joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4267e0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4420a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x20000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x4268a9
push 0x34
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x426835
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004308d0
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push esi
call ebx
test eax, eax
je 0x42689c
cmp dword [ebp - 0x1c], 4
jne 0x4268a8
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x42689c
lea eax, [ebp - 0x20]
push eax
push esi
call ebx
cmp eax, 1
jne 0x4268a8
lea ebx, [ebx]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1c], 1
je 0x42689c
lea eax, [ebp - 0x20]
push eax
push esi
call ebx
cmp eax, 1
je 0x426870
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004308d0
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004308d0
mov esp, ebp
pop ebp
ret
Function at 0x4279d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x427a13
mov ecx, dword [0x44381c]
push str.RunProcess
call fcn.00423ea0
lea eax, [ebp + 8]
push str.EXPLORER.EXE
push eax
call fcn.00426520
mov ecx, dword [0x44381c]
add esp, 8
test eax, eax
jne 0x427a1a
push str.GetTokenByName_False
call fcn.00423ea0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push str.GetTokenByName_True
call fcn.00423ea0
push 0x44
lea eax, [ebp - 0x54]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x54], 0x44
lea eax, [ebp - 0x10]
mov dword [ebp - 0x4c], str.winsta0default
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov ecx, dword [0x44381c]
mov esi, eax
push str.GetTokenByName_True
call fcn.00423ea0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x427a90
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x4420a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x427b14
push 0x7f
push eax
mov byte [ebp - 0x84], al
lea eax, [ebp - 0x83]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x84]
push str.SERVICE:OpenSCManager_failed__error_code___d_n
push eax
call fcn.00402a10
mov ecx, dword [0x44381c]
lea eax, [ebp - 0x84]
add esp, 0xc
push eax
call fcn.00423ea0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004308d0
mov esp, ebp
pop ebp
ret
push 0xf01ff
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x427b6e
push 0x7f
push eax
mov byte [ebp - 0x84], al
lea eax, [ebp - 0x83]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x84]
push str.SERVICE:OpenService_failed__error_code___d_n
push eax
call fcn.00402a10
mov ecx, dword [0x44381c]
lea eax, [ebp - 0x84]
add esp, 0xc
push eax
call fcn.00423ea0
jmp 0x427bec
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x427b9e
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004308d0
mov esp, ebp
pop ebp
ret
push 0x7f
lea eax, [ebp - 0x83]
mov byte [ebp - 0x84], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x84]
push str.SERVICE:StartService_failed__error_code___d_n
push eax
call fcn.00402a10
mov ecx, dword [0x44381c]
lea eax, [ebp - 0x84]
add esp, 0xc
push eax
call fcn.00423ea0
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004308d0
mov esp, ebp
pop ebp
ret
Function at 0x429260
Capabilities:
Delete file
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x4420a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x4292d7
push 0x7f
push eax
mov byte [ebp - 0x84], al
lea eax, [ebp - 0x83]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x84]
push str.SERVICR:OpenSCManager_failed__error_code___d_n
push eax
call fcn.00402a10
mov ecx, dword [0x44381c]
lea eax, [ebp - 0x84]
add esp, 0xc
push eax
call fcn.00423ea0
jmp 0x4293b4
push edi
push 0xf01ff
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x429338
push 0x7f
push eax
mov byte [ebp - 0x84], al
lea eax, [ebp - 0x83]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x84]
push str.SERVICE:OpenService_failed__error_code___d_n
push eax
call fcn.00402a10
mov ecx, dword [0x44381c]
lea eax, [ebp - 0x84]
add esp, 0xc
push eax
call fcn.00423ea0
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4293b0
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push 0x7f
test eax, eax
mov byte [ebp - 0x84], 0
push 0
lea eax, [ebp - 0x83]
push eax
jne 0x42937b
call sub.MSVCR120.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
lea eax, [ebp - 0x84]
push str.SERVICE:Failed_to_delete_service__s__error_code___d_n
push eax
call fcn.00402a10
add esp, 0x10
jmp 0x429395
call sub.MSVCR120.dll_memset
push ebx
lea eax, [ebp - 0x84]
push str.SERVICE:Service__s_removed_n
push eax
call fcn.00402a10
add esp, 0x18
mov ecx, dword [0x44381c]
lea eax, [ebp - 0x84]
push eax
call fcn.00423ea0
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop edi
push 0x443600
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004308d0
mov esp, ebp
pop ebp
ret
Function at 0x42bb90
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b0
mov eax, dword [0x4420a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
call dword [sym.imp.MSVCR120.dll__time64]
mov dword [ebp - 0x2b0], eax
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x2a8]
mov dword [ebp - 0x2ac], edx
push eax
call dword [sym.imp.MSVCR120.dll__localtime64_s]
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call sub.MSVCR120.dll_memset
push dword [ebp - 0x2a8]
mov eax, dword [ebp - 0x298]
push dword [ebp - 0x2a4]
inc eax
push dword [ebp - 0x2a0]
push dword [ebp - 0x29c]
push eax
mov eax, dword [ebp - 0x294]
add eax, 0x76c
push eax
push str.__d__d__d_____02d_:__02d_:__02d_
lea eax, [ebp - 0x84]
push 0x80
push eax
call dword [sym.imp.MSVCR120.dll_sprintf_s]
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x84]
add esp, 0x3c
push eax
call esi
push 0x200
lea eax, [ebp - 0x284]
push 0
push eax
call sub.MSVCR120.dll_memset
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x284]
push 0x200
push eax
call dword [sym.imp.MSVCR120.dll_vsprintf_s]
add esp, 0x1c
cmp eax, 0x1ff
jae 0x42bc73
lea eax, [ebp - 0x284]
push eax
jmp 0x42bc76
push dword [ebp + 8]
call esi
push 0x4386ac
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004308d0
mov esp, ebp
pop ebp
ret
Function at 0x42e960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4420a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20b]
push 0x103
push 0
push eax
mov dword [ebp - 0x230], 0x104
mov dword [ebp - 0x22c], 0x104
mov byte [ebp - 0x20c], 0
call sub.MSVCR120.dll_memset
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0x18
lea eax, [ebp - 0x228]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsDroid4X.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42ea1f
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x108]
push eax
push 0
push 0
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x42ea30
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004308d0
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x108], 0
jne 0x42ea3d
xor ecx, ecx
jmp 0x42ea4f
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42ea46
sub ecx, edx
push ecx
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.00406720
push 1
push 0xffffffffffffffff
push 0x438bd4
mov ecx, esi
call fcn.00414c10
cmp eax, 0xffffffff
je 0x42eaa4
inc eax
mov ecx, esi
push eax
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.00414cf0
push eax
mov ecx, esi
call fcn.00404460
cmp dword [ebp - 0x210], 0x10
jb 0x42eaa4
push dword [ebp - 0x224]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004308d0
mov esp, ebp
pop ebp
ret
Function at 0x42ead0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43645b
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x4420a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
lea eax, [ebp - 0x12c]
mov dword [ebp - 4], 0
push eax
call fcn.0042e960
add esp, 4
lea ecx, [ebp - 0x12c]
push 0xa
push str.config.ini
call fcn.004063e0
cmp dword [ebp - 0x118], 0x10
lea eax, [ebp - 0x12c]
cmovae eax, dword [ebp - 0x12c]
push eax
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0x43778c
push 0x439934
push str.Droid4X_version
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x114], 0
jne 0x42eba0
xor ecx, ecx
jmp 0x42ebb9
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42ebb0
sub ecx, edx
push ecx
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
call fcn.00406720
cmp dword [ebp - 0x118], 0x10
jb 0x42ebdf
push dword [ebp - 0x12c]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004308d0
mov esp, ebp
pop ebp
ret
Function at 0x42eef0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436563
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x4420a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x168], esi
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
lea eax, [ebp - 0x160]
mov dword [ebp - 4], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 0x160], 0
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0
push eax
je 0x42ef86
push 0x101
jmp 0x42ef88
push 1
push 0
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42efb1
lea eax, [ebp - 0x12c]
mov ecx, esi
push eax
call fcn.004032d0
jmp 0x42f089
sub esp, 0x18
mov eax, esp
mov dword [eax], vtable.._AV___Func_impl_U___Callable_obj_V_lambda_abcf92e62e237e9c0dab7fbfdf9ed2d1____0A__std__V__allocator_V___Func_class_X___V_std___2_X___V_std__.0
lea ecx, [ebp - 0x150]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x14c]
mov dword [eax + 0x10], eax
mov byte [ebp - 4], 1
call fcn.0040d500
push 0x104
lea eax, [ebp - 0x114]
mov byte [ebp - 4], 3
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x15c], 0x103
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x158], 1
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x158]
push eax
push 0
push str.MachineGuid
push dword [ebp - 0x150]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42f062
cmp byte [ebp - 0x114], al
jne 0x42f03d
xor ecx, ecx
jmp 0x42f04f
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42f046
sub ecx, edx
push ecx
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x12c]
call fcn.00406720
lea eax, [ebp - 0x12c]
mov ecx, esi
push eax
call fcn.004032d0
lea ecx, [ebp - 0x14c]
mov dword [ebp - 0x154], 1
mov byte [ebp - 4], 1
call fcn.0040d920
cmp dword [ebp - 0x118], 0x10
jb 0x42f0a0
push dword [ebp - 0x12c]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004308d0
mov esp, ebp
pop ebp
ret
Function at 0x42f360
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43662b
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x4420a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x118], 0xf
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], 0
lea eax, [ebp - 0x12c]
mov dword [ebp - 4], 0
push eax
call fcn.0042e960
add esp, 4
lea ecx, [ebp - 0x12c]
push 0xb
push str.Partners.db
call fcn.004063e0
cmp dword [ebp - 0x118], 0x10
lea eax, [ebp - 0x12c]
cmovae eax, dword [ebp - 0x12c]
push eax
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0x43778c
push 0x43981c
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x114], 0
jne 0x42f430
xor ecx, ecx
jmp 0x42f449
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42f440
sub ecx, edx
push ecx
lea eax, [ebp - 0x114]
mov ecx, esi
push eax
call fcn.00406720
cmp dword [ebp - 0x118], 0x10
jb 0x42f46f
push dword [ebp - 0x12c]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004308d0
mov esp, ebp
pop ebp
ret
Function at 0x5e6b2af9
Capabilities:
Set thread local storage value

Disassembly:
push esi
test word [0x610d5f4d], 0x3069
jno 0x5e6b2b25
push edx
pushal
sub dword [ebp - 0x7e], edx
scasb al, byte es:[edi]
and ebp, ecx
xor eax, dword [0x94c557d7]
dec ebx
xor dword [ebx], 0x9d30e7ef
outsb dx, byte [esi]
test byte [ecx], al
push esi
int 0x27
and byte [esi + 0x69], ah
invalid
mov esi, ecx
test word [0x60ffaca2], 0x64aa
je 0x5e714ed9
push edi
mov edi, dword [esi]
push ecx
mov ecx, edi
and ecx, edi
pop ecx
je 0x5e6b2b7d
push ebx
mov eax, eax
mov ebx, dword [esi + 4]
nop
nop
nop
jmp 0x5e6b2b5c
push 0
nop
nop
push 1
mov ecx, edi
call fcn.5e6b4aa6
add edi, 0x18
push ecx
mov ecx, edi
sub ecx, ebx
pop ecx
jne 0x5e6b2b4c
mov ecx, ecx
push dword [esi]
call fcn.5e6d68f8
mov eax, eax
xor eax, eax
pop ecx
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
nop
nop
pop ebx
pop edi
pop esi
ret
push dword [ebp + 0xc]
push dword [ebp + 8]
je 0x5e714ee5
call eax
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop ebp
nop
ret

Function at 0x5e6b2b80
Capabilities:
Encode data using base64
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
nop
nop
mov ebp, esp
test byte [0x60fe67ee], 0x83
jns 0x5e6bee0f
mov eax, dword [ebp + 8]
push edx
mov edx, eax
sub edx, dword [ecx + 0x10]
pop edx
ja 0x5e6b2bb5
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], eax
jb 0x5e6b2ba9
mov ecx, dword [ecx]
nop
nop
nop
mov byte [ecx + eax], 0
nop
nop
nop
jmp 0x5e6b2bc7
nop
nop
push dword [ebp + 0xc]
mov ecx, ecx
sub eax, dword [ecx + 0x10]
mov eax, eax
push eax
call fcn.5e6b2bfc
pop ebp
mov ecx, ecx
ret 8
jb 0x5e6bee90
invalid
Function at 0x5e6b9771
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
nop
push ebx
push esi
nop
push edi
cmp byte [0x60fd8226], 0xc5
jne 0x5e6eee0e
mov edi, edx
mov esi, ecx
nop
nop
xor ecx, ecx
mov ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [edi + 0x10], ecx
jne 0x5e6b97ac
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ecx
mov byte [esi], cl
jmp 0x5e6b98c5
cmp dword [edi + 0x14], 8
jb 0x5e6b97b6
mov eax, dword [edi]
jmp 0x5e6b97b8
mov eax, edi
push ecx
push ecx
push ecx
nop
nop
push ecx
cmp word [0x61076d23], 0x438d
jns 0x5e6b97ed
jnp 0x5e6b9831
add esp, dword [eax + eax*4 + 0x3e]
lodsd eax, dword ss:[esi]
sub dword [0x7b29555b], ebp
les ecx, [eax + 0x43b428d5]
sbb eax, 0xe4eddbbd
call 0xa4f723c4
or al, 0xe5
out dx, eax
test eax, 0x1077ff0d
push dword [edi + 0x10]
push eax
test dword [0x60fd9b41], 0xbea031a5
je 0x5e6f5188
push ecx
mov ecx, ecx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop
nop
mov ebx, eax
push edx
mov edx, ebx
and edx, ebx
pop edx
jne 0x5e6b982e
push 0x610e79cc
mov ecx, esi
mov eax, eax
call fcn.5e6b5217
jmp 0x5e6b98c5
xor eax, eax
mov dword [ebp - 8], 0xf
push eax
cmp dword [0x610d21cc], 0x16f7bc4f
js 0x5e72a716
inc ebp
clc
sldt word [eax]
add byte [eax - 0x7f], dl
cmp eax, 0x610d21cc
dec edi
mov esp, 0x880f16f7
into
push cs
pop es
add byte [ebx - 0x73], dl
dec ebp
in al, 0x89
inc ebp
hlt
push ebx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0xc], eax
test byte [0x6106980e], 0xfd
jns 0x5e6f18b9
mov byte [ebp - 0x1c], al
call fcn.5e6ba37d
push ecx
mov ecx, dword [ebp - 8]
sub ecx, 0x10
pop ecx
lea eax, [ebp - 0x1c]
mov ecx, dword [edi + 0x10]
cmovae eax, dword [ebp - 0x1c]
cmp dword [edi + 0x14], 8
jb 0x5e6b987e
mov edi, dword [edi]
push 0
mov ecx, ecx
push 0
push ebx
push eax
mov eax, eax
push ecx
push edi
nop
nop
nop
xor ebx, ebx
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x1c]
mov ecx, ecx
mov dword [esi + 0x14], 0xf
mov ecx, ecx
mov dword [esi + 0x10], ebx
mov ecx, esi
nop
nop
push eax
mov byte [esi], bl
call fcn.5e6b3e7d
push ebx
push 1
mov ecx, ecx
lea ecx, [ebp - 0x1c]
call fcn.5e6b4e3e
nop
pop edi
mov eax, esi
nop
nop
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi + 4], ecx
pop edi
pop esi
pop ebp
nop
nop
nop
ret 4
mov edi, eax
test dword [0x61081b6f], 0xa204471
je 0x5e714e41
pop ecx
test edi, edi
je 0x5e6f51c0
lea eax, [ebx - 1]
test eax, eax
js 0x5e6f51c4
mov ecx, ecx
lea ecx, [edi + 8]
nop
nop
nop
xor edx, edx
dec eax
mov dword [ecx - 8], edx
mov dword [ecx - 4], edx
mov byte [ecx], dl
lea ecx, [ecx + 0x10]
jns 0x5e6f51b0
jmp 0x5e6f51c4
nop
nop
xor edi, edi
mov ecx, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x5e6f51dc
shl eax, 4
push eax
push dword [esi]
push edi
call fcn.5e710a24
add esp, 0xc
nop
nop
nop
push dword [esi]
call fcn.5e6d68f8
pop ecx
mov dword [esi], edi
pop edi
mov dword [esi + 8], ebx
pop ebx
pop esi
ret
mov eax, dword [0x610f081a]
xor eax, dword [0x610e8864]
je 0x5e714e58
nop
nop
nop
push dword [ebp + 8]
call eax
pop ebp
ret
nop
nop
pop ebp
mov ecx, ecx
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea ecx, [ebp - 0x348]
jmp fcn.5e7083ce
Function at 0x5e6beb8b
Capabilities:
Encode data using base64
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, 0x5e7299f5
call fcn.5e711585
cmp dword [0x6107a055], 0xe98a34c
je 0x5e6b2bf3
sub esp, 0x158
push ebx
push esi
cmp word [0x6107a8da], 0x9ce
jne 0x5e72a59e
push dword [ebp + 0xc]
mov esi, ecx
test dword [0x61077a6c], 0x32a0ec08
jo 0x5e6cdf18
mov dword [ebp - 0x14], esi
mov eax, eax
call fcn.5e6c8adc
mov ebx, dword [ebp + 8]
pop ecx
push edx
mov edx, ebx
sub edx, 0xffffffff
pop edx
jne 0x5e6bebef
xor eax, eax
jmp 0x5e6bf25c
mov esi, dword [esi + 0xd0]
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, eax
