8]
push 2
pop esi
sub eax, 0
je 0x5b864efe
sub eax, esi
je 0x5b864efa
push 0x8000ffff
lea ecx, [esp + 0x14]
call fcn.5b86cc36
push 0x5b894880
lea eax, [esp + 0x14]
jmp 0x5b86501f
push 0x38
jmp 0x5b864f00
push 0x30
pop eax
xor edx, edx
lea ecx, [eax + edi]
xor eax, eax
lock cmpxchg dword [ecx], edx
mov ecx, eax
test ecx, ecx
jne 0x5b864f56
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b864f3a
test byte [eax + 0x1c], 2
je 0x5b864f3a
push dword [ebp + 8]
mov edx, 0x5b816e6c
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xf
pop ecx
call fcn.5b81ae33
push 0x8007139f
lea ecx, [esp + 0x14]
call fcn.5b86cc36
push 0x5b894880
lea eax, [esp + 0x14]
jmp 0x5b86501f
mov eax, dword [ebp + 0xc]
xor edx, edx
sub eax, edx
je 0x5b864f94
sub eax, 1
je 0x5b864f8f
sub eax, 1
je 0x5b864f96
sub eax, 1
je 0x5b864f8a
push 0x8000ffff
lea ecx, [esp + 0x14]
call fcn.5b86cc36
push 0x5b894880
lea eax, [esp + 0x14]
jmp 0x5b86501f
push 4
pop esi
jmp 0x5b864f96
xor esi, esi
inc esi
jmp 0x5b864f96
mov esi, edx
push edx
push dword [ebp + 0x1c]
push edx
push ebx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x5b864fff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x5b864fc4
movzx esi, si
or esi, 0x80070000
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b864fea
test byte [eax + 0x1c], 1
je 0x5b864fea
push esi
push dword [eax + 0x14]
mov edx, 0x5b816e6c
push dword [eax + 0x10]
push 0x10
pop ecx
call fcn.5b81ae33
push esi
lea ecx, [esp + 0x14]
call fcn.5b86cc36
push 0x5b894880
lea eax, [esp + 0x14]
jmp 0x5b86501f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0x80070057
lea ecx, [esp + 0x14]
call fcn.5b86cc36
push 0x5b894880
lea eax, [esp + 0x14]
push eax
call fcn.5b885548
int3

Function at 0x5b865d19
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + edi]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x5b865d28
mov eax, dword [ecx + 0x18]
pop edi
and eax, esi
pop esi
pop ebp
ret 4
Function at 0x5b868675
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x5b89bae4]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], edi
call fcn.5b86a057
mov esi, eax
test esi, esi
jns 0x5b8686c4
mov ecx, esi
call fcn.5b871d3e
test eax, eax
je 0x5b8686bd
lea ecx, [esp + 0x10]
call fcn.5b868603
test eax, eax
jns 0x5b8686d4
mov esi, eax
lfence
mov eax, esi
jmp 0x5b86870b
lea esi, [esp + 0x20]
lea edi, [esp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0xc]
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
xor dword [esp + ecx*4 + 0x10], eax
inc ecx
cmp ecx, 4
jb 0x5b8686d6
push 0x10
pop ecx
lea eax, [esp + 0x20]
mov dword [esp + 0xc], ecx
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push ecx
push 2
call fcn.5b87aa10
lea esi, [esp + 0x20]
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.5b884340
mov esp, ebp
pop ebp
ret
Function at 0x5b868ad5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x5b89bae4]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
push edi
mov dword [esp + 0x28], edx
mov esi, ecx
mov dword [esp + 0x2c], esi
xor ebx, ebx
mov dword [esp + 0x74], 0xaac56b
lea eax, [esp + 0x64]
mov dword [esp + 0x48], eax
mov eax, ebx
mov dword [esp + 0x78], 0x11d0cd44
mov dword [esp + 0x7c], 0xc000c28c
mov dword [esp + 0x80], 0xee95c24f
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], 0x34
mov dword [esp + 0x44], 1
mov dword [esp + 0x3c], 2
