joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401118
Capabilities:
Query environment variable

Disassembly:
enter 0x34, 0
mov edx, 0x403154
sub dword [ebp - 0x20], esi
push edx
push dword [edx + 0xd4]
push dword [edx + 0x60]
call fcn.00401a38
pop edx
push edx
lea edi, [edx - 0x154]
push edi
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
jne 0x401135
pop edx
push edx
call sub.KERNEL32.dll_GetEnvironmentStringsA
pop edx
add esp, 0x34
pop ebp
ret 0x10

Function at 0x40188c
Capabilities:
Query environment variable

Disassembly:
enter 0x60, 0
mov ebx, 0x4031b0
and dword [ebx - 0x78], 0x49
call sub.KERNEL32.dll_GetEnvironmentStringsA
push ebx
push dword [ebx + 0x9c]
push dword [ebx + 0xb4]
push edi
call fcn.004012a0
pop ebx
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
add esp, 0x60
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41b4f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x424c20], ecx
add edx, 1
cmp edx, 0x100
jb 0x41b4f2
cmp edx, 0x800
jae 0x41b5db
mov edi, edi
mov eax, dword [edx*4 + 0x424820]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x424c20]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x424c1c], eax
jb 0x41b5b0
mov eax, 0x41bdb0
mov dword [0x424c0c], eax
mov dword [0x426c20], eax
mov dword [0x424c08], 0x41bcd0
call fcn.0041b810
test eax, eax
jne 0x41b607
mov dword [0x426c20], 0x41bcd0
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..pdata
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x12c55e51
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..pdata_1
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4cd376ae
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10001640
Capabilities:
Create thread
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push ebp
push esi
push edi
push str._IsAgent
push 0x2f
push str..IsaCtrl.c
push 3
mov ecx, 0x1002bd8c
call fcn.1000be40
push str._IsAgent
push 0x2f
push str..IsaCtrl.c
push 3
mov ecx, 0x1002bd8c
call fcn.1000bb50
push str.IsaCtrl_is_start_to_work_
push 0x30
push str..IsaCtrl.c
push 3
mov ecx, 0x1002bd8c
call fcn.1000be40
push str.IsaCtrl_is_start_to_work_
push 0x30
push str..IsaCtrl.c
push 3
mov ecx, 0x1002bd8c
call fcn.1000bb50
add esp, 0x40
push 0x10001760
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.1000b780
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebp
test esi, esi
mov edi, eax
mov ebx, edi
je 0x100016f3
push 4
push str.2722
push 1
push 0
push str.IsaCtrlVer
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
call ebp
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x100016fe
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.1000eef0
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x1006d140
call esi
push 0x100519c0
call esi
push 0x100519a8
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x100074b0
push 0
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.100075d0
call fcn.10003210
push 0
push 0
push 0
push 0x10002630
push 0
push 0
call esi
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002db0
Capabilities:
Query service status

