joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ec090
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x577688
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 4], eax
push ebx
mov eax, dword [0x59b000]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
cmp dword [0x598578], 0xffffffff
jne 0x4ec12c
mov dword [esp + 8], 0
call fcn.004ef2d0
push eax
lea ecx, [esp + 0xc]
call fcn.004c5cc0
cmp dword [0x598578], 0xffffffff
mov dword [esp + 0x18], 0
je 0x4ec0f4
mov bl, 1
jmp 0x4ec101
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
jne 0x4ec116
xor bl, bl
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.004c5d00
mov al, bl
jmp 0x4ec12e
lea ecx, [esp + 8]
mov dword [0x598578], eax
mov dword [esp + 0x18], 0xffffffff
call fcn.004c5d00
mov al, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0054a992
add esp, 0x14
ret

Function at 0x4ec780
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x577718
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
mov eax, dword [0x59b000]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov esi, dword [esp + 0x54]
push 0x69
call dword [eax + 4]
push 0x34
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0054b440
xorps xmm0, xmm0
mov dword [esp + 0x1c], 0xffffffff
add esp, 0xc
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], 0
mov byte [esp + 0x2c], 0
mov dword [esp + 0xc], 0x44dcac
mov byte [esp + 0x30], 0x72
mov dword [esp + 0x34], 0
movq qword [esp + 0x38], xmm0
push esi
lea ecx, [edi + 0x58]
mov dword [esp + 0x50], 0
call fcn.0050fd70
push 0
or esi, eax
lea ecx, [edi + 0x14]
mov eax, dword [esp + 0x5c]
push 8
mov dword [esp + 0x44], eax
lea eax, [esp + 0x14]
push 0xc
push eax
mov dword [esp + 0x48], esi
call fcn.00511860
test al, al
je 0x4ec86a
cmp dword [esp + 0x14], 0
jne 0x4ec86a
mov esi, 1
jmp 0x4ec86c
xor esi, esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x4c], 0xffffffff
call fcn.0050bda0
mov eax, esi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0054a992
add esp, 0x44
ret 8
Function at 0x4f7dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov dword [esi], 0x44e368
lea ecx, [esi + 0xd4]
mov eax, dword [esi + 0xd4]
push eax
push dword [eax]
lea eax, [esp + 0x10]
push eax
call fcn.004fe050
push dword [esi + 0xd4]
call fcn.00549eaf
mov edi, dword [esi + 0xc8]
add esp, 4
test edi, edi
je 0x4f7e43
push ebx
mov ebx, dword [esi + 0xcc]
cmp edi, ebx
je 0x4f7e16
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax]
add edi, 0x1c
cmp edi, ebx
jne 0x4f7e07
push dword [esi + 0xc8]
call fcn.00549eaf
add esp, 4
mov dword [esi + 0xc8], 0
mov dword [esi + 0xcc], 0
mov dword [esi + 0xd0], 0
pop ebx
mov eax, dword [esi + 0xc0]
lea ecx, [esi + 0xc0]
push eax
push dword [eax]
lea eax, [esp + 0x10]
push eax
call fcn.004fdca0
push dword [esi + 0xc0]
call fcn.00549eaf
add esp, 4
mov dword [esi + 0xa4], 0x4442f8
cmp dword [esi + 0xbc], 0x10
jb 0x4f7e8b
push dword [esi + 0xa8]
call fcn.00549eaf
add esp, 4
mov dword [esi + 0xbc], 0xf
mov dword [esi + 0xb8], 0
mov byte [esi + 0xa8], 0
mov dword [esi + 0x88], 0x4442f8
cmp dword [esi + 0xa0], 0x10
jb 0x4f7ec7
push dword [esi + 0x8c]
call fcn.00549eaf
add esp, 4
mov dword [esi + 0xa0], 0xf
mov ecx, esi
mov dword [esi + 0x9c], 0
pop edi
mov byte [esi + 0x8c], 0
pop esi
add esp, 4
jmp fcn.004dceb0
Function at 0x4ff0f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x578e78
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x59b000]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x20]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0xc], eax
mov al, byte [esp + 0x24]
mov byte [esi + 0x10], al
mov al, byte [esp + 0x28]
mov byte [esi + 0x11], al
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], 0
mov dword [esi], 0x44e48c
test eax, eax
je 0x4ff156
add eax, 4
jmp 0x4ff158
xor eax, eax
push 0xffffffffffffffff
lea ecx, [esi + 0x18]
mov dword [ecx + 0x14], 0xf
push 0
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004658c0
mov dword [esi + 0x14], 0x4442f8
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x18

Function at 0x4ff370
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x57a09b
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 0x118], eax
mov eax, dword [0x59b000]
xor eax, esp
push eax
lea eax, [esp + 0x120]
mov dword fs:[0], eax
mov eax, dword [esp + 0x130]
add eax, 4
cmp dword [eax + 0x14], 0x10
jb 0x4ff3b9
mov eax, dword [eax]
push eax
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4ff432
push 0x8c
lea eax, [esp + 0x94]
push 0
push eax
call fcn.0054b440
add esp, 0xc
call fcn.004bb040
push eax
call fcn.004bb040
push eax
call fcn.004bb040
push eax
call fcn.004bb040
push eax
push 0x47a
lea ecx, [esp + 0xa4]
call fcn.004c07f0
lea eax, [esp + 0x90]
mov dword [esp + 0x128], 0
push eax
lea ecx, [esp + 8]
call fcn.004c0700
push 0x5852cc
lea eax, [esp + 8]
push eax
call fcn.0054a9a1
mov ecx, dword [esp + 0x120]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.0054a992
add esp, 0x128
ret 4
Function at 0x4ffab0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x578f71
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 0x144], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x59b000]
xor eax, esp
push eax
lea eax, [esp + 0x15c]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x14], ebp
mov edi, dword [esp + 0x16c]
mov ebx, dword [esp + 0x170]
push 0x100
call fcn.00545ef6
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
add edi, 4
mov dword [esp + 0x164], 0
mov dword [esp + 0xc8], 0
mov dword [esp + 0xc4], 0x100
cmp dword [edi + 0x14], 0x10
jb 0x4ffb40
mov eax, dword [edi]
jmp 0x4ffb42
mov eax, edi
lea ecx, [esp + 0xc4]
push ecx
push esi
lea ecx, [esp + 0xd0]
push ecx
push 0
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
jne 0x4ffbb5
mov eax, dword [esp + 0xc4]
inc eax
push eax
call fcn.00545ef6
mov ebp, eax
add esp, 4
cmp ebp, esi
je 0x4ffb86
push esi
call fcn.00549eaf
add esp, 4
cmp dword [edi + 0x14], 0x10
mov esi, ebp
mov dword [esp + 0x18], esi
jb 0x4ffb94
mov edi, dword [edi]
lea eax, [esp + 0xc4]
push eax
push ebp
lea eax, [esp + 0xd0]
push eax
mov eax, dword [esp + 0x20]
push 0
push edi
push dword [eax + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
jne 0x4ffbf5
call fcn.004bb040
push eax
call fcn.004bb040
push eax
call fcn.004bb040
push eax
call fcn.004bb040
push eax
push 0x47b
lea ecx, [esp + 0xe0]
call fcn.004c07f0
push 0x5852cc
lea eax, [esp + 0xd0]
push eax
call fcn.0054a9a1
mov eax, dword [esp + 0xc8]
cmp eax, 1
jne 0x4ffc7f
call fcn.004bb040
push eax
mov ecx, ebx
call fcn.004ba3a0
cmp byte [esi], 0
mov edi, esi
je 0x4ffca2
lea esp, [esp]
mov al, byte [edi]
mov dword [esp + 0x34], 0xf
mov byte [esp + 0x20], al
mov dword [esp + 0x30], 1
mov byte [esp + 0x21], 0
mov dword [esp + 0x1c], 0x4442f8
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x28]
mov byte [esp + 0x16c], 1
push eax
lea ecx, [ebx + 4]
call fcn.004656b0
cmp dword [esp + 0x34], 0x10
mov byte [esp + 0x164], 0
jb 0x4ffc77
push dword [esp + 0x20]
call fcn.00549eaf
add esp, 4
inc edi
cmp byte [edi], 0
jne 0x4ffc20
jmp 0x4ffca2
cmp eax, 4
jne 0x4ffcd5
cmp dword [ebx + 0x18], 0x10
lea eax, [ebx + 4]
mov dword [eax + 0x10], 0
jb 0x4ffc96
mov eax, dword [eax]
mov byte [eax], 0
mov ecx, ebx
push dword [esi]
call fcn.00480430
push esi
call fcn.00549eaf
add esp, 4
mov ecx, dword [esp + 0x15c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.0054a992
add esp, 0x154
ret 8
push 0x8c
lea eax, [esp + 0xd0]
push 0
push eax
call fcn.0054b440
add esp, 0xc
call fcn.004bb040
push eax
call fcn.004bb040
push eax
call fcn.004bb040
push eax
call fcn.004bb040
push eax
push 0x47a
lea ecx, [esp + 0xe0]
call fcn.004c07f0
lea eax, [esp + 0xcc]
mov byte [esp + 0x164], 2
push eax
lea ecx, [esp + 0x3c]
call fcn.004c0700
push 0x5852cc
lea eax, [esp + 0x3c]
push eax
call fcn.0054a9a1
int3
Function at 0x5002d0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x579086
mov eax, dword fs:[0]
push eax
sub esp, 0x1b8
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 0x1b4], eax
mov eax, dword [0x59b000]
xor eax, esp
push eax
lea eax, [esp + 0x1bc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1cc]
add eax, 4
mov dword [esp + 0x94], 8
cmp dword [eax + 0x14], 0x10
jb 0x500324
mov eax, dword [eax]
lea edx, [esp + 0x94]
push edx
lea edx, [esp + 0x9c]
push edx
lea edx, [esp + 0x98]
push edx
push 0
push eax
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x5003bd
push 0x8c
lea eax, [esp + 0x130]
push 0
push eax
call fcn.0054b440
add esp, 0xc
call fcn.004bb040
push eax
call fcn.004bb040
push eax
call fcn.004bb040
push eax
call fcn.004bb040
push eax
push 0x47a
lea ecx, [esp + 0x140]
call fcn.004c07f0
lea eax, [esp + 0x12c]
mov dword [esp + 0x1c4], 0
push eax
lea ecx, [esp + 0xa4]
call fcn.004c0700
push 0x5852cc
lea eax, [esp + 0xa4]
push eax
call fcn.0054a9a1
cmp dword [esp + 0x90], 0xb
je 0x500432
push 0x8c
lea eax, [esp + 0xa4]
push 0
push eax
call fcn.0054b440
add esp, 0xc
call fcn.004bb040
push eax
call fcn.004bb040
push eax
call fcn.004bb040
push eax
call fcn.004bb040
push eax
push 0x47a
lea ecx, [esp + 0xb4]
call fcn.004c07f0
lea eax, [esp + 0xa0]
mov dword [esp + 0x1c4], 1
push eax
lea ecx, [esp + 8]
call fcn.004c0700
push 0x5852cc
lea eax, [esp + 8]
push eax
call fcn.0054a9a1
mov eax, dword [esp + 0x98]
mov edx, dword [esp + 0x9c]
mov ecx, dword [esp + 0x1bc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x1b4]
xor ecx, esp
call fcn.0054a992
add esp, 0x1c4
ret 4
Function at 0x500590
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5790d6
mov eax, dword fs:[0]
push eax
sub esp, 0x1b4
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 0x1b0], eax
mov eax, dword [0x59b000]
xor eax, esp
push eax
lea eax, [esp + 0x1b8]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1c8]
add eax, 4
mov dword [esp + 0x94], 4
cmp dword [eax + 0x14], 0x10
jb 0x5005e4
mov eax, dword [eax]
lea edx, [esp + 0x94]
push edx
lea edx, [esp + 0x94]
push edx
lea edx, [esp + 0xa0]
push edx
push 0
push eax
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x50067d
push 0x8c
lea eax, [esp + 0x12c]
push 0
push eax
call fcn.0054b440
add esp, 0xc
call fcn.004bb040
push eax
call fcn.004bb040
push eax
call fcn.004bb040
push eax
call fcn.004bb040
push eax
push 0x47a
lea ecx, [esp + 0x13c]
call fcn.004c07f0
lea eax, [esp + 0x128]
mov dword [esp + 0x1c0], 0
push eax
lea ecx, [esp + 0xa0]
call fcn.004c0700
push 0x5852cc
lea eax, [esp + 0xa0]
push eax
call fcn.0054a9a1
cmp dword [esp + 0x98], 4
je 0x5006f2
push 0x8c
lea eax, [esp + 0xa0]
push 0
push eax
call fcn.0054b440
add esp, 0xc
call fcn.004bb040
push eax
call fcn.004bb040
push eax
call fcn.004bb040
push eax
call fcn.004bb040
push eax
push 0x47a
lea ecx, [esp + 0xb0]
call fcn.004c07f0
lea eax, [esp + 0x9c]
mov dword [esp + 0x1c0], 1
push eax
lea ecx, [esp + 8]
call fcn.004c0700
push 0x5852cc
lea eax, [esp + 8]
push eax
call fcn.0054a9a1
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x1b8]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.0054a992
add esp, 0x1c0
ret 4
Function at 0x500840
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x57915b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov eax, dword [0x59b000]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [esp + 0x244]
cmp dword [ebx + 0x18], 0x10
lea eax, [ebx + 4]
mov esi, dword [esp + 0x248]
mov dword [esp + 0x9c], 0x100
jb 0x5008a0
mov eax, dword [eax]
lea ecx, [esp + 0x9c]
push ecx
lea ecx, [esp + 0x134]
push ecx
lea ecx, [esp + 0xa8]
push ecx
push 0
push eax
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
jne 0x5008e7
mov eax, dword [esi + 4]
sub eax, dword [esi]
test eax, 0xfffffffc
je 0x5009bb
mov eax, dword [edi]
mov ecx, edi
push esi
push ebx
call dword [eax + 0x14]
jmp 0x5009bb
cmp dword [esp + 0xa0], 3
je 0x50093f
push 0x8c
lea eax, [esp + 0xa8]
push 0
push eax
call fcn.0054b440
add esp, 0xc
lea ecx, [esp + 0xa4]
call fcn.004c09f0
lea eax, [esp + 0xa4]
mov dword [esp + 0x23c], 0
push eax
lea ecx, [esp + 0x14]
call fcn.004c0700
push 0x5852cc
lea eax, [esp + 0x14]
push eax
call fcn.0054a9a1
cmp dword [esp + 0x9c], 4
lea edi, [esp + 0x130]
mov eax, dword [esi]
mov dword [esi + 4], eax
jb 0x5009bb
mov eax, dword [esi + 4]
cmp edi, eax
jae 0x500985
mov ecx, dword [esi]
cmp ecx, edi
ja 0x500985
mov ebx, edi
sub ebx, ecx
sar ebx, 2
cmp eax, dword [esi + 8]
jne 0x500977
push 1
mov ecx, esi
call fcn.004a5870
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x50099e
mov eax, dword [esi]
mov eax, dword [eax + ebx*4]
jmp 0x50099c
cmp eax, dword [esi + 8]
jne 0x500993
push 1
mov ecx, esi
call fcn.004a5870
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x50099e
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [esp + 0x9c]
add edi, 4
add dword [esi + 4], 4
sub eax, 4
mov dword [esp + 0x9c], eax
cmp eax, 4
jae 0x500955
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.0054a992
add esp, 0x230
ret 8
Function at 0x500b10
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 8
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov ebx, ecx
cmp dword [ebp + 0x18], 0x10
push esi
lea esi, [ebp + 4]
push edi
mov edi, dword [esp + 0x20]
jb 0x500b39
mov eax, dword [esi]
jmp 0x500b3b
mov eax, esi
push 0
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push eax
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x500b91
cmp dword [esp + 0x10], 4
jne 0x500b91
cmp dword [edi + 0x18], 0x10
lea eax, [edi + 4]
jb 0x500b66
mov eax, dword [eax]
push 0xa
push 0
push eax
call fcn.0054fb73
mov edx, dword [ebx]
add esp, 0xc
mov ecx, ebx
push eax
push ebp
call dword [edx + 0xc]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.0054a992
add esp, 8
ret 8
mov ecx, dword [edi + 0x14]
lea eax, [edi + 4]
inc ecx
cmp dword [eax + 0x14], 0x10
jb 0x500ba0
mov eax, dword [eax]
cmp dword [esi + 0x14], 0x10
jb 0x500ba8
mov esi, dword [esi]
push ecx
push eax
push 1
push 0
push esi
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0054a992
add esp, 8
ret 8

Function at 0x500fb0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
mov edx, 4
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov dword [esp + 0x14], eax
mov ebp, dword [edi + 4]
sub ebp, dword [edi]
sar ebp, 2
lea eax, [ebp + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545ef6
mov ecx, dword [edi]
add esp, 4
mov ebx, eax
cmp ecx, dword [edi + 4]
jae 0x501011
mov esi, ebx
mov edx, dword [ecx]
lea esi, [esi + 4]
mov dword [esi - 4], edx
add ecx, 4
cmp ecx, dword [edi + 4]
jb 0x501001
mov esi, dword [esp + 0x14]
add esi, 4
cmp dword [esi + 0x14], 0x10
jb 0x501022
mov eax, dword [esi]
jmp 0x501024
mov eax, esi
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push 0
push 0
push ecx
push 0
push eax
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [esi + 0x14], 0x10
jb 0x501045
mov esi, dword [esi]
lea eax, [ebp*4]
push eax
push ebx
push 3
push 0
push esi
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
call fcn.0054a8a8
mov ecx, dword [esp + 0x20]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0054a992
add esp, 0x10
ret 8
Function at 0x501080
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push edi
mov edi, dword [esp + 0x18]
xor cl, cl
mov eax, edi
mov bh, 1
mov dword [esp + 8], eax
test edi, edi
je 0x5010da
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
nop
movzx edx, bh
lea esi, [esi + 1]
inc bh
mov bl, byte [edx + ebp]
add cl, bl
mov byte [esp + 0x20], cl
movzx ecx, cl
mov al, byte [ecx + ebp]
mov byte [edx + ebp], al
mov byte [ecx + ebp], bl
movzx ecx, byte [edx + ebp]
add cl, bl
movzx ecx, cl
movzx ecx, byte [ecx + ebp]
xor byte [esi - 1], cl
mov cl, byte [esp + 0x20]
dec edi
jne 0x5010a0
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
Function at 0x509150
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57a0f9
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x59b000]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
mov byte [esi + 4], 0
mov dword [esp + 0xc], esi
mov dword [esi], 0x4442f8
mov eax, dword [esp + 0x44]
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], 0
mov dword [esi + 0x4c], 0xf
mov dword [esi + 0x48], 0
mov byte [esi + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esi + 0x34], 0x4442f8
lea eax, [esi + 0x70]
mov byte [esp + 0x3c], 1
lea edi, [esi + 0x50]
mov dword [edi], 0
push eax
call fcn.004b4170
mov word [esi + 0x74], 0
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov eax, dword [esp + 0x44]
mov edx, 2
mov ecx, eax
mov dword [esi + 0x84], 0xffffffff
and ecx, 0x1000
mov dword [esi + 0x2c], 0
mov ecx, 0x12
mov byte [esp + 0x3c], 2
cmovne edx, ecx
xorps xmm0, xmm0
and eax, 3
movdqu xmmword [edi], xmm0
movdqu xmmword [edi + 0x10], xmm0
dec eax
je 0x509281
dec eax
je 0x50926a
lea ecx, [esi + 0x34]
dec eax
je 0x509253
push 0x444144
call fcn.004ba6c0
jmp 0x5092d5
mov dword [esp + 0x18], 0x44e74c
mov dword [esp + 0x1c], 0x59865c
push 0x44e780
jmp 0x509299
mov dword [esp + 0x18], 0x44e718
mov dword [esp + 0x1c], 0x59862c
push 0x44e740
jmp 0x509296
mov dword [esp + 0x18], 0x44e6e0
mov dword [esp + 0x1c], 0x59861c
push 0x44e70c
lea ecx, [esi + 0x34]
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x34], 0
movq qword [esp + 0x2c], xmm0
mov dword [esp + 0x18], edx
call fcn.004ba6c0
movdqu xmm0, xmmword [esp + 0x14]
movdqu xmmword [edi], xmm0
movdqu xmm0, xmmword [esp + 0x24]
movdqu xmmword [edi + 0x10], xmm0
push 0xb4
call fcn.00549e5e
add esp, 4
mov dword [esp + 0x10], eax
mov byte [esp + 0x3c], 3
test eax, eax
je 0x50930b
push 0xb4
push 0
push eax
call fcn.0054b440
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push edi
call fcn.00502250
jmp 0x50930d
xor eax, eax
push 0x444144
mov ecx, esi
mov byte [esp + 0x40], 2
mov dword [esi + 0x2c], eax
call fcn.004ba6c0
xor eax, eax
mov dword [esi + 0x24], 0
mov word [esi + 0x1c], ax
mov eax, esi
mov dword [esi + 0x20], 0
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x34
ret 4
Function at 0x5111c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57a888
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x59b000]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xorps xmm0, xmm0
movdqu xmmword [esi + 4], xmm0
movdqu xmmword [esi + 0x14], xmm0
mov dword [esi], 0x44ea18
mov dword [esi + 0x24], 0
lea ecx, [esi + 0x3c]
mov dword [esp + 0x14], 0
call fcn.004c5ca0
mov byte [esi + 0x34], 1
mov eax, esi
mov dword [esi + 0x28], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [esi + 0x40], 0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x512110
Capabilities:
Query service configuration

Disassembly:
push 0xffffffffffffffff
push 0x57aa08
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x59b000]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x59b000]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor ebx, ebx
push reloc.WS2_32.dll_accept
push ebx
push ebx
mov byte [esp + 0x23], bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
je 0x512301
push closesocket
push 0x44eaa0
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, eax
mov dword [esp + 0x20], ebp
test ebp, ebp
je 0x5122e7
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
lea eax, [esp + 0x24]
push eax
push ebx
push ebx
push ebp
mov dword [esp + 0x34], ebx
call edi
test eax, eax
jne 0x5122e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x5122e0
mov esi, dword [esp + 0x24]
test esi, esi
je 0x5122dc
push esi
call fcn.0054cb68
mov ebx, eax
add esp, 4
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x5122dc
lea eax, [esp + 0x24]
push eax
push esi
push ebx
push ebp
call edi
test eax, eax
je 0x5122dc
mov eax, dword [ebx + 4]
cmp eax, 2
jne 0x5121f1
cmp byte [esp + 0x58], 0
jne 0x512205
cmp eax, 3
jne 0x5122dc
cmp byte [esp + 0x5c], 0
je 0x5122dc
push dword [ebx + 0xc]
lea ecx, [esp + 0x2c]
call fcn.004bbb30
mov ebx, dword [esp + 0x40]
lea esi, [esp + 0x2c]
mov edx, dword [esp + 0x2c]
lea edi, [esp + 0x2c]
cmp ebx, 0x10
mov dword [esp + 0x50], 0
lea ecx, [esp + 0x2c]
cmovae esi, edx
add esi, dword [esp + 0x3c]
cmp ebx, 0x10
cmovae edi, edx
add edi, dword [esp + 0x3c]
cmp ebx, 0x10
mov eax, edi
cmovae ecx, edx
sub eax, ecx
push eax
push 0x22
push ecx
call fcn.0054b5b0
add esp, 0xc
mov ecx, edi
test eax, eax
cmovne ecx, eax
cmp ecx, edi
je 0x51228a
lea eax, [ecx + 1]
mov ebp, edi
sub ebp, eax
xor ebx, ebx
xor edx, edx
cmp eax, edi
cmova ebp, ebx
test ebp, ebp
je 0x512286
mov bl, byte [eax]
cmp bl, 0x22
je 0x512280
mov byte [ecx], bl
inc ecx
inc edx
inc eax
cmp edx, ebp
jne 0x512276
mov ebp, dword [esp + 0x20]
cmp dword [esp + 0x40], 0x10
lea edx, [esp + 0x2c]
cmovae edx, dword [esp + 0x2c]
test ecx, ecx
jne 0x5122a0
xor eax, eax
jmp 0x5122a4
mov eax, ecx
sub eax, edx
test esi, esi
je 0x5122aa
sub esi, ecx
push esi
push eax
lea ecx, [esp + 0x34]
call fcn.004672b0
lea ecx, [esp + 0x28]
call fcn.004bc590
mov dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x28]
test al, al
je 0x5122d3
mov byte [esp + 0x17], 1
call fcn.0045fd40
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x5122fb
push ebx
call fcn.00549ff4
add esp, 4
mov al, byte [esp + 0x17]
jmp 0x512303
mov al, bl
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0054a992
add esp, 0x40
ret 8