mov dword [esp + 0x40], ebx
mov dword [esp + 0x58], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x60], ecx
mov edi, ebx
push 0x10
pop ecx
test dl, 8
jne 0x5b868b79
mov eax, ecx
mov dword [esp + 0x58], eax
test dl, 0x10
jne 0x5b868b87
or eax, 0x1000
mov dword [esp + 0x58], eax
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x18], 3
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x30]
mov dword [esp + 0x50], ebx
push eax
lea edx, [esp + 0x78]
mov dword [esp + 0x50], 1
or ecx, 0xffffffff
mov dword [esp + 0x24], ebx
call fcn.5b8687f5
mov ebx, eax
test ebx, ebx
js 0x5b868c18
mov ecx, dword [esp + 0x50]
test ecx, ecx
je 0x5b868cad
mov edx, dword [esp + 0x28]
call fcn.5b868864
mov ebx, eax
test ebx, ebx
jns 0x5b868c7b
mov edx, dword [0x5b89602c]
cmp edx, 0x5b89602c
je 0x5b868c4d
test byte [edx + 0x1c], 4
je 0x5b868c4d
push ebx
lfence
push dword [esp + 0x20]
push dword [esp + 0x1c]
push esi
push dword [edx + 0x14]
push dword [edx + 0x10]
push 0x13
jmp 0x5b868c41
mov edx, dword [0x5b89602c]
cmp edx, 0x5b89602c
je 0x5b868c4d
test byte [edx + 0x1c], 4
je 0x5b868c4d
push ebx
lfence
push dword [esp + 0x20]
push dword [esp + 0x1c]
push esi
push dword [edx + 0x14]
push dword [edx + 0x10]
push 0x14
pop ecx
call fcn.5b86878a
mov edx, dword [0x5b89602c]
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x5b868c57
mov edi, ebx
mov ecx, 0x60001
call fcn.5b871d95
test eax, eax
js 0x5b868cb4
inc esi
mov dword [esp + 0x14], esi
cmp esi, dword [esp + 0x1c]
ja 0x5b868cb4
mov esi, dword [esp + 0x2c]
xor ebx, ebx
jmp 0x5b868ba7
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b868ca9
test byte [eax + 0x1c], 4
je 0x5b868ca9
push dword [esp + 0x1c]
mov edx, 0x5b8171fc
push dword [esp + 0x18]
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x12
pop ecx
call fcn.5b82ebe4
xor eax, eax
jmp 0x5b868ce1
mov eax, 0x8000ffff
jmp 0x5b868ce1
test edi, edi
js 0x5b868cbd
mov edi, 0x80004005
cmp edx, 0x5b89602c
je 0x5b868cdf
test byte [edx + 0x1c], 1
je 0x5b868cdf
push edi
push dword [edx + 0x14]
push dword [edx + 0x10]
mov edx, 0x5b8171fc
push 0x15
pop ecx
call fcn.5b81ae33
mov eax, edi
mov ecx, dword [esp + 0x84]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.5b884340
mov esp, ebp
pop ebp
ret 4
Function at 0x5b8697fd
Capabilities:
Modify service
Start service

Disassembly:
push ecx
push esi
push edi
push 0x12
push edx
push ecx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x5b86984b
call fcn.5b86f6c1
mov esi, eax
mov ecx, dword [0x5b89602c]
cmp ecx, 0x5b89602c
je 0x5b8698c8
test byte [ecx + 0x1c], 1
je 0x5b8698c8
push esi
push dword [ecx + 0x14]
mov edx, 0x5b81727c
push dword [ecx + 0x10]
push 0x2b
pop ecx
call fcn.5b81ae33
jmp 0x5b8698c8
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x5b869887
call fcn.5b86f6c1
mov esi, eax
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b8698c1
test byte [eax + 0x1c], 1
je 0x5b8698c1
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2c
jmp 0x5b8698b6
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x5b8698c1
call fcn.5b86f6c1
mov esi, eax
mov eax, dword [0x5b89602c]
cmp eax, 0x5b89602c
je 0x5b8698c1
test byte [eax + 0x1c], 1
je 0x5b8698c1
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2d
mov edx, 0x5b81727c
pop ecx
call fcn.5b81ae33
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, esi
pop esi
pop ecx
ret