joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16f1e20
Capabilities:
Resume thread

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x16f1e75
mov eax, dword [esi + 8]
cmp eax, 1
lea ebp, [esi + 8]
jne 0x16f1e75
mov ecx, dword [esi + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x16f1e4d
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp eax, 1
jbe 0x16f1e6c
push edi
lea edi, [eax - 1]
test edi, edi
jbe 0x16f1e6b
lea ebx, [ebx]
mov edx, dword [esi + 4]
push edx
call ebx
sub edi, 1
jne 0x16f1e60
pop edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x16f1e81
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x16f1ecc
mov eax, dword [esi + 8]
test eax, eax
lea ebp, [esi + 8]
jne 0x16f1ecc
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x16f1ea8
pop esi
xor eax, eax
pop ebp
ret
test eax, eax
jbe 0x16f1ec3
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
mov edi, eax
mov edx, dword [esi + 4]
push edx
call ebx
sub edi, 1
jne 0x16f1eb6
pop edi
pop ebx
push 1
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
pop esi
mov eax, 1
pop ebp
ret

Function at 0x16f2140
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x16f214f
call fcn.0176dcc0
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
lea eax, [esp + 4]
push eax
push 4
push ecx
push 0x16f2130
push edx
push 0
call fcn.017b23f2
add esp, 0x18
test eax, eax
mov dword [esi + 4], eax
pop esi
je 0x16f218c
mov ecx, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 1
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
Function at 0x16fafe0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x1008
call fcn.017b03b0
mov eax, dword [0x1845170]
xor eax, esp
mov dword [esp + 0x1004], eax
mov eax, dword [esp + 0x1010]
push ebx
push ebp
mov ebp, dword [esp + 0x101c]
push esi
mov esi, dword [esp + 0x1018]
push edi
mov edi, dword [esp + 0x1028]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x16fb039
call fcn.0176dcc0
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x16fb047
xor eax, eax
jmp 0x16fb0e6
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [edi]
push eax
call fcn.017af02b
add esp, 4
cmp eax, ebx
mov dword [ebp], eax
jne 0x16fb066
call fcn.0176dcc0
cmp dword [ebp], ebx
je 0x16fb040
push 0xfff
xor edi, edi
lea ecx, [esp + 0x19]
push edi
push ecx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x20], bl
call fcn.017b03e0
add esp, 0xc
mov ecx, dword [esi]
push 0
lea edx, [esp + 0x14]
push edx
push 0x1000
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x16fb0cd
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp]
push edx
lea eax, [esp + 0x18]
push eax
add ecx, edi
push ecx
call fcn.017784b0
mov eax, dword [esp + 0x1c]
add esp, 0xc
add edi, eax
adc ebx, 0
test eax, eax
ja 0x16fb088
jmp 0x16fb0d2
call fcn.0176dcc0
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov eax, 1
mov ecx, dword [esp + 0x1014]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.017b0193
add esp, 0x1008
ret 0x10

Function at 0x16fd240
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
mov esi, ecx
call fcn.016fb450
test eax, eax
jne 0x16fd255
pop esi
ret 4
mov ecx, dword [esi + 4]
push edi
push 0
mov dword [esi + 8], ecx
push 0
mov ecx, esi
call fcn.016fb130
lea edx, [esi + 0xc]
push edx
call fcn.017b06f3
mov edi, eax
add esp, 4
cmp edi, 0xf0
jae 0x16fd28e
push 0
push 0
push str.Probably_You_have_Invalid_CountryCodeFile..
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
test edi, edi
jbe 0x16fd2aa
push 0
push 0
mov ecx, esi
call fcn.016fb130
push eax
mov ecx, esi
call fcn.016fc9e0
sub edi, 1
jne 0x16fd292
pop edi
mov eax, 1
pop esi
ret 4

Function at 0x1704440
Capabilities:
Terminate thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x1704430
lea edx, [esp + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [esp + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 4], 0xffffffff
pop esi
pop ecx
ret
jmp 0x17043f0
Function at 0x1709e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x17e75ab
mov eax, dword fs:[0]
push eax
mov eax, 0x3a58
call fcn.017b03b0
mov eax, dword [0x1845170]
xor eax, esp
mov dword [esp + 0x3a54], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1845170]
xor eax, esp
push eax
lea eax, [esp + 0x3a6c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3a7c]
mov edi, ecx
cmp word [edi + 0x24], 0
mov dword [esp + 0x18], esi
ja 0x1709ea8
call fcn.0176dcc0
lea eax, [esi + 0x1044]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [edi + 0x1c], 1
jne 0x170a07a
mov al, 0xcd
mov byte [esp + 0x3a48], al
mov byte [esp + 0x3a49], al
mov byte [esp + 0x3a4a], al
mov byte [esp + 0x3a4b], al
mov byte [esp + 0x3a4c], 0x18
mov byte [esp + 0x3a4d], 0x28
mov byte [esp + 0x3a4e], 0x43
mov byte [esp + 0x3a4f], 0xa2
mov byte [esp + 0x3a50], 5
mov byte [esp + 0x3a52], 0x75
mov byte [esp + 0x3a53], 0x52
mov byte [esp + 0x3a54], 0x32
mov byte [esp + 0x3a56], 0x99
mov byte [esp + 0x3a57], 0x47
mov byte [esp + 0x3a58], 0x3f
mov byte [esp + 0x3a59], 0x2e
mov byte [esp + 0x3a5a], al
mov byte [esp + 0x3a5b], al
mov byte [esp + 0x3a5c], 0x69
mov byte [esp + 0x3a5d], 0x11
mov byte [esp + 0x3a5e], 0x58
mov byte [esp + 0x3a5f], 0x7b
mov byte [esp + 0x3a60], 0xe3
mov byte [esp + 0x3a61], 0x5c
mov byte [esp + 0x3a63], 0x82
mov byte [esp + 0x3a64], 0x27
mov byte [esp + 0x3a65], 0x65
mov byte [esp + 0x3a66], 0xd9
mov byte [esp + 0x3a67], 0
mov byte [esp + 0x3a51], al
mov byte [esp + 0x3a55], al
mov byte [esp + 0x3a62], al
mov ecx, dword [esi + 0x1054]
movzx ebp, word [ecx]
lea ecx, [esp + 0x1c]
and ebp, 0x7fff
call fcn.01750000
mov dword [esp + 0x3a74], 0
mov dl, byte [edi + 0x24]
lea eax, [esp + 0x3a48]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x3a6b], dl
call fcn.01750020
cmp dword [esi + 0x104c], 0x10
jg 0x170a004
call fcn.0176dcc0
mov ebx, dword [esi + 0x1034]
add ebx, 0x10
cmp dword [esi + 0x104c], 0x10
jg 0x170a01b
call fcn.0176dcc0
mov ecx, dword [esi + 0x1034]
push ebx
add ecx, 0x10
push ecx
add ebp, 0xfffffff6
push ebp
lea ecx, [esp + 0x28]
call fcn.017500a0
mov ebx, 0xa
jmp 0x170a040
cmp dword [esi + 0x1048], 0
mov ecx, esi
je 0x170a057
lea edx, [esp + 0x17]
push edx
call fcn.01679210
jmp 0x170a061
lea eax, [esp + 0x17]
push eax
call fcn.01679290
sub ebx, 1
jne 0x170a040
mov dword [esp + 0x3a74], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.01750010
lea ecx, [esp + 0x18]
lea esi, [edi + 4]
push ecx
mov ecx, esi
call fcn.01709b40
mov dword [edi + 0x14], 0
mov eax, dword [esi + 4]
mov esi, dword [esi + 8]
cmp eax, esi
ja 0x170a0e4
jb 0x170a0a1
call fcn.01708520
mov edx, dword [eax]
add word [edi + 0x24], 0xffff
movzx eax, word [edi + 0x24]
xor ecx, ecx
test ax, ax
sete cl
mov dword [edi + 0x2c], edx
mov al, cl
mov ecx, dword [esp + 0x3a6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3a54]
xor ecx, esp
call fcn.017b0193
add esp, 0x3a64
ret 4
call fcn.01708590
int3
Function at 0x170ab20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x18]
push eax
push 0x40
mov esi, ecx
push edi
push esi
mov ebx, edx
call ebp
push edi
push esi
push ebx
call fcn.017b2ea0
lea eax, [ebx + edi]
mov ecx, esi
sub ecx, eax
add esp, 0xc
lea edx, [ecx + edi - 5]
mov dword [eax + 1], edx
mov edx, dword [esp + 0x18]
mov byte [eax], 0xe9
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edx
sub eax, esi
push edi
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x170afb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.kernel32
call esi
push str.ntdll
mov dword [0x1868948], eax
call esi
mov ecx, dword [0x1868948]
test ecx, ecx
mov dword [0x186894c], eax
jne 0x170afe0
mov eax, 3
pop esi
ret
test eax, eax
jne 0x170afeb
mov eax, 4
pop esi
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x180a150
push ecx
call esi
test eax, eax
mov dword [0x1868944], eax
jne 0x170b015
mov eax, dword [0x1868948]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 5
pop esi
ret
mov ecx, dword [0x1868948]
push str.LoadLibraryW
push ecx
call esi
test eax, eax
mov dword [0x1868940], eax
jne 0x170b040
mov edx, dword [0x1868948]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 6
pop esi
ret
mov eax, dword [0x186894c]
push str.LdrLoadDll
push eax
call esi
test eax, eax
mov dword [0x186893c], eax
jne 0x170b06a
mov ecx, dword [0x186894c]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 7
pop esi
ret
push 0x40
push 0x1000
push 0xa
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [0x186893c]
push 5
push 0x170af90
mov edx, eax
mov dword [0x1868938], eax
call fcn.0170ab20
xor eax, eax
pop esi
ret

Function at 0x170b4e0
Capabilities:
Hash data using djb2

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx + 0x14]
push esi
xor esi, esi
test eax, eax
push edi
mov edi, 0x1505
jbe 0x170b529
cmp esi, eax
push ebp
lea ebp, [ebx + 4]
jbe 0x170b502
call fcn.017aefad
cmp dword [ebx + 0x18], 0x10
jb 0x170b50d
mov eax, dword [ebp]
jmp 0x170b50f
mov eax, ebp
movsx eax, byte [eax + esi]
mov ecx, edi
shl ecx, 5
add ecx, edi
add eax, ecx
mov edi, eax
mov eax, dword [ebx + 0x14]
add esi, 1
cmp esi, eax
jb 0x170b502
pop ebp
mov eax, edi
pop edi
pop esi
and eax, 0x7fffffff
pop ebx
ret
Function at 0x172ad60
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x2808
call fcn.017b03b0
mov eax, dword [0x1845170]
xor eax, esp
mov dword [esp + 0x2804], eax
push ebp
mov ebp, dword [esp + 0x2814]
push esi
mov esi, dword [esp + 0x2814]
push edi
push 0x180a098
lea eax, [esp + 0x10]
push esi
push eax
mov dword [esp + 0x18], 0
call fcn.017b2e4f
mov edi, eax
add esp, 0xc
test edi, edi
je 0x172ae02
push 0x27ff
lea ecx, [esp + 0x15]
push 0
push ecx
mov byte [esp + 0x1c], 0
call fcn.017b03e0
push ebp
push edi
push esi
push str.ServerFramework::SaveRawLogToFile
push str._s__File__s__Open_Failed._ErrorCode__d___Log:__s_
lea edx, [esp + 0x30]
push 0x2800
push edx
call fcn.0167a070
add esp, 0x28
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x2804]
xor ecx, esp
call fcn.017b0193
add esp, 0x2808
ret
mov ecx, dword [esp + 0xc]
push ecx
push ebp
call fcn.017b3796
mov edx, dword [esp + 0x14]
push edx
call fcn.017b2b75
mov ecx, dword [esp + 0x281c]
add esp, 0xc
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.017b0193
add esp, 0x2808
ret

Function at 0x172ea50
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [0x1868958], 2
je 0x172ea6e
mov eax, dword [0x186981c]
test eax, eax
je 0x172eaa2
mov eax, dword [eax + 0xbc]
mov dword [0x1869728], eax
call fcn.0172e9e0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ecx, [esp]
push ecx
push 0
push 0
push 0x172e3b0
push 0
push 0
mov dword [0x1869730], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x186972c], eax
pop ecx
ret

Function at 0x1737320
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x17eab8b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1845170]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.ServerFramework::COverlapJob.0
mov dword [esp + 0x14], 0xffffffff
cmp dword [esi + 0x30], 0x10
jb 0x1737368
mov eax, dword [esi + 0x1c]
push eax
call fcn.017af9e0
add esp, 4
xor eax, eax
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], eax
mov byte [esi + 0x1c], al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x173f8c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
mov edx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov eax, edx
shr eax, 0x10
and eax, 0x7fff
test ecx, ecx
mov dword [esp], str.DISCONNECT_REASON_NETENGINE_ERROR
mov dword [esp + 4], str.DISCONNECT_REASON_INTENTIONAL_KILL
mov dword [esp + 8], str.DISCONNECT_REASON_STALE_SESSION
mov dword [esp + 0xc], str.DISCONNECT_REASON_CLOSED_BY_PEER
mov dword [esp + 0x10], str.DISCONNECT_REASON_ENGINE_SHUTDOWN
mov dword [esp + 0x14], str.DISCONNECT_OVERLAPPED
mov dword [esp + 0x18], str.DISCONNECT_SENDCOUNT
mov dword [esp + 0x1c], str.NERR_GOOD
mov dword [esp + 0x20], str.NERR_TIMEOUT
mov dword [esp + 0x24], str.NERR_UNKNOWN
mov dword [esp + 0x28], str.NERR_SESSION_LOST
mov dword [esp + 0x2c], str.NERR_BUFFER_FULL
mov dword [esp + 0x30], str.NERR_TOO_MANY_OUTSTANDING
mov dword [esp + 0x34], str.NERR_NODATA_TO_SEND
mov dword [esp + 0x38], str.NERR_NO_MSGTARGET
mov dword [esp + 0x3c], str.NERR_INVALID_SOCKET
mov dword [esp + 0x40], str.NERR_INVALID_SESSION
mov dword [esp + 0x44], str.NERR_FAILED_TO_TRANSFILE
mov dword [esp + 0x48], str.NERR_INVALID_SEQUENCE
mov dword [esp + 0x4c], str.NERR_INVALID_CHECKSUM
mov dword [esp + 0x50], str.NERR_INVALID_MSGSIZE
mov dword [esp + 0x54], str.NERR_FAILED_TO_ACCEPT
mov dword [esp + 0x58], str.NERR_INVALID_TARGET_FILE
mov dword [esp + 0x5c], str.NERR_NET_ACCESSED_BEFORE_HANDSHAKE
mov dword [esp + 0x60], str.NERR_INVALID_MSG_HEADER
mov dword [esp + 0x64], str.NERR_COMPLETION_TARGET_MISMATCH
mov dword [esp + 0x68], str.NERR_TARGET_TASK_LOST
mov dword [esp + 0x6c], str.NERR_FAILED_TO_CREATE_SESSION
mov dword [esp + 0x70], str.NERR_PEER_DOESNT_RESPONSE
je 0x173fa40
test dx, dx
jne 0x173fa07
mov edx, dword [0x1868d38]
movzx edx, word [edx]
push edx
movzx edx, word [ecx + 6]
movzx ecx, word [ecx + 4]
push edx
push ecx
mov ecx, dword [esp + 0x84]
movzx edx, ax
mov eax, dword [esp + edx*4 + 0x28]
push eax
push str.DISCONNECT_REASON_NETENGINE_ERROR
push ecx
push str.Session_Lost___d_:__s_:__s__OutletID__d___InletID__d___MyselfID__d_
push 0x2000001
call fcn.0170b720
add esp, 0x20
add esp, 0x74
ret
mov eax, dword [0x1868d38]
movzx eax, word [eax]
push eax
movzx eax, word [ecx + 6]
movzx ecx, word [ecx + 4]
push eax
push ecx
mov ecx, dword [esp + 0x84]
movzx edx, dx
mov eax, dword [esp + edx*4 + 0xc]
push eax
push ecx
push str.Session_Lost___d_:__s__OutletID__d___InletID__d___MyselfID__d_
push 0x2000001
call fcn.0170b720
add esp, 0x1c
add esp, 0x74
ret
test dx, dx
mov ecx, dword [esp + 0x78]
jne 0x173fa6d
movzx edx, ax
mov eax, dword [esp + edx*4 + 0x1c]
push eax
push str.DISCONNECT_REASON_NETENGINE_ERROR
push ecx
push str.Session_Lost___d_:__s_:__s
push 0x2000001
call fcn.0170b720
add esp, 0x14
add esp, 0x74
ret
movzx edx, dx
mov eax, dword [esp + edx*4]
push eax
push ecx
push str.Session_Lost___d_:__s
push 0x2000001
call fcn.0170b720
add esp, 0x10
add esp, 0x74
ret
Function at 0x174d650
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x208
mov eax, dword [0x1845170]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov al, 1
mov edi, edi
movzx edx, al
mov byte [esp + edx + 0x14], cl
mov dl, al
and dl, 0x80
mov byte [esp + ecx + 0x114], al
add ecx, 1
neg dl
sbb dl, dl
mov bl, al
add bl, bl
and edx, 0x1b
xor dl, bl
xor al, dl
cmp ecx, 0x100
jl 0x174d670
mov al, 1
lea ecx, [edi + 0x2a04]
mov esi, 0xa
lea ebx, [ebx]
movzx edx, al
shl edx, 0x18
mov dword [ecx], edx
mov dl, al
and dl, 0x80
add ecx, 4
neg dl
sbb dl, dl
add al, al
and edx, 0x1b
xor al, dl
sub esi, 1
jne 0x174d6b0
mov dword [edi + 0x1790], esi
mov dword [edi + 0x204], 0x63
mov edx, 1
lea esi, [edi + 0x208]
jmp 0x174d6f0
movzx eax, byte [esp + edx + 0x14]
lea ecx, [esp + 0x213]
sub ecx, eax
mov cl, byte [ecx]
mov al, cl
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor al, cl
xor al, 0x63
movzx eax, al
mov dword [esi], eax
mov dword [edi + eax*4 + 0x1604], edx
add edx, 1
add esi, 4
cmp edx, 0x100
jl 0x174d6f0
lea ecx, [edi + 0x604]
mov dword [esp + 0x10], 0x100
lea esp, [esp]
mov dl, byte [ecx - 0x400]
mov al, dl
and al, 0x80
neg al
sbb al, al
mov bl, dl
add bl, bl
movzx edx, dl
and eax, 0x1b
xor al, bl
movzx esi, al
mov eax, esi
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, esi
xor eax, edx
mov dword [ecx], eax
ror eax, 8
mov dword [ecx + 0x400], eax
ror eax, 8
mov dword [ecx + 0x800], eax
ror eax, 8
mov dword [ecx + 0xc00], eax
mov al, byte [ecx + 0x1000]
test al, al
je 0x174d7f3
movzx edx, al
movzx esi, byte [esp + edx + 0x14]
movzx eax, byte [esp + 0x1f]
add eax, esi
cdq
mov edi, 0xff
idiv edi
movzx eax, byte [esp + 0x21]
add eax, esi
movzx ebp, byte [esp + edx + 0x114]
cdq
idiv edi
movzx eax, byte [esp + 0x1d]
add eax, esi
movzx ebx, byte [esp + edx + 0x114]
cdq
idiv edi
movzx eax, byte [esp + 0x22]
add eax, esi
mov esi, 0xff
movzx edi, byte [esp + edx + 0x114]
cdq
idiv esi
movzx eax, byte [esp + edx + 0x114]
jmp 0x174d7fb
xor ebp, ebp
xor ebx, ebx
xor edi, edi
xor eax, eax
shl eax, 8
xor eax, edi
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, ebp
mov dword [ecx + 0x1400], eax
ror eax, 8
mov dword [ecx + 0x1800], eax
ror eax, 8
mov dword [ecx + 0x1c00], eax
ror eax, 8
mov dword [ecx + 0x2000], eax
add ecx, 4
sub dword [esp + 0x10], 1
jne 0x174d740
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.017b0193
add esp, 0x208
ret
Function at 0x17505a0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x17ecb8b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1845170]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x1750627
push 8
call fcn.017b01a2
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], 0
test esi, esi
je 0x17505f3
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], edi
jmp 0x17505f5
xor esi, esi
mov dword [esp + 0x14], 0xffffffff
push 0
push 0
push esi
push 0x1750450
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1750627
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x1750700
Capabilities:
Access the windows event log

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
shr eax, 0x18
sub eax, 0
je 0x1750726
sub eax, 1
je 0x175071f
sub eax, 1
jne 0x1750726
mov eax, 1
jmp 0x175072b
mov eax, 2
jmp 0x175072b
mov eax, 4
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 1
push 0
push ecx
push 0
push eax
mov eax, dword [0x18699ec]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
xor eax, eax
ret
Function at 0x1759100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x17ed981
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x1845170]
xor eax, esp
mov dword [esp + 0x164], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1845170]
xor eax, esp
push eax
lea eax, [esp + 0x17c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18c]
xor ebx, ebx
push 0x103
lea eax, [esp + 0x79]
mov ebp, ecx
push ebx
push eax
mov dword [esp + 0x24], ebp
mov byte [esp + 0x80], bl
call fcn.017b03e0
lea ecx, [esp + 0x80]
push ecx
push esi
call fcn.0174d3e0
mov edi, eax
add esp, 0x14
cmp edi, ebx
je 0x1759238
lea eax, [esp + 0x74]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x1759193
sub eax, edx
push eax
lea edx, [esp + 0x78]
push edx
lea ecx, [esp + 0x58]
call fcn.01667500
mov dword [esp + 0x184], ebx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x70]
lea esi, [ebp + 0x1f4]
push ecx
mov ecx, esi
call fcn.017569f0
mov edx, dword [eax + 4]
mov ebp, dword [eax]
mov dword [esp + 0x20], edx
mov dword [esp + 0x184], 0xffffffff
cmp dword [esp + 0x68], 0x10
jb 0x17591f3
mov eax, dword [esp + 0x54]
push eax
call fcn.017af9e0
add esp, 4
cmp ebp, ebx
mov eax, dword [esi + 4]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
je 0x175935a
cmp ebp, esi
jne 0x175935a
cmp dword [esp + 0x20], eax
sete al
cmp al, bl
je 0x1759262
lea ecx, [esp + 0x74]
push ecx
push str.unknown_command_:__s
push 0x1000000
call fcn.0170b720
add esp, 0xc
mov ecx, dword [esp + 0x17c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.017b0193
add esp, 0x174
ret 4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x184], 1
lea edx, [esp + 0x14]
push edx
push 0x180d3ec
push edi
mov dword [esp + 0x20], ebx
call fcn.017b3cd7
add esp, 0xc
cmp eax, ebx
je 0x1759325
jmp 0x17592a0
mov edi, 0xf
mov ecx, eax
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
cmp dl, bl
jne 0x17592b6
sub ecx, esi
push ecx
push eax
lea ecx, [esp + 0x3c]
call fcn.01667500
mov byte [esp + 0x184], 2
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x28]
call fcn.016fd7b0
mov byte [esp + 0x184], 1
cmp dword [esp + 0x4c], 0x10
jb 0x17592fe
mov ecx, dword [esp + 0x38]
push ecx
call fcn.017af9e0
add esp, 4
lea edx, [esp + 0x14]
push edx
push 0x180d3ec
push ebx
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
call fcn.017b3cd7
add esp, 0xc
cmp eax, ebx
jne 0x17592a0
mov eax, dword [esp + 0x20]
cmp eax, dword [ebp + 4]
jne 0x1759333
call fcn.01754920
mov edx, dword [eax + 0x28]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x1c]
call edx
mov dword [esp + 0x184], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.016f8db0
jmp 0x1759238
call fcn.017545d0
int3