joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57c4a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x57c603
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x57c51e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
add eax, 8
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.004070dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x57c549
xor eax, eax
push ebp
push 0x57c58b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1a
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
add eax, 4
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.004070dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x57c5b6
lea edx, [ebp - 0x224]
xor eax, eax
call fcn.00403640
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
call fcn.00471c9c
mov edx, dword [ebp - 0x220]
mov eax, dword [ebp - 4]
add eax, 0xc
call fcn.00406edc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57c60a
lea eax, [ebp - 0x224]
mov edx, 4
call fcn.00406ed4
ret

Function at 0x57ccd8
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x57cd54
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
mov edx, dword [ebp - 8]
inc edx
lea eax, [ebp - 4]
call fcn.00406e28
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00406bc0
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x57cd35
mov edx, dword [ebp - 8]
dec edx
lea eax, [ebp - 4]
call fcn.00406e28
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407144
jmp 0x57cd3e
mov eax, ebx
xor edx, edx
call fcn.00406edc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57cd5b
lea eax, [ebp - 4]
call fcn.004069dc
ret
Function at 0x57ed68
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
xor ecx, ecx
push ebp
push 0x57ee82
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor ecx, ecx
push ebp
push 0x57ee0b
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 8]
push ecx
push edx
push eax
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
cmp ebx, 0x20
ja 0x57ee01
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ecx, 0
call fcn.00406158
push dword [ebp - 0xc]
push 0x57eea0
lea eax, [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov ecx, 0
call fcn.00406158
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00406380
push 1
lea eax, [ebp - 4]
call fcn.004065a4
push eax
call sub.KERNEL32.DLL_WinExec
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x57ee5f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57ee89
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00405e94
lea eax, [ebp - 4]
call fcn.00405e70
ret

Function at 0x57eea4
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffff7f8
mov ebx, eax
mov dword [esp], 0x400
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameW
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x401
call fcn.004070dc
add esp, 0x808
pop ebx
ret

Function at 0x57ef58
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
mov ebx, eax
mov eax, ebx
xor edx, edx
call fcn.00406edc
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x57ef95
mov eax, ebx
lea edx, [ebp - 0x20c]
call fcn.00407088
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x57ef9c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x57f018
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryW
test eax, eax
jbe 0x57efff
push ebx
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.004070dc
mov eax, dword [ebp - 0x20c]
mov ecx, 2
mov edx, 1
call fcn.00407530
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57f01f
lea eax, [ebp - 0x20c]
call fcn.00406ecc
ret
Function at 0x58402c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo_1
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x58407d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x584064
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x584054
jmp 0x58407d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x584065
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x594730
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x59475e
mov eax, ebx
call fcn.005951e4
cmp dword [ebx + 0x40], 0
je 0x594757
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5947cf
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x5947c1
cmp dword [ebx + 8], 0
je 0x594780
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x594792
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5947c1
cmp dword [ebx + 8], 0
je 0x594773
cmp eax, 3
je 0x5947a5
dec eax
jne 0x594773
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x594773
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x594773
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5947ed
cmp dword [ebx + 0x14], 0xcc
je 0x5947ed
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005947f8
pop ebx
ret
Function at 0x5a6dc4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd20
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x20]
call fcn.00406ec4
xor eax, eax
push ebp
push 0x5a6fda
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0x20]
call fcn.00403f50
mov esi, eax
lea eax, [ebp - 0x2d0]
xor ecx, ecx
mov edx, 0x2b4
call fcn.00403d24
cmp dword [ebp + 0x20], 0
je 0x5a6e7f
cmp dword [ebp - 0x10], 0
je 0x5a6e7f
mov eax, dword [ebp + 0x20]
call fcn.00471794
test al, al
jne 0x5a6e35
mov eax, dword [ebp + 0x20]
call fcn.004717dc
test al, al
je 0x5a6e58
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00406f68
push eax
call sub.shell32.dll_SHGetFileInfoW
jmp 0x5a6e79
push 0x4010
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
mov eax, dword [ebp + 0x20]
call fcn.00406f68
push eax
call sub.shell32.dll_SHGetFileInfoW
mov esi, dword [ebp - 0x2cc]
cmp byte [ebp + 0x1c], 0
je 0x5a6ea6