mov byte [ebp - 0x65], 0
push edi
mov edi, 0xff
mov edx, dword [eax + 0xd4]
mov eax, dword [esi + ebx*4 + 4]
mov ecx, ecx
add edx, dword [esi + ebx*4]
sub eax, dword [esi + ebx*4]
and dword [ebp - 0x28], 0
nop
nop
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x30], edx
nop
nop
nop
mov dword [ebp - 0x2c], eax
mov eax, eax
call fcn.5e6cdc8b
nop
nop
mov byte [ebp + 0xb], 0
test eax, eax
jmp 0x5e6bf1fd
add ecx, 0x38
jmp fcn.5e6ec989
Function at 0x5e6c9a88
Capabilities:
Get thread local storage value

Disassembly:
jmp fcn.5e6be926
push ebp
mov ebp, esp
push ebx
mov bx, word [ebp + 0xc]
push edi
mov edi, ecx
cmp word [ebp + 8], bx
je 0x5e6c9b7a
add byte [eax], al
add byte [ebx - 0x67fa08f9], cl
mov bh, 1
popal
xor dword [eax - 0x7ff0c6e5], ebp
stc
dec edi
mov eax, dword [edi]
test dword [0x6101b798], 0x391ba831
jo 0x5e6beaa8
add dword [ecx + 0x31], esp
test al, 0x1b
cmp dword [edi], ecx
cmp cl, 0x4f
invalid
push esi
xor esi, esi
mov dword [ebp + 0xc], eax
push ecx
mov ecx, dword [edi + 4]
sub ecx, esi
pop ecx
jbe 0x5e6c9b77
mov eax, dword [edi]
push dword [ebp + 8]
lea eax, [eax + esi*2]
push eax
cmp dword [0x610dcd1d], 0x3e122062
jns 0x5e6c9b09
arpl dx, sp
fstp xword [ebx + 0x43]
sti
jae 0x5e6c9a9a
ror dword [0xae47ea08], cl
arpl ax, cx
wait
push ss
inc esp
in al, dx
ret 0x50a8
jo 0x5e6c9aa3
call 0xc3d649fa
rol dword [eax], 0x50
add eax, 0xf945e805
invalid
call fcn.5e6c9453
mov eax, eax
pop ecx
pop ecx
cmp word [0x61049ea4], 0x5a53
jns 0x5e6c9b3e
stosd dword es:[edi], eax
cld
jge 0x5e6c9afc
daa
frstor dword [ebp + 0x65897c99]
add al, 0x58
lea ebx, [eax + ecx*4 - 0x1eb7ffbd]
into
fidiv dword [esi]
je 0x5e6c9b94
dec ecx
cdq
cmp dword [eax + 0x4d], edi
aam 0xdd
add esi, eax
add esi, eax
test dword [0x6102af9f], 0x2bdc6cf0
je 0x5e7112dd
or ecx, 0xffffffff
push ecx
mov ecx, eax
and ecx, eax
pop ecx
cmovs esi, ecx
test esi, esi
js 0x5e6c9b77
mov eax, eax
mov eax, dword [ebp + 0xc]
mov word [eax + esi*2], bx
inc esi
push ebx
mov ebx, esi
sub ebx, dword [edi + 4]
pop ebx
jb 0x5e6c9ac2
mov eax, eax
pop esi
nop
pop edi
pop ebx
pop ebp
ret 8
rcl dword [ebx + 0x4b3314fd]
adc al, 0x33
dec ebx
outsb dx, byte [esi]
test eax, ebx
scasb al, byte es:[edi]
sub ebx, dword [eax]
sahf
pop ecx
mov eax, dword [0x1876a940]
cmp al, 0x27
loop 0x5e6c9baa
push 0xaed3b037
mov al, 0xd3
scasb al, byte es:[edi]
insb byte es:[edi], dx
xchg esi, eax
jae 0x5e6c9b91
pop edi
in eax, 0x10
cmpsb byte [esi], byte es:[edi]
add bl, byte [esi]
inc edx
inc edi
fmulp st(2)
sbb eax, 0x6964b46b
test eax, 0x4418b1e
push ecx
mov ecx, eax
and ecx, eax
pop ecx
jne 0x5e6c9bd5
or eax, 0xffffffff
mov ecx, ecx
jmp 0x5e6c9bf5
nop
mov ecx, dword [ecx]
dec eax
mov ecx, ecx
mov dx, word [ebp + 8]
lea eax, [ecx + eax*2]
jmp 0x5e6c9beb
cmp eax, ecx
je 0x5e6c9bce
sub eax, 2
cmp word [eax], dx
jne 0x5e6c9be4
sub eax, ecx
nop
sar eax, 1
nop
pop ebp
ret 4
Function at 0x5e6cec8e
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
push edi
nop
mov edx, dword [esi + 8]
test byte [0x61011975], 0x7d
jno 0x5e6cecd3
mov ah, dl
popfd
mov edi, 0xe3fc4bf2
jo 0x5e6cecfe
push ebp
retf
lea edi, [edx + 8]
push edx
mov edx, edi
sub edx, dword [esi + 4]
pop edx
ja 0x5e6cecee
mov ecx, dword [esi]
mov eax, dword [edx + ecx]
mov edx, dword [edx + ecx + 4]
mov dword [esi + 8], edi
pop edi
pop esi
ret
call fcn.5e6cfde7
int3