joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53fb88
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x53fd3b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
xor ebx, ebx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406a04
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00406a3c
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
test edi, edi
jne 0x53fce4
cmp dword [ebp - 0x14], 4
jne 0x53fc5d
mov dword [ebp - 0x1c], 0xffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00406a3c
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
test edi, edi
jne 0x53fc3e
mov eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov bl, 1
jmp 0x53fcfe
lea edx, [ebp - 0x2c]
mov eax, edi
call fcn.004707a4
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
mov edx, 0x53fd5c
call fcn.00406e84
jmp 0x53fcfe
cmp dword [ebp - 0x14], 0xb
jne 0x53fcc3
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0xffffffff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00406a3c
push eax
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
test edi, edi
jne 0x53fca7
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov bl, 1
jmp 0x53fcfe
lea edx, [ebp - 0x30]
mov eax, edi
call fcn.004707a4
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 4]
mov edx, 0x53fd8c
call fcn.00406e84
jmp 0x53fcfe
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.004709e8
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 4]
mov edx, 0x53fdbc
call fcn.00406e84
jmp 0x53fcfe
lea edx, [ebp - 0x38]
mov eax, edi
call fcn.004707a4
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 4]
mov edx, 0x53fde4
call fcn.00406e84
test bl, bl
jne 0x53fd18
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00406e84
mov eax, dword [ebp - 0x3c]
call fcn.0053f390
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53fd42
lea eax, [ebp - 0x3c]
mov edx, 5
call fcn.004069a8
lea eax, [ebp - 4]
call fcn.004069a0
ret
Function at 0x53fe0c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.0053f430
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00406a3c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x53fe6b
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x62f67c]
mov dl, 1
mov eax, dword [0x53f280]
call fcn.004778b8
call fcn.004051f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x53fea8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x540003
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
call fcn.0053f430
mov dword [ebp - 0xc], eax
mov eax, esi
xor edx, edx
call fcn.004069b0
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x53fefd
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
jmp 0x53ff00
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
dec eax
sub al, 2
jae 0x53ff0f
add dword [ebp - 0x10], 2
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x53fe74]
call fcn.00408440
add esp, 4
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.00403a80
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, edi
call fcn.00406a3c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov ebx, eax
test ebx, ebx
jne 0x53ff65
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00406b5c
mov edx, dword [esi]
mov eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x53ff78
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x802
jle 0x53ffcd
mov eax, edx
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x53ff90
sub esi, 4
mov esi, dword [esi]
push 0x540020
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.004707a4
push dword [ebp - 0x1c]
push 0x540060
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.004707a4
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00406f68
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dl, 1
call fcn.0053f368
mov eax, dword [ebp - 0xc]
call fcn.0053f460
mov edx, dword [ebp + 0xc]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54000a
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004069a8
lea eax, [ebp - 4]
mov edx, dword [0x53fe74]
call fcn.00408560
ret
Function at 0x5470d4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x547102
mov eax, ebx
call fcn.00547b88
cmp dword [ebx + 0x40], 0
je 0x5470fb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x547173
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x547165
cmp dword [ebx + 8], 0
je 0x547124
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x547136
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x547165
cmp dword [ebx + 8], 0
je 0x547117
cmp eax, 3
je 0x547149
dec eax
jne 0x547117
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x547117
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x547117
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x547191
cmp dword [ebx + 0x14], 0xcc
je 0x547191
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0054719c
pop ebx
ret

Function at 0x557bec
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov eax, 8
call fcn.004030ac
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x557c59
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax], ebx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp - 8]
push eax
push 0x5579e0
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x557c3a
mov byte [ebp - 1], 1
jmp 0x557c3e
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x557c60
mov edx, 8
mov eax, dword [ebp - 8]
call fcn.004030c8
ret

Function at 0x557f3c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, edx
mov ebp, eax
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
mov edi, esi
xor eax, eax
call fcn.00557bec
test al, al
jne 0x557f65
test bl, bl
je 0x557fa7
call fcn.00557e2c
test al, al
je 0x557fa7
push 0x64
call sub.kernel32.dll_Sleep_2
xor eax, eax
call fcn.00557bec
test al, al
jne 0x557f84
test bl, bl
je 0x557f8d
call fcn.00557e2c
test al, al
je 0x557f8d
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
jmp 0x557f9e
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
imul edx, ebp, 0x3e8
cmp eax, edx
jae 0x557fa7
push 0x64
call sub.kernel32.dll_Sleep_2
jmp 0x557f6c
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
sub esi, edi
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x55836c
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406998
mov eax, dword [ebp - 8]
call fcn.00406998
xor eax, eax
push ebp
push 0x55840b
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00406a3c
push eax
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x5583eb
push 4
mov eax, dword [ebp - 8]
call fcn.00406a3c
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov edi, eax
test edi, edi
jbe 0x5583e1
lea eax, [ebp - 0x24]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x5583db
mov esi, dword [ebp - 0x20]
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov ebx, esi
jmp 0x5583f0
mov ebx, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x558412
lea eax, [ebp - 8]
mov edx, 2
call fcn.004069a8
ret

Function at 0x558484
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406998
xor eax, eax
push ebp
push 0x558568
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, 0xfffffffe
push 0xf003f
push 0
push 0x558578
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
je 0x558552
push 0x23
mov eax, dword [ebp - 4]
call fcn.00406a3c
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
je 0x55854c
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push esi
call sub.advapi32.dll_QueryServiceConfigW
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
jne 0x558523
mov eax, dword [ebp - 0x10]
call fcn.00403094
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.advapi32.dll_QueryServiceConfigW
mov eax, dword [ebp - 0xc]
mov edi, dword [eax + 4]
mov eax, dword [ebp - 0xc]
call fcn.004030c8
cmp edi, 4
jne 0x558546
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
push 0xffffffffffffffff
push esi
call sub.advapi32.dll_ChangeServiceConfigW
test eax, eax
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55856f
lea eax, [ebp - 4]
call fcn.004069a0
ret
Function at 0x55857c
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406998
mov eax, dword [ebp - 8]
call fcn.00406998
xor eax, eax
push ebp
push 0x558684
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x28], eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00406a3c
push eax
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x558662
push 0x14
mov eax, dword [ebp - 8]
call fcn.00406a3c
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x55865c
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceW
test eax, eax
je 0x558656
lea eax, [ebp - 0x2c]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x558656
xor edi, edi
jmp 0x558650
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
cmp edi, 0xc8
ja 0x558656
cmp dword [ebp - 0x14], 0x64
jbe 0x558628
push 0x32
call sub.kernel32.dll_Sleep_1
add edi, 0x32
jmp 0x558634
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_Sleep_1
add edi, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x558656
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
jb 0x558656
cmp dword [ebp - 0x18], 0
je 0x558656
cmp dword [ebp - 0x28], 4
jne 0x558608
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x28], 4
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55868b
lea eax, [ebp - 8]
mov edx, 2
call fcn.004069a8
ret
Function at 0x558804
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
mov dword [ebp - 4], 1
xor edx, edx
push ebp
push 0x5589b2
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x120]
xor ecx, ecx
mov edx, 0x11c
call fcn.00403a80
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
lea eax, [ebp - 0x144]
xor ecx, ecx
mov edx, 0x24
call fcn.00403a80
push 0x5589c8
push 0x5589f0
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409db4
test eax, eax
je 0x558883
lea edx, [ebp - 0x144]
push edx
call eax
jmp 0x55888f
lea eax, [ebp - 0x144]
push eax
call sub.kernel32.dll_GetSystemInfo_1
cmp dword [ebp - 0x110], 2
jne 0x5589a8
mov eax, dword [ebp - 0x11c]
add eax, 0xfffffffd
sub eax, 2
jae 0x5588b1
mov dword [ebp - 4], 2
cmp dword [ebp - 0x11c], 5
jne 0x5588cf
cmp dword [ebp - 0x118], 0
jne 0x5588cf
mov dword [ebp - 4], 3
jmp 0x5589a8
cmp dword [ebp - 0x11c], 5
jne 0x5588ed
cmp dword [ebp - 0x118], 1
jne 0x5588ed
mov dword [ebp - 4], 4
jmp 0x5589a8
cmp dword [ebp - 0x11c], 5
jne 0x558927
cmp dword [ebp - 0x118], 2
jne 0x558927
cmp byte [ebp - 6], 1
jne 0x55891b
cmp word [ebp - 0x144], 9
jne 0x55891b
mov dword [ebp - 4], 4
jmp 0x5589a8
mov dword [ebp - 4], 5
jmp 0x5589a8
cmp dword [ebp - 0x11c], 6
jne 0x558942
cmp dword [ebp - 0x118], 0
jne 0x558942
mov dword [ebp - 4], 6
jmp 0x5589a8
cmp dword [ebp - 0x11c], 6
jne 0x55895d
cmp dword [ebp - 0x118], 1
jne 0x55895d
mov dword [ebp - 4], 7
jmp 0x5589a8
cmp dword [ebp - 0x11c], 6
jne 0x55897d
mov eax, dword [ebp - 0x118]
add eax, 0xfffffffe
sub eax, 2
jae 0x55897d
mov dword [ebp - 4], 8
jmp 0x5589a8
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jne 0x55899c
mov edx, dword [ebp - 0x118]
sub edx, 4
jne 0x55899c
mov dword [ebp - 4], 0xa
jmp 0x5589a8
cmp eax, 0xa
jne 0x5589a8
mov dword [ebp - 4], 0xa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5589bc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x558a14
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x558a1d
mov eax, dword [ebp - 4]
add esp, 0xffffffd8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x558bec
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x558bc7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x558c08
xor eax, eax
call fcn.0055841c
test al, al
je 0x558aa3
mov edx, 2
mov eax, 0x558c08
call fcn.00558484
mov edx, 0x558c08
xor eax, eax
call fcn.0055857c
xor ebx, ebx
jmp 0x558a93
push 0x3e8
call sub.kernel32.dll_Sleep_2
inc ebx
cmp ebx, 0xa
jae 0x558aa3
mov edx, 0x558c08
xor eax, eax
call fcn.00558304
test al, al
je 0x558a83
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 6
jg 0x558ac7
mov dword [ebp - 0x28], 0x1779
xor eax, eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 8]
mov edx, 0x558c08
call fcn.00406a04
jmp 0x558ae2
mov dword [ebp - 0x28], 0x1b59
mov dword [ebp - 0x2c], 0x44d
lea eax, [ebp - 8]
mov edx, 0x558c28
call fcn.00406a04
push 0x558c60
push 0
call sub.advapi32.dll_OpenEventLogW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x558bbd
mov byte [ebp - 0x21], 0
lea eax, [ebp - 0x1002c]
xor ecx, ecx
mov edx, 0x10000
call fcn.00403a80
jmp 0x558b8b
lea ebx, [ebp - 0x1002c]
jmp 0x558b76
mov eax, dword [ebx + 0x10]
call fcn.00558714
fstp qword [ebp - 0x20]
wait
lea eax, [ebp - 4]
mov edx, edi
add edx, 0x38
call fcn.00406b5c
mov eax, dword [ebx + 0x14]
call fcn.00558a0c
mov esi, eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0046ff38
test al, al
je 0x558b70
cmp esi, dword [ebp - 0x28]
jne 0x558b70
movzx eax, word [ebx + 0x1c]
cmp eax, dword [ebp - 0x2c]
jne 0x558b70
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov dword [eax - 0x10], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax - 0xc], edx
mov byte [ebp - 0x21], 1
jmp 0x558b85
mov eax, dword [ebx]
add eax, ebx
mov ebx, eax
lea eax, [ebp - 0x1002c]
add eax, dword [ebp - 0x10]
mov edi, ebx
cmp eax, edi
ja 0x558b1b
cmp byte [ebp - 0x21], 0
jne 0x558bb4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x10000
lea eax, [ebp - 0x1002c]
push eax
push 0
push 9
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ReadEventLogW
test eax, eax
jne 0x558b13
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseEventLog
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x558bd1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x558bf3
lea eax, [ebp - 8]
mov edx, 2
call fcn.004069a8
ret
Function at 0x558d70
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x558e0a
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x558d8f
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x558e20
dec edx
je 0x558e55
jmp 0x558ea6
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x558ea6
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x558f88
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x558fa7
add edx, 3
sar edx, 2
test edx, edx
jle 0x5590b5
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x558fdc
je 0x55901f
sub ecx, 0x2b
je 0x559015
sub ecx, 4
je 0x55901a
dec ecx
sub ecx, 0xa
jb 0x559007
jmp 0x559022
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x558fee
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x558ff9
jmp 0x559022
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x559022
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x559022
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x559022
mov byte [eax], 0x3e
jmp 0x559022
mov byte [eax], 0x3f
jmp 0x559022
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x558fbf
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x559073
cmp byte [esp + 7], 0xff
jne 0x559073
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x5590aa
cmp dl, 0xff
je 0x5590aa
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x558fb6
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x559c1c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x559c3d
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x559c2a
pop edi
pop esi
pop ebx
ret

Function at 0x55ac64
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, dl
dec ebx
test ebx, ebx
jb 0x55acb8
inc ebx
xor edx, edx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x622dc4]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x6231c4]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x6235c4]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x6239c4]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x55ac72
pop edi
pop esi
pop ebx
ret