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
push 0x5a6fec
call sub.shell32.dll_SHGetFileInfoW
mov edi, eax
jmp 0x5a6ec5
push 0x4001
push 0x2b4
lea eax, [ebp - 0x2d0]
push eax
push 0
push 0x5a6fec
call sub.shell32.dll_SHGetFileInfoW
mov edi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
call sub.comctl32.dll_ImageList_GetIconSize
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.00409c94
test bl, bl
je 0x5a6f05
cmp byte [ebp + 0x14], 0
jne 0x5a6f05
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004a3fac
push eax
push esi
push edi
call sub.comctl32.dll_ImageList_Draw
test byte [ebp + 0x14], bl
je 0x5a6fc4
mov dl, 1
mov eax, dword [0x4a15b0]
call fcn.004a8410
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x5a6fbd
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0
push 0
push 0
mov eax, dword [ebp - 0x1c]
call fcn.004a8d28
call fcn.004a3fac
push eax
push esi
push edi
call sub.comctl32.dll_ImageList_Draw
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2dc], eax
fild dword [ebp - 0x14]
fmul qword [ebp + 0xc]
call fcn.00403780
add eax, dword [ebp - 8]
mov dword [ebp - 0x2d8], eax
fild dword [ebp - 0x18]
fmul qword [ebp + 0xc]
call fcn.00403780
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x2d4], eax
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x2e0]
mov eax, dword [ebp - 4]
call fcn.005a6ce8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a6fc4
mov eax, dword [ebp - 0x1c]
call fcn.004047c4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a6fe1
lea eax, [ebp + 0x20]
call fcn.00406ecc
ret
Function at 0x5b6484
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffff7f8
mov ebx, eax
mov dword [esp], 0x400
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameW
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x401
call fcn.004070dc
add esp, 0x808
pop ebx
ret
Function at 0x5b6bbc
Capabilities:
Create process on windows
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5b6db4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67d698]
cmp dword [eax], 1
jne 0x5b6cc0
push 0x5b6dcc
push 0x5b6dfc
call sub.user32.dll_FindWindowW
test eax, eax
je 0x5b6bfd
mov byte [ebp - 1], 1
jmp 0x5b6daa
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00403d24
mov dword [ebp - 0x54], 0x44
mov eax, 0x104
call fcn.00403230
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5b6cb9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0x104
push 0
push 0x5b6e1c
push 0
call sub.KERNEL32.DLL_SearchPathW
test eax, eax
jne 0x5b6c5a
call sub.KERNEL32.DLL_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x5b6ca3
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x210
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
jne 0x5b6c8d
call sub.KERNEL32.DLL_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x5b6ca3
mov eax, dword [ebp - 0x64]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x60]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b6daa
mov eax, dword [ebp - 8]
call fcn.0040324c
ret
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jne 0x5b6ce1
call sub.KERNEL32.DLL_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x5b6daa
push 4
push 0x5b6e34
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jne 0x5b6d03
push 0x10
push 0x5b6e34
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
push ebx
call sub.advapi32.dll_CloseServiceHandle
test esi, esi
jne 0x5b6d1d
call sub.KERNEL32.DLL_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x5b6daa
lea eax, [ebp - 0x80]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x5b6d3e
push esi
call sub.advapi32.dll_CloseServiceHandle
call sub.KERNEL32.DLL_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x5b6daa
cmp dword [ebp - 0x7c], 4
jne 0x5b6d50
push esi
call sub.advapi32.dll_CloseServiceHandle
mov byte [ebp - 1], 1
jmp 0x5b6daa
xor eax, eax
mov dword [ebp - 0x10], eax
push esi
call sub.advapi32.dll_CloseServiceHandle
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
push 0x10
push 0x5b6e34
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
push ebx
call sub.advapi32.dll_CloseServiceHandle
lea eax, [ebp - 0x10]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceW
test eax, eax
jne 0x5b6da0
push esi
call sub.advapi32.dll_CloseServiceHandle
call sub.KERNEL32.DLL_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x5b6daa
push esi
call sub.advapi32.dll_CloseServiceHandle
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5b6dbe
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b6e48
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x5b6f05
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67d698]
cmp dword [eax], 1
jne 0x5b6e84
push 0x5b6f1c
push 0x5b6f4c
call sub.user32.dll_FindWindowW
test eax, eax
setne byte [ebp - 1]
jmp 0x5b6efb
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jne 0x5b6ea2
call sub.KERNEL32.DLL_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x5b6efb
push 4
push 0x5b6f6c
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jne 0x5b6ebf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5b6f0f
push ebx
call sub.advapi32.dll_CloseServiceHandle
lea eax, [ebp - 0x20]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x5b6ee3
push esi
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5b6f0f
cmp dword [ebp - 0x1c], 4
jne 0x5b6ef5
push esi
call sub.advapi32.dll_CloseServiceHandle
mov byte [ebp - 1], 1
jmp 0x5b6efb
push esi
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5b6f0f
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b6f80
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406ec4
mov eax, dword [ebp - 8]
call fcn.00406ec4
xor eax, eax
push ebp
push 0x5b7204
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 1
xor edx, edx
push ebp
push 0x5b71df
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jne 0x5b6fda
mov byte [ebp - 0xd], 0
push ebx
call sub.advapi32.dll_LockServiceDatabase
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x5b71ce
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 0x14], 0
jne 0x5b7038
call sub.KERNEL32.DLL_GetLastError_1
cmp eax, 0x41f
je 0x5b7007
mov byte [ebp - 0xd], 0
push 0x10c
push 0x40
call sub.KERNEL32.DLL_LocalAlloc_1
mov esi, eax
test esi, esi
lea eax, [ebp - 0x18]
push eax
push 0x10c
push esi
push ebx
call sub.advapi32.dll_QueryServiceLockStatusW
test eax, eax
jne 0x5b702f
mov byte [ebp - 0xd], 0
cmp dword [esi], 0
push esi
call sub.KERNEL32.DLL_LocalFree
push 2
mov eax, dword [ebp - 4]
call fcn.00406f68
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x5b7056
mov byte [ebp - 0xd], 0
xor edx, edx
push ebp
push 0x5b71a7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
cmp eax, 4
ja case.default.0x5b706c
jmp dword [eax*4 + 0x5b7073]
xor edi, edi
jmp case.default.0x5b706c
mov edi, 1
jmp case.default.0x5b706c
mov edi, 2
jmp case.default.0x5b706c
mov edi, 3
jmp case.default.0x5b706c
mov edi, 4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0x110
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_ChangeServiceConfigW
test eax, eax
jne 0x5b70cc
mov byte [ebp - 0xd], 0
push 0x5b7218
call sub.KERNEL32.DLL_GetModuleHandleW_2
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
setne al
test al, al
jne 0x5b70fb
call fcn.00405750
call fcn.00405750
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5b71e9
xor edx, edx
push ebp
push 0x5b7189
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x5b7234
mov eax, dword [ebp - 0x20]
push eax
call fcn.0040a328
mov ebx, eax
test ebx, ebx
setne al
test al, al
jne 0x5b713e
call fcn.00405750
call fcn.00405750
call fcn.00405750
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5b71e9
cmp dword [ebp - 8], 0
je 0x5b7151
mov eax, dword [ebp - 8]
call fcn.00406f68
mov dword [ebp - 0x24], eax
jmp 0x5b7156
xor eax, eax
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x24]
mov edx, dword [0x674524]
mov eax, dword [ebp - 0x1c]
call ebx
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x5b7172
mov byte [ebp - 0xd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b7190
mov eax, dword [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b720b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ed4
ret
Function at 0x5b7304
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x5b73be
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.0057c648
push dword [ebp - 4]
push 0x5b73d8
movzx eax, byte [ebp - 5]
push dword [eax*4 + 0x674528]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00407380
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00403d24
mov dword [ebp - 0x4c], 0x44
mov eax, 0x5b7400
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x430
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406f68
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
je 0x5b73a8
mov bl, 1
mov eax, dword [ebp - 0x5c]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x58]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b73c5
lea eax, [ebp - 4]
call fcn.00406ecc
ret
Function at 0x5ba4b8
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x5ba552
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x5ba4d7
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x5ba568
dec edx
je 0x5ba59d
jmp 0x5ba5ee
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x5ba5ee
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5bb514
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x5bb535
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x5bb522
pop edi
pop esi
pop ebx
ret
Function at 0x5c122c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
mov eax, 0xedb88320
xor esi, esi
mov ebx, dword [esp]
mov edx, esi
mov ecx, 0xfffffff8
mov edi, edx
and edi, 1
dec edi
jne 0x5c1252
shr edx, 1
xor edx, eax
jmp 0x5c1254
shr edx, 1
inc ecx
jne 0x5c1244
mov dword [ebx], edx
inc esi
add ebx, 4
cmp esi, 0x100
jne 0x5c123d
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x5c126c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x5c1275
mov eax, dword [ebp - 4]
add esp, 0xfffff7f0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004918b0
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
or esi, 0xffffffff
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
sub eax, dword [ebp + 8]
sub eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x5c1322
cmp dword [ebp - 0xc], 0x2800
jl 0x5c12d0
mov dword [ebp - 8], 0x2800
jmp 0x5c12d6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x2814]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
xor ebx, ebx
cmp ebx, dword [ebp - 0x10]
jge 0x5c131a
mov eax, esi
shr eax, 8
and eax, 0xffffff
movzx edx, byte [ebp + ebx - 0x2814]
xor esi, edx
and esi, 0xff
xor eax, dword [esi*4 + 0x6b740c]
mov esi, eax
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x5c12f1
mov eax, dword [ebp - 8]
sub dword [ebp - 0xc], eax
jmp 0x5c12b8
mov ebx, esi
xor ebx, 0xffffffff
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x5f40c8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x5f4122
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.005f40bc
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.005f13b0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.005f0f14
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f4129
lea eax, [ebp - 4]
call fcn.00406ecc
ret