joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ce1c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67f5bf
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x78a6d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
lea esi, [edi + 0xc]
mov dword [ebp - 4], 0
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0058a8a1
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x14]
mov byte [ebp - 4], 1
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0058a8a1
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x1c], 0
xor eax, eax
mov dword [edi + 0x20], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 7
mov word [edi + 0x20], ax
push dword [ebp + 8]
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.005ce2b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x5ce710
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67f63f
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x78a6d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
lea ebx, [esi + 0xc]
mov dword [ebp - 4], 0
push 0x18
mov dword [ebp - 0x14], ebx
mov dword [ebx], 0
mov dword [ebx + 4], 0
call fcn.0058a8a1
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebx], eax
lea edi, [esi + 0x14]
mov byte [ebp - 4], 1
push 0x18
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.0058a8a1
add esp, 8
mov ecx, ebx
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [edi], eax
xor eax, eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 7
mov word [esi + 0x20], ax
mov eax, dword [esi]
mov dword [esi + 4], eax
mov esi, dword [ebx]
push dword [esi + 4]
push ebx
call fcn.00453f50
mov dword [esi + 4], esi
mov ecx, edi
mov dword [esi], esi
mov dword [esi + 8], esi
mov dword [ebx + 4], 0
mov esi, dword [edi]
push dword [esi + 4]
push edi
call fcn.00453f50
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], esi
mov dword [esi], esi
mov dword [esi + 8], esi
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d34e0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67fdbe
mov eax, dword fs:[0]
push eax
sub esp, 0x294
mov eax, dword [0x78a6d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x29c], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x298], esi
mov dword [ebp - 0x294], 0
push 0x20
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0058a8a1
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
mov edx, ebx
mov dword [ebp - 0x294], 1
call fcn.005d5a30
mov dword [ebp - 4], 1
mov eax, accept
mov ecx, dword [ebp - 0x30]
sub eax, ecx
cmp eax, 5
jb 0x5d36ce
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push 5
cmovae eax, dword [ebp - 0x40]
push 0x70cf68
push ecx
push eax
push ecx
push dword [ebp - 0x298]
lea ecx, [ebp - 0x28]
call fcn.0044c500
mov dword [ebp - 0x294], 3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x290]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x5d3630
lea eax, [ebp - 0x264]
mov edx, ebx
push eax
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.005d3290
add esp, 8
lea eax, [ebp - 0x290]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x5d3629
nop dword [eax]
lea eax, [ebp - 0x264]
mov edx, ebx
push eax
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.005d3290
add esp, 8
lea eax, [ebp - 0x290]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x5d3600
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x5d3666
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x5d365c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d36d3
push edx
push ecx
call fcn.0058ab22
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x5d36b0
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x5d36a6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d36d3
push edx
push ecx
call fcn.0058ab22
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058a893
mov esp, ebp
pop ebp
ret
call fcn.00446fa0
call fcn.005968cf
int3
Function at 0x5dddc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x681119
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x78a6d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebx + 4], eax
xor eax, eax
mov dword [ebx], vtable.XmlPrefMgr.0
mov dword [ebx + 8], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 7
mov word [ebx + 8], ax
lea esi, [ebx + 0x20]
mov byte [ebp - 4], 1
push 0x40
mov dword [ebp - 0x14], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0058a8a1
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 2
push 0x20
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
call fcn.0058a8a1