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, eax
xor eax, eax
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
je 0x10002f3b
push 0xf003f
push ebx
push ebx
mov dword [esi], 1
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebx
jne 0x10002e47
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str.______OpenSCManager_failed__error:__d_______
push 0xf3
push str.....IsaManageIsaManageProtectWork.c
push 1
mov ecx, str.QueryAssignServiceStatus
call fcn.1000be40
add esp, 0x14
call esi
push eax
push str.______OpenSCManager_failed__error:__d_______
push 0xf3
push str.....IsaManageIsaManageProtectWork.c
push 1
mov ecx, str.QueryAssignServiceStatus
call fcn.1000bb50
add esp, 0x14
jmp 0x10002f2e
push 0xf003f
push str.IsaSvcProtectServer
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebp, eax
test ebp, ebp
jne 0x10002eb2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str.IsaSvcProtectServer
push str.______OpenService:__s__failed__error:__d_______
push 0xfa
push str.....IsaManageIsaManageProtectWork.c
push 1
mov ecx, str.QueryAssignServiceStatus
call fcn.1000be40
add esp, 0x18
call esi
push eax
push str.IsaSvcProtectServer
push str.______OpenService:__s__failed__error:__d_______
push 0xfa
push str.....IsaManageIsaManageProtectWork.c
push 1
mov ecx, str.QueryAssignServiceStatus
call fcn.1000bb50
add esp, 0x18
jmp 0x10002f23
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x10002ecf
mov ecx, dword [esp + 0x14]
mov ebx, 1
mov dword [esi], ecx
jmp 0x10002f23
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str.IsaSvcProtectServer
push str.______OpenService:__s__failed__error:__d_______
push 0x105
push str.....IsaManageIsaManageProtectWork.c
push 1
mov ecx, str.QueryAssignServiceStatus
call fcn.1000be40
add esp, 0x18
call esi
push eax
push str.IsaSvcProtectServer
push str.______OpenService:__s__failed__error:__d_______
push 0x105
push str.....IsaManageIsaManageProtectWork.c
push 1
mov ecx, str.QueryAssignServiceStatus
call fcn.1000bb50
add esp, 0x18
xor ebx, ebx
test ebp, ebp
je 0x10002f2e
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x10002f39
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x10003210
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [0x1006bef8], eax
call esi
push 0x1006d160
mov dword [0x1006bf00], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.10003280
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10003ab0
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push 0
push 0
push 0
push 0x10003320
push 0
push 0
call esi
push eax
call edi
pop edi
pop esi
pop ecx
ret
Function at 0x10003c20
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push str._SessionMgr__Session_System_is_logon
push 0x1b2
push str..SessionMgr.c
push 3
mov ecx, str.SessionSystem
call fcn.1000be40
push str._SessionMgr__Session_System_is_logon
push 0x1b2
push str..SessionMgr.c
push 3
mov ecx, str.SessionSystem
call fcn.1000bb50
add esp, 0x20
push 0x1006d160
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1006beec], 0
je 0x10003c87
push 0x1006d160
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov esp, ebp
pop ebp
ret
push 0x1006bee4
push 0x1006bee8
call fcn.10004170
add esp, 8
test eax, eax
jne 0x10003ce7
push str._SessionMgr__Create_System_Process_failed
push 0x1be
push str..SessionMgr.c
push 1
mov ecx, str.SessionSystem
call fcn.1000be40
push str._SessionMgr__Create_System_Process_failed
push 0x1be
push str..SessionMgr.c
push 1
mov ecx, str.SessionSystem
call fcn.1000bb50
add esp, 0x20
push 0x1006d160
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1006bee8]
push eax
call fcn.10004b50
add esp, 4
test eax, eax
mov dword [0x1006beec], eax
push 0
jne 0x10003d78
mov ecx, dword [0x1006bee4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [0x1006bee4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._SessionMgr__Connect_to_System_Session_Pipe_failed
push 0x1ca
push str..SessionMgr.c
push 1
mov ecx, str.SessionSystem
mov dword [0x1006bee4], 0
mov dword [0x1006bee8], 0
call fcn.1000be40
push str._SessionMgr__Connect_to_System_Session_Pipe_failed
push 0x1ca
push str..SessionMgr.c
push 1
mov ecx, str.SessionSystem
call fcn.1000bb50
add esp, 0x20
push 0x1006d160
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov esp, ebp
pop ebp
ret
push 0
push 0x1000
push 0x10004ca0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1006d160
mov dword [0x1006bef0], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push str._SessionMgr__Start_System_Session_Sub_Process_Completed
push 0x1d3
push str..SessionMgr.c
push 3
mov ecx, str.SessionSystem
call fcn.1000be40
push str._SessionMgr__Start_System_Session_Sub_Process_Completed
push 0x1d3
push str..SessionMgr.c
push 3
mov ecx, str.SessionSystem
call fcn.1000bb50
add esp, 0x20
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10003de0
Capabilities:
Create thread
Terminate process

Disassembly:
push ebx
push ebp
push edi
push esi
push str._SessionMgr__Session___d__is_logon
push 0x1dc
push str..SessionMgr.c
push 3
mov ecx, str.SessionLogon
call fcn.1000be40
add esp, 0x14
push esi
push str._SessionMgr__Session___d__is_logon
push 0x1dc
push str..SessionMgr.c
push 3
mov ecx, str.SessionLogon
call fcn.1000bb50
add esp, 0x14
push 0x1006d160
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebx, [esi + esi*4]
add ebx, ebx
add ebx, ebx
cmp dword [ebx + 0x10057eec], 0
je 0x10003e50
push 0x1006d160
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop edi
pop ebp
pop ebx
ret
xor ebp, ebp
push esi
mov edi, str.Explorer.exe
call fcn.1000d120
mov edi, eax
add esp, 4
test edi, edi
ja 0x10003eb9
push esi
mov edi, str.Winlogon.exe
call fcn.1000d120
mov edi, eax
add esp, 4
test edi, edi
ja 0x10003eb9
push esi
mov edi, str.wsap.exe
call fcn.1000d120
mov edi, eax
add esp, 4
test edi, edi
ja 0x10003eb9
push esi
mov edi, str.ecdeamon.exe
call fcn.1000d120
mov edi, eax
add esp, 4
test edi, edi
ja 0x10003eb9
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebp, 1
cmp ebp, 0xa
jb 0x10003e52
test edi, edi
je 0x10003f13
lea ebp, [ebx + 0x10057ee8]
lea edi, [ebx + 0x10057ee4]
push ebp
push esi
mov ecx, edi
call fcn.10004310
add esp, 8
test eax, eax
jne 0x10003f24
push esi
push str._SessionMgr__Create_User_Session:__d__Process_failed
push 0x20b
push str..SessionMgr.c
push 1
mov ecx, str.SessionLogon
call fcn.1000be40
add esp, 0x14
push esi
push str._SessionMgr__Create_User_Session:__d__Process_failed
push 0x20b
push str..SessionMgr.c
push 1
mov ecx, str.SessionLogon
call fcn.1000bb50
add esp, 0x14
push 0x1006d160
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop edi
pop ebp
pop ebx
ret
mov eax, dword [ebp]
push eax
call fcn.10004b50
add esp, 4
test eax, eax
mov dword [ebx + 0x10057eec], eax
push 0
jne 0x10003faa
mov ecx, dword [edi]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [edi]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push str._SessionMgr__Connect_to_Session:__d__Pipe_failed
push 0x217
push str..SessionMgr.c
push 1
mov ecx, str.SessionLogon
mov dword [edi], 0
mov dword [ebp], 0
call fcn.1000be40
add esp, 0x14
push esi
push str._SessionMgr__Connect_to_Session:__d__Pipe_failed
push 0x217
push str..SessionMgr.c
push 1
mov ecx, str.SessionLogon
call fcn.1000bb50
add esp, 0x14
push 0x1006d160
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop edi
pop ebp
pop ebx
ret
push 0
push esi
push 0x10004ca0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1006d160
mov dword [ebx + 0x10057ef0], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
push str._SessionMgr__Start_User_Session___d__Sub_Process_Completed
push 0x220
push str..SessionMgr.c
push 3
mov ecx, str.SessionLogon
call fcn.1000be40
add esp, 0x14
push esi
push str._SessionMgr__Start_User_Session___d__Sub_Process_Completed
push 0x220
push str..SessionMgr.c
push 3
mov ecx, str.SessionLogon
call fcn.1000bb50
add esp, 0x14
pop edi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x10004020
Capabilities:
Terminate process

Disassembly:
sub esp, 0x110
mov eax, dword [0x10035400]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
push edi
push 0x103
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x1c], 0
call fcn.1001f410
add esp, 0xc
push 0x1006d160
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea esi, [ebp + ebp*4]
add esi, esi
mov ecx, dword [esi + esi + 0x10057ee8]
add esi, esi
push ecx
lea edx, [esp + 0x14]
push str.GlobalIsaHelpExit__u
push edx
call fcn.100182ad
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
test edi, edi
je 0x100040ce
push edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push edi
call ebx
mov ecx, dword [esi + 0x10057ee4]
push 0x2710
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x100040dd
mov edx, dword [esi + 0x10057ee4]
push 0
push edx
jmp 0x100040d7
mov eax, dword [esi + 0x10057ee4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esi + 0x10057ee4]
push ecx
call ebx
mov edi, dword [esi + 0x10057eec]
xor eax, eax
push edi
mov dword [esi + 0x10057ee4], eax
mov dword [esi + 0x10057ee8], eax
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push edi
call ebx
push 0x1006d160
mov dword [esi + 0x10057eec], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebp
push str._SessionMgr__Session___d__is_logoff
push 0x251
push str..SessionMgr.c
push 3
mov ecx, str.SessionLogoff
call fcn.1000be40
add esp, 0x14
push ebp
push str._SessionMgr__Session___d__is_logoff
push 0x251
push str..SessionMgr.c
push 3
mov ecx, str.SessionLogoff
call fcn.1000bb50
mov ecx, dword [esp + 0x130]
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001829e
add esp, 0x110
ret
Function at 0x10004170
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x27c
mov eax, dword [0x10035400]
xor eax, esp
mov dword [esp + 0x274], eax
mov eax, dword [esp + 0x284]
push ebx
push ebp
mov ebp, dword [esp + 0x288]
push esi
push edi
xor ebx, ebx
push 0x40
lea ecx, [esp + 0x30]
push ebx
push ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebx
call fcn.1001f410
add esp, 0xc
push 0x103
xor eax, eax
lea edx, [esp + 0x17d]
push ebx
push edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov byte [esp + 0x184], bl
call fcn.1001f410
add esp, 0xc
push 0x103
lea eax, [esp + 0x75]
push ebx
push eax
mov byte [esp + 0x7c], bl
call fcn.1001f410
add esp, 0xc
lea edi, [esp + 0x178]
call fcn.10011130
push 0x1002bdd0
mov ecx, edi
push ecx
lea edx, [esp + 0x78]
push str._s_s
push edx
call fcn.100182ad
add esp, 0x10
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov edx, edi
push edx
push ebx
push 0x20
push ebx
push ebx
push ebx
lea eax, [esp + 0x90]
push eax
push ebx
mov dword [esp + 0x50], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, ebx
je 0x100042ab
cmp ebp, ebx
je 0x10004257
mov ecx, dword [esp + 0x1c]
mov dword [ebp], ecx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x10004265
mov edx, dword [esp + 0x14]
mov dword [eax], edx
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
push ecx
push str._SessionMgr__CreateSystemProcess_id:___d_
push 0x270
push str..SessionMgr.c
push 3
mov ecx, str.CreateSystemProcess
call fcn.1000be40
mov edx, dword [esp + 0x30]
add esp, 0x14
push edx
push str._SessionMgr__CreateSystemProcess_id:___d_
push 0x270
push str..SessionMgr.c
push 3
jmp 0x100042e4
lea eax, [esp + 0x70]
push eax
push str._SessionMgr__CreateSystemProcess__s
push 0x274
push str..SessionMgr.c
push 1
mov ecx, str.CreateSystemProcess
call fcn.1000be40
add esp, 0x14
lea ecx, [esp + 0x70]
push ecx
push str._SessionMgr__CreateSystemProcess__s
push 0x274
push str..SessionMgr.c
push 1
mov ecx, str.CreateSystemProcess
call fcn.1000bb50
mov ecx, dword [esp + 0x298]
add esp, 0x14
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001829e
add esp, 0x27c
ret
Function at 0x10005410
Capabilities:
Create thread

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
mov edi, eax
mov eax, dword [edi + 0x64]
push edx
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x1c], 0
call fcn.1000a5d0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100054d1
mov edx, dword [esp + 0x14]
push edx
push esi
call fcn.1000aab0
push 0x449
push str.StartIsaHelpWarden
lea ebx, [esi + 1]
push 1
push ebx
mov ecx, str..SessionMgr.c
call fcn.1000c550
add esp, 0x18
push str.Request_Start
push esi
call fcn.1000a480
add esp, 8
test