joyce8/EMBER2024-capa huggingface dataset:
Function at 0x558fc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.0050c860
add esp, 0x18
test eax, eax
je 0x558fe2
cmp eax, 0xffffffff
jne 0x558fe4
xor eax, eax
pop ebp
ret

Function at 0x55c850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
mov eax, dword [0x71906c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x7277fd], 0
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x158], ebx
jne 0x55c886
call fcn.0055d0c0
test al, al
je 0x55c897
mov byte [0x7277fd], 1
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d755
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x5a8]
test eax, eax
je 0x55c8b8
push 0x400
push eax
call fcn.005b3dd0
add esp, 8
call fcn.0055d0c0
test al, al
jne 0x55c886
push esi
push edi
nop word [eax + eax]
mov ebx, 2
mov dword [ebp - 0x150], 4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x14c], eax
nop
lea eax, [ebp - 0x188]
push eax
call fcn.0054bf20
push 0
push 1
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x178], xmm0
movups xmmword [ebp - 0x168], xmm0
call fcn.00555770
lea eax, [ebp - 0x198]
push eax
call fcn.0054bf20
mov esi, dword [eax + 8]
lea eax, [ebp - 0x1a8]
push eax
call fcn.0054bf20
add esp, 0x14
mov ecx, eax
mov eax, esi
inc ebx
cdq
mov dword [ebp - 0x154], ebx
add eax, dword [ecx]
push 0
adc edx, dword [ecx + 4]
push ebx
push edx
push eax
call fcn.0042e400
movups xmm1, xmmword [ebp - 0x178]
mov esi, dword [ebp - 0x148]
mov edi, eax
mov ebx, edx
dec esi
movaps xmm0, xmm1
movd eax, xmm1
psrldq xmm0, 4
movd ecx, xmm0
shld ebx, edi, 8
push ecx
push eax
push 0
push esi
shl edi, 8
call fcn.0042e400
xor edi, eax
xor ebx, edx
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x168], edi
push eax
mov dword [ebp - 0x164], ebx
call fcn.0054bf20
lea esi, [eax + 8]
lea eax, [ebp - 0x1c8]
push eax
call fcn.0054bf20
mov edx, dword [ebp - 0x148]
add esp, 8
mov ebx, dword [ebp - 0x154]
mov dword [ebp - 0x148], ebx
mov ecx, dword [eax]
add ecx, dword [esi]
lea eax, [edx + 2]
imul edx, dword [ebp - 0x160]
imul ecx, eax
mov eax, dword [ebp - 0x14c]
shl ecx, 0x10
xor ecx, edx
mov dword [ebp - 0x160], ecx
movups xmm0, xmmword [ebp - 0x168]
movups xmmword [eax], xmm0
add eax, 0x10
sub dword [ebp - 0x150], 1
mov dword [ebp - 0x14c], eax
jne 0x55c8e0
movsd xmm0, qword [0x6a8fe0]
lea eax, [ebp - 0x44]
sub esp, 8
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.005b3a10
add esp, 0x10
call fcn.0055d0c0
test al, al
je 0x55c8c0
lea eax, [ebp - 0x144]
mov byte [ebp - 0x144], 0
push 0x100
push eax
call fcn.005b3c20
add esp, 8
cmp byte [ebp - 0x144], 0
pop edi
pop esi
je 0x55ca66
lea eax, [ebp - 0x144]
push 0x400
push eax
call fcn.005b3dd0
add esp, 8
call fcn.0055d0c0
test al, al
jne 0x55c886
push 0x6a7a6c
push dword [ebp - 0x158]
call fcn.005464a0
add esp, 8
call fcn.0055d0c0
xor edx, edx
mov ecx, 0x23
test al, al
pop ebx
cmovne ecx, edx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d755
mov esp, ebp
pop ebp
ret
Function at 0x566870
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 0x64
jb 0x5668a2
push 0x6aa198
push esi
call fcn.005463e0
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x5668b9
push ecx
push 0x6aa1b4
push esi
call fcn.005464a0
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x5668d2
push ebx
push esi
call fcn.00566510
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x5668e7
push esi
call fcn.00565530
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x5668fc
push esi
call fcn.005664f0
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x56690c
push esi
call fcn.00566750
add esp, 4
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5798f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x719dec]
mov edi, eax
add esp, 4
test edi, edi
jne 0x57991d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x579967
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp + 0x10], ebx
jmp 0x57996d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x5799cb
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop dword [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x579990
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x5799f7
mov eax, dword [esi + 4]
push 1
push 0x6acbe0
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x6acbe1
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x5799d0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x57c470
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057c480

Function at 0x57c700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0057c710
Function at 0x58e6b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx - 4]
jle 0x58e71a
mov ecx, dword [ebp + 8]
sub ecx, ebx
push esi
mov dword [ebp + 8], ecx
push edi
nop word [eax + eax]
mov esi, dword [ecx + ebx]
lea ebx, [ebx + 4]
mov ecx, eax
mov edi, esi
and edi, 0xffff00ff
and ecx, 0xffff00ff
add edi, ecx
mov edx, esi
movzx ecx, ax
and edx, 0xff00
add edx, ecx
and eax, 0xff00ffff
mov ecx, dword [ebp + 8]
xor edi, edx
and esi, 0xff00ff00
and edi, 0xff00ff
add eax, esi
xor eax, edi
sub dword [ebp + 0x10], 1
mov dword [ebx - 4], eax
jne 0x58e6d0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x58e720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jle 0x58e793
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub ecx, eax
sub dword [ebp + 0x14], eax
push ebx
push esi
mov dword [ebp + 0xc], ecx
push edi
nop word [eax + eax]
mov ebx, dword [ecx + eax]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov ecx, ebx
and ecx, 0xffff00ff
mov edi, esi
and edi, 0xffff00ff
mov edx, esi
add edi, ecx
and edx, 0xff00
movzx ecx, bx
and esi, 0xff00ff00
add edx, ecx
and ebx, 0xff00ffff
mov ecx, dword [ebp + 0x14]
xor edi, edx
and edi, 0xff00ff
add ebx, esi
xor edi, ebx
sub dword [ebp + 0x10], 1
mov dword [ecx + eax - 4], edi
mov ecx, dword [ebp + 0xc]
jne 0x58e740
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x58ef90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [ebp + 8], 0
lea eax, [ebx + eax*4]
mov edi, eax
sub edi, ebx
add edi, 3
shr edi, 2
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x58f004
push esi
mov esi, dword [ebp + 0x10]
nop
mov edx, dword [ebx]
lea esi, [esi + 2]
mov ecx, edx
lea ebx, [ebx + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xd
xor cl, al
mov eax, edx
and cl, 7
shr eax, 0x10
xor cl, al
mov eax, edx
mov byte [esi - 2], cl
mov ecx, edx
shr ecx, 5
shr eax, 3
xor cl, al
shr edx, 5
mov eax, dword [ebp + 8]
and cl, 0x1f
xor cl, dl
inc eax
mov byte [esi - 1], cl
mov dword [ebp + 8], eax
cmp eax, edi
jb 0x58efc0
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x58f010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 8], 0
lea eax, [edi + eax*4]
mov ebx, eax
sub ebx, edi
add ebx, 3
shr ebx, 2
cmp edi, eax
cmova ebx, ecx
test ebx, ebx
je 0x58f07b
push esi
mov esi, dword [ebp + 0x10]
nop
mov edx, dword [edi]
lea esi, [esi + 2]
mov ecx, edx
lea edi, [edi + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xc
xor cl, al
mov eax, edx
shr eax, 0x10
and cl, 0xf
xor cl, al
mov eax, edx
shr eax, 0x1c
xor al, dl
mov byte [esi - 2], cl
and al, 0xf
xor al, dl
mov byte [esi - 1], al
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, ebx
jb 0x58f040
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5bf6c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor dl, dl
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test esi, esi
je 0x5bf6e6
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x5bf6d6
pop edi
movzx eax, dl
pop esi
ret
Function at 0x5dbb90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ebp
push edi
sub ecx, 4
jb 0x5dbbc1
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x5dbbc8
add edx, 4
add esi, 4
sub ecx, 4
jae 0x5dbbb0
xor edi, edi
cmp ecx, 0xfffffffc
je 0x5dbc03
movzx edi, byte [edx]
movzx eax, byte [esi]
sub edi, eax
jne 0x5dbc03
cmp ecx, 0xfffffffd
je 0x5dbc03
movzx edi, byte [edx + 1]
movzx eax, byte [esi + 1]
sub edi, eax
jne 0x5dbc03
cmp ecx, 0xfffffffe
je 0x5dbc03
movzx edi, byte [edx + 2]
movzx eax, byte [esi + 2]
sub edi, eax
jne 0x5dbc03
cmp ecx, 0xffffffff
je 0x5dbc03
movzx edi, byte [edx + 3]
movzx eax, byte [esi + 3]
sub edi, eax
test edi, edi
jle 0x5dbc1e
push 0x157
push 0x6caf50
push 0x6caf80
call fcn.005bf6f0
add esp, 0xc
mov edi, dword [esp + 0x14]
xor ecx, ecx
test ebx, ebx
jle 0x5dbc3d
mov esi, edi
mov edx, ebp
sub esi, ebp
nop
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x5dbc3d
inc ecx
inc edx
cmp ecx, ebx
jl 0x5dbc30
lea edx, [ebx - 1]
test edx, edx
js 0x5dbc61
mov esi, edi
lea eax, [edx + ebp]
sub esi, ebp
nop dword [eax + eax]
cmp byte [eax + esi], 0
jne 0x5dbc61
cmp byte [eax], 0xff
jne 0x5dbc61
dec eax
sub edx, 1
jns 0x5dbc50
cmp ecx, edx
jl case.0x5dbc8d.2
jle 0x5dbc73
pop edi
pop esi
pop ebp
lea eax, [ecx*8]
pop ebx
ret
mov bl, byte [ecx + ebp]
mov dh, byte [ecx + edi]
mov dl, bl
xor dl, dh
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x5dbc8d.2
movzx eax, byte [eax + 0x5dbd00]
jmp dword [eax*4 + 0x5dbce0]
mov eax, 7
jmp 0x5dbcc3
mov eax, 6
jmp 0x5dbcc3
mov eax, 5
jmp 0x5dbcc3
mov eax, 4
jmp 0x5dbcc3
mov eax, 3
jmp 0x5dbcc3
mov eax, 2
jmp 0x5dbcc3
mov eax, 1
test dl, dh
jne case.0x5dbc8d.2
and bl, dl
cmp bl, dl
jne case.0x5dbc8d.2
pop edi
pop esi
pop ebp
lea eax, [eax + ecx*8]
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x608ac0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x608bac
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
inc edi
nop word [eax + eax]
cmp esi, 3
jl 0x608b3d
movzx ecx, byte [edi - 1]
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + 0x6d5ab0]
mov byte [edx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x6d5ab0]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x6d5ab0]
mov byte [edx + 2], al
add edx, 3
and ecx, 0x3f
movzx eax, byte [ecx + 0x6d5ab0]
mov byte [edx], al
jmp 0x608b91
movzx eax, byte [edi - 1]
shl eax, 0x10
cmp esi, 2
jne 0x608b51
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + 0x6d5ab0]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x6d5ab0]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x608b7b
lea eax, [esi + 0x3c]
jmp 0x608b88
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x6d5ab0]
mov byte [edx + 2], al
add edx, 3
mov byte [edx], 0x3d
sub esi, 3
add ebx, 4
add edi, 3
inc edx
test esi, esi
jg 0x608ae0
pop edi
pop esi
mov eax, ebx
mov byte [edx], 0
pop ebx
ret
mov eax, dword [esp + 0xc]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
ret
Function at 0x609cf0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.0042ea90
mov eax, dword [0x71906c]
xor eax, esp
mov dword [esp + 0x88], eax
mov edx, dword [esp + 0xa0]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [esp + 0xac]
mov dword [esp + 0x10], edx
test edi, edi
je 0x609d56
cmp edi, dword [esi]
je 0x609d4d
test ebp, ebp
je 0x609dd0
test ebx, ebx
js 0x609dd0
mov eax, 1
mov dword [esi], edi
jmp 0x609d5c
mov edi, dword [esi]
test edi, edi
je 0x609dd0
test ebp, ebp
je 0x609eea
push edi
call fcn.005b2660
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x609d90
push 0x28
push 0x6d5db8
push 0x6d5de0
call fcn.005bf6f0
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
jge 0x609deb
push dword [esp + 0x10]
push edi
push dword [esi + 4]
call fcn.005aeac0
add esp, 0xc
test eax, eax
je 0x609dd0
push ebx
push ebp
push dword [esi + 4]
call fcn.005aec70
add esp, 0xc
test eax, eax
je 0x609dd0
lea ebp, [esi + 0x10]
push ebp
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.005aea20
add esp, 0xc
test eax, eax
jne 0x609e07
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042d755
add esp, 0x8c
ret
cmp ebx, 0x80
ja 0x609dd0
push ebx
lea eax, [esi + 0x14]
push ebp
push eax
call fcn.00507210
lea ebp, [esi + 0x10]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x80
je 0x609e2a
mov eax, 0x80
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call fcn.00506fc0
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x609e30
push edx
push edi
push dword [esi + 8]
call fcn.005aeac0
add esp, 0xc
test eax, eax
je 0x609dd0
push edi
call fcn.005b2660
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call fcn.005aec70
add esp, 0x10
test eax, eax
je 0x609dd0
xor ecx, ecx
nop dword [eax]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x609e80
push dword [esp + 0x10]
push edi
push dword [esi + 0xc]
call fcn.005aeac0
add esp, 0xc
test eax, eax
je 0x609dd0
push edi
call fcn.005b2660
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.005aec70
add esp, 0x10
test eax, eax
je 0x609dd0
push dword [esi + 8]
push dword [esi + 4]
call fcn.005aeca0
add esp, 8
test eax, eax
je 0x609dd0
mov eax, 1
jmp 0x609dd2
test eax, eax
je 0x609eca
jmp 0x609e2e
Function at 0x11648
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x1c]
push eax
push 0x20006
lea eax, [ebp + 8]
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0x240
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, esi
jl 0x116bd
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_ZwFlushKey]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
pop esi
leave
ret 0x14

Function at 0x116c8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
xor esi, esi
push 0x20019
lea eax, [ebp + 8]
push eax
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0x240
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, esi
jl 0x1172f
push ebx
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebx]
push edi
add esi, 0x10
push esi
call fcn.00015ae6
mov edi, eax
test edi, edi
jne 0x11734
mov esi, 0xc000009a
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
mov eax, esi
pop ebx
pop esi
leave
ret 0x14
push esi
push 0
push edi
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
push edi
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov esi, eax
cmp esi, 0xc0000023
je 0x11795
cmp esi, 0x80000005
je 0x11795
test esi, esi
jl 0x1179d
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x11776
mov ecx, dword [edi + 4]
mov dword [eax], ecx
mov eax, dword [ebx]
mov ecx, dword [edi + 8]
cmp eax, ecx
jb 0x11781
mov eax, ecx
push eax
mov dword [ebx], eax
lea eax, [edi + 0xc]
push eax
push dword [ebp + 0x14]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
jmp 0x1179d
mov eax, dword [ebp - 4]
add eax, 0xfffffff4
mov dword [ebx], eax
push edi
call fcn.00015b00
jmp 0x11722
Function at 0x11c78
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [sym.imp.ntoskrnl.exe_KeTickCount]
sub esp, 0x1c
push esi
jmp 0x11c8a
pause
mov ecx, dword [eax + 4]
mov esi, dword [eax]
mov edx, dword [eax + 8]
cmp ecx, edx
jne 0x11c88
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_KeQuerySystemTime]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
lea eax, [ebp - 0xc]
push eax
call fcn.00011a5a
lea eax, [ebp - 4]
push eax
call sub.ntoskrnl.exe_RtlRandomEx
mov ecx, eax
xor edx, edx
add ecx, 3
mov eax, esi
div ecx
movzx eax, byte [ebp - 0xb]
push 0x114
push 0
mov esi, 0x27ba0
push esi
add edx, eax
movzx eax, byte [ebp - 7]
add edx, eax
movzx eax, byte [ebp - 8]
add edx, eax
movzx eax, byte [ebp - 9]
add edx, eax
movzx eax, byte [ebp - 0xa]
add eax, dword [ebp - 0x14]
add eax, edx
mov dword [ebp - 0x14], eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push esi
mov dword [0x27ba0], 0x114
call dword [sym.imp.ntoskrnl.exe_RtlGetVersion]
pop esi
test eax, eax
jne 0x11d35
cmp dword [0x27ba4], 6
jb 0x11d35
push dword [ebp - 0x14]
call dword [sym.imp.ntoskrnl.exe_srand]
pop ecx
call dword [sym.imp.ntoskrnl.exe_rand]
leave
ret
mov ecx, dword [ebp - 0x14]
mov eax, 0x3039
test ecx, ecx
jne 0x11d4f
mov ecx, dword [0x24938]
imul ecx, ecx, 0x41c64e6d
add ecx, eax
imul ecx, ecx, 0x3e39b193
sub eax, ecx
shr eax, 0x10
and eax, 0x7fff
leave
ret

Function at 0x12f58
Capabilities:
Complete processing asynchronous io request

Disassembly:
push 0x14
push 0x1fc88
call fcn.0001e948
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 0xc]
mov edi, dword [esi + 0x60]
push dword [edi + 0x18]
call fcn.00012b3e
mov ebx, eax
mov eax, dword [edi + 8]
test ebx, ebx
je 0x1304a
mov ecx, dword [edi + 0x10]
mov dword [ebp + 8], ecx
and dword [ebp - 4], 0
push 4
push eax
push ecx
call dword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp + 8], eax
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
push ecx
push dword [eax]
push dword [eax + 4]
call dword [sym.imp.ntoskrnl.exe_ProbeForWrite]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, dword [ebx + 8]
jb 0x1300f
push ecx
push 0
push dword [eax + 4]
call sub.ntoskrnl.exe_memset
push dword [ebx + 8]
push dword [ebx + 4]
mov eax, dword [ebp + 8]
push dword [eax + 4]
call sub.ntoskrnl.exe_memcpy
add esp, 0x18
and dword [esi + 0x18], 0
mov eax, dword [ebx + 8]
mov dword [esi + 0x1c], eax
push dword [edi + 0x18]
call fcn.00012b82
xor edi, edi
mov dl, 2
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, edi
jmp 0x1305f
mov eax, 0xc0000023
mov dword [esi + 0x18], eax
and dword [esi + 0x1c], 0
mov edi, eax
jmp 0x13001
inc byte [esi + 0x23]
add dword [esi + 0x60], 0x24
mov edx, esi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xc]
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
call fcn.0001e98d
ret 8
Function at 0x1337a
Capabilities:
Complete processing asynchronous io request

Disassembly:
push 0x2c
push 0x1fcd0
call fcn.0001e948
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x60]
mov edx, eax
mov dword [ebp - 0x34], edx
mov byte [ebp - 0x19], 1
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ebx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x28]
mov dword [ebp + 8], ecx
cmp byte [0x24930], bl
jne 0x1354e
cmp byte [section..data], bl
jne 0x1354e
cmp byte [0x24e3e], 1
jne 0x1354e
mov edi, dword [edx + 0x10]
mov dword [ebp - 4], ebx
push 4
push dword [ebp - 0x30]
push edi
call dword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov dword [ebp - 4], 0xfffffffe
mov ebx, dword [edi]
mov dword [ebp - 0x28], ebx
mov eax, dword [edi + 8]
mov dword [ebp - 0x2c], eax
xor eax, eax
inc eax
mov dword [ebp - 4], eax
push eax
push dword [ebx]
push dword [ebx + 4]
call dword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov dword [ebp - 4], 0xfffffffe
jmp 0x13448
cmp byte [ebp - 0x19], 1
je 0x13460
inc byte [esi + 0x23]
add dword [esi + 0x60], 0x24
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
jmp 0x1355a
xor edi, edi
cmp ebx, edi
je 0x13478
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebx]
push dword [ebx + 4]
call fcn.00017ea0
cmp dword [ebp - 0x24], edi
je 0x134e7
cmp dword [ebp - 0x20], edi
je 0x134e7
push dword [ebp - 0x20]
push dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
push dword [eax + 0x18]
call fcn.00012aa4
cmp dword [ebp - 0x2c], edi
je 0x134b5
mov dword [esi + 0x18], edi
cmp ebx, edi
je 0x134a4
mov eax, dword [ebx]
mov dword [esi + 0x1c], eax
mov dl, 2
mov ecx, esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
xor eax, eax
jmp 0x13562
cmp ebx, edi
je 0x1344e
push dword [ebx]
push edi
push dword [ebx + 4]
call sub.ntoskrnl.exe_memset
add esp, 0xc
cmp dword [ebx], 0x20
jl 0x1344e
push 8
pop ecx
mov esi, str.HEAD__index.htm_HTTP_1.1_r_n_r_n
mov edi, dword [ebx + 4]
rep movsd dword es:[edi], dword [esi]
mov dword [ebx], 0x1c
mov esi, dword [ebp + 0xc]
jmp 0x1344e
cmp ebx, edi
je 0x134fd
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebx]
push dword [ebx + 4]
call fcn.00017ec4
cmp dword [ebp - 0x24], edi
je 0x1344e
cmp dword [ebp - 0x20], edi
je 0x13536
cmp ebx, edi
je 0x13536
mov eax, dword [ebx]
cmp eax, dword [ebp - 0x20]
jb 0x13536
push eax
push edi
push dword [ebx + 4]
call sub.ntoskrnl.exe_memset
mov eax, dword [ebp - 0x20]
mov dword [ebx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebx + 4]
call sub.ntoskrnl.exe_memcpy
add esp, 0x18
cmp dword [ebp - 0x24], edi
je 0x1344e
push edi
push dword [ebp - 0x24]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x1344e
add eax, 0x24
inc byte [esi + 0x23]
mov dword [esi + 0x60], eax
mov ecx, dword [ecx + 0xc]
mov edx, esi
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
call fcn.0001e98d
ret 8