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebx + 0x28], eax
mov byte [ebp - 4], 3
push 0x20
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
call fcn.0058a8a1
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebx + 0x30], eax
mov byte [ebp - 4], 4
lea esi, [ebx + 0x3c]
mov word [ebx + 0x38], 0
mov byte [ebx + 0x3a], 0
push 0x40
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0058a8a1
add esp, 0x10
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov esi, dword [ebx + 0x28]
mov eax, dword [esi + 4]
mov dword [eax], 0
mov esi, dword [esi]
test esi, esi
je 0x5ddeeb
mov edi, dword [esi]
lea ecx, [esi + 8]
call fcn.004471f0
push 0x20
push esi
call fcn.0058ab22
add esp, 8
mov esi, edi
test edi, edi
jne 0x5dded0
mov eax, dword [ebx + 0x28]
mov dword [eax], eax
mov eax, dword [ebx + 0x28]
mov dword [eax + 4], eax
mov eax, ebx
mov dword [ebx + 0x2c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5deb40
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6812fd
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x78a6d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov dword [edi], vtable.XmlProfMgr.0
push 0xc
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.0058a8a1
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
xor eax, eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 7
mov word [edi + 0xc], ax
mov byte [ebp - 4], 2
lea esi, [edi + 0x24]
mov dword [ebp - 0x14], esi
push 0x40
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0058a8a1
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 3
push 0x64
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov byte [edi + 0x38], 0
mov dword [edi + 0x3c], 0
call fcn.0058a8a1
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.005cabb0
mov dword [edi + 0x3c], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5e1800
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68152e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x78a6d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CCertificate.0
push 0x20
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.0058a8a1
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [esi], vtable.CCapiCertificate.0
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov word [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
call fcn.005e1650
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
test eax, eax
je 0x5e18cd
push 0
push 0
push eax
push str.CapiCertUtils::CapiCertUtils
push 0x45
push 0x6f
jmp 0x5e192b
mov edi, dword [ebp + 0x10]
push edi
call dword [sym.imp.CRYPT32.dll_CertDuplicateCertificateContext]
mov dword [esi + 0x10], eax
test eax, eax
jne 0x5e1907
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x70e0e4
push 0x45
push 0x76
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonCryptCertificatesCapiCertificate.cpp
push str.CCapiCertificate::CCapiCertificate
call fcn.00612830
mov dword [ebx], 0xfe21000a
jmp 0x5e193a
push dword [edi + 4]
mov ecx, esi
push dword [edi + 8]
call fcn.005ec9e0
mov dword [ebx], eax
test eax, eax
je 0x5e193d
push 0
push 0
push eax
push str.OpenOpenSSLCert
push 0x45
push 0x81
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonCryptCertificatesCapiCertificate.cpp
push str.CCapiCertificate::CCapiCertificate
call fcn.00612830
add esp, 0x20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5e3de0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x681887
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x78a6d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
mov byte [ebx], 0
call fcn.0060af70
mov edi, eax
test edi, edi
je 0x5e3e55
push esi
push esi
push edi
push str.CWinsecApiImpersonateUser::getUserStringSid
push 0x45
push 0x131
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonCryptCertificatesCapiCertUtils.cpp
push str.CCapiCertUtils::GetCertRevocationFlagFromReg
call fcn.00612830
add esp, 0x20
jmp 0x5e3f5c
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0xf003f
push 0
push dword [ebp - 0x10]
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5e3e82
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0
test eax, eax
je 0x5e3e9d
push 0
push 0
push eax
push str.CRegKey::Open
push 0x45
push 0x13f
jmp 0x5e3e3e
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5e3ed7
test esi, esi
je 0x5e3eca
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0
mov byte [ebp - 4], 0
test eax, eax
je 0x5e3f09
push 0
push 0
push eax
push str.CRegKey::Open
push 0x45
push 0x147
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonCryptCertificatesCapiCertUtils.cpp
push str.CCapiCertUtils::GetCertRevocationFlagFromReg
call fcn.00612830
add esp, 0x20
mov edi, 0xfea9000e
jmp 0x5e3f5c
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push str.CertificateRevocation
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x5e3f35
cmp eax, 2
je 0x5e3f5c
jmp 0x5e3f40
cmp dword [ebp - 0x1c], 4
je 0x5e3f53
mov eax, 0xd
push 0
push 0
push eax
push str.CRegKey::QueryDWORDValue
push 0x45
push 0x155
jmp 0x5e3ef0
cmp dword [ebp - 0x18], 0
setne al
mov byte [ebx], al
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x5e3f68
call fcn.0060af30
test esi, esi
je 0x5e3f73
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5faaa0
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov edx, ecx
mov dword [ebp - 0xc], 0x18
xor bl, bl
mov dword [ebp - 4], edx
push edi
mov dword [ebp - 8], 1
xor esi, esi
test bl, bl
jne 0x5fab52
mov edi, dword [ebp + esi*4 - 0xc]
lea eax, [edx + 8]
push 0xf0000000
push edi
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x5fab0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x5fab0e
mov eax, dword [ebp - 4]
push 0xf0000008
push edi
push 0
push 0
add eax, 8
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x5fab0e
mov bl, 1
mov edx, dword [ebp - 4]
inc esi
cmp esi, 2
jb 0x5faac0
test bl, bl
jne 0x5fab52
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CryptAcquireContext
push 0x45
push 0x2fa
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonCryptHash.cpp
push str.CCAPIHash::init
call fcn.00612830
add esp, 0x20
mov eax, 0xfe300009
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
cmp eax, 4
ja case.default.0x5fab5e
jmp dword [eax*4 + 0x5fac14]
mov ecx, 0x8003
mov esi, 0x70e7e4
jmp 0x5fab9f
mov ecx, 0x8004
mov esi, 0x70e7e8
jmp 0x5fab9f
mov ecx, 0x800c
mov esi, 0x70e7f0
jmp 0x5fab9f
mov ecx, 0x800d
mov esi, str.sha384
jmp 0x5fab9f
mov ecx, 0x800e
mov esi, str.sha512
lea eax, [edx + 0xc]
push eax
push 0
push 0
push ecx
push dword [edx + 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x5fabf4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090008
jne 0x5fabde
push esi
push 0x1838
call fcn.00612810
add esp, 8
mov eax, 0xfe30000f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push eax
push 0x70e4f4
push 0x45
push 0x327
jmp 0x5fab32
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
pop ebx
mov byte [ecx + 4], 1
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, 0xfe300002
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5fb480
Capabilities:
Hash data via wincrypt

Disassembly:
push ebp
mov ebp, esp
cmp byte [ecx + 4], 0
jne 0x5fb492
mov eax, 0xfe300007
pop ebp
ret 8
cmp byte [ecx + 5], 0
je 0x5fb4a1
mov eax, 0xfe300009
pop ebp
ret 8
mov edx, dword [ebp + 8]
test edx, edx
jne 0x5fb4b1
mov eax, 0xfe300005
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push 0
push dword [eax]
push edx
push dword [ecx + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x5fb4f6
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x714c8c
push 0x45
push 0x369
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonCryptHash.cpp
push str.CCAPIHash::Update
call fcn.00612830
add esp, 0x20
mov eax, 0xfe30000c
pop ebp
ret 8
xor eax, eax
pop ebp
ret 8
Function at 0x6047b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.006045c0
mov esi, eax
push 0
test esi, esi
je 0x6047f3
push 0
push esi
push str.FindProcess
push 0x45
push 0x2a4
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonIPCProcessAPI.cpp
push str.CProcessApi::Terminate
call fcn.00612830
add esp, 0x20
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x604834
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
mov esi, eax
push esi
push 0x717354
push 0x45
push 0x2ac
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonIPCProcessAPI.cpp
push str.CProcessApi::Terminate
call fcn.00612830
add esp, 0x20
mov ecx, esi
call fcn.00604560
mov esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x606160
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x606298
push edi
call fcn.00599f70
add esp, 4
test eax, eax
je 0x606298
call fcn.00606870
mov esi, eax
test esi, esi
je 0x6061c0
push 0
push 0
push esi
push str.CSocketSupportBase::startSocketSupport
push 0x45
push 0x20c
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonIPCSocketSupport.cpp
push str.CSocketSupportBase::resolveAddress
call fcn.00612830
add esp, 0x20
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x20
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0
push 0
push eax
call fcn.0058d130
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 0
push eax
push 0
push edi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x606251
push 0
push 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x717690
push 0x45
push 0x218
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonIPCSocketSupport.cpp
push str.CSocketSupportBase::resolveAddress
call fcn.00612830
mov eax, dword [esp + 0x2c]
add esp, 0x20
test eax, eax
je 0x60623e
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov esi, 0xfe25000c
call fcn.00606880
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0xc]
test eax, eax
je 0x60623e
push dword [eax + 0x10]
mov esi, dword [ebp + 8]
push dword [eax + 0x18]
push esi
call fcn.0058c9c0
add esp, 0xc
push dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, 2
push ebx
call dword [sym.imp.WS2_32.dll_htons]
movzx eax, ax
mov word [esi + 2], ax
xor esi, esi
call fcn.00606880
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xfe250002
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6062b0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x78a6d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x430], eax
mov edi, ecx
call fcn.00606870
mov esi, eax
test esi, esi
je 0x606314
push 0
push 0
push esi
push str.CSocketSupportBase::startSocketSupport
push 0x45
push 0x1b0
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonIPCSocketSupport.cpp
push str.CSocketSupportBase::getHostName
call fcn.00612830
add esp, 0x20
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058a893
mov esp, ebp
pop ebp
ret
push 0x1c
lea eax, [ebp - 0x42c]
push 0
push eax
call fcn.0058d130
add esp, 0xc
lea eax, [ebp - 0x410]
push 0x401
push 0
push eax
call fcn.0058d130
add esp, 0xc
cmp byte [edi + 4], 0
push ebx
je 0x60636f
movups xmm0, xmmword [edi + 0x10]
mov eax, 0x17
mov word [ebp - 0x42c], ax
movups xmmword [ebp - 0x424], xmm0
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x42a], ax
mov eax, 0x1c
jmp 0x606396
mov eax, 2
mov word [ebp - 0x42c], ax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x428], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x42a], ax
mov eax, 0x10
push 4
push 0
push 0
push 0x401
lea ecx, [ebp - 0x410]
push ecx
push eax
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x6063f1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2af9
je 0x6063ea
push 0
push 0
push eax
push str.::getnameinfo
push 0x57
push 0x1dd
push str.C:_temp_build_thehoffQuicksilver_fcs0.742171161775Quicksilver_fcs_vpnCommonIPCSocketSupport.cpp
push str.CSocketSupportBase::getHostName
call fcn.00612830
add esp, 0x20
mov esi, 0xfe25000f
jmp 0x606430
lea eax, [ebp - 0x410]
push eax
call fcn.00599f70
add esp, 4
test eax, eax
jne 0x60640b
mov esi, 0xfe250014
jmp 0x606430
lea edx, [ebp - 0x410]
lea edi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x606414
mov ecx, dword [ebp - 0x430]
lea eax, [ebp - 0x410]
sub edx, edi
push edx
push eax
call fcn.0044a410
call fcn.00606880
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058a893
mov esp, ebp
pop ebp
ret
Function at 0x606930
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x684270
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xa8
mov eax, dword [0x78a6d4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00606a90
test eax, eax
jne 0x606a68
call fcn.0062e670
test al, al
je 0x606a66
mov ecx, 0x1a
lea edi, [ebp - 0xa8]
mov esi, str.SYSTEMCurrentControlSetServicesTcpip6Parameters
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xac]
mov dword [ebp - 0xac], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0xa8]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x606a66
mov eax, dword [0x717864]
movups xmm0, xmmword [str.DisabledComponents]
mov esi, dword [ebp - 0xac]
mov dword [ebp - 0x1c], eax
mov ax, word [0x717868]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xb0], 0
push eax
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xb4], 4
push eax
push 0
movups xmmword [ebp - 0x3c], xmm0
lea eax, [ebp - 0x3c]
movups xmm0, xmmword [0x717854]
push eax
push esi
movups xmmword [ebp - 0x2c], xmm0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x606a5b
cmp dword [ebp - 0xb8], 4
jne 0x606a5b
test byte [ebp - 0xb0], 0x10
je 0x606a5b
test esi, esi
je 0x606a54
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xfe250010
jmp 0x606a68
test esi, esi
je 0x606a66
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0058a893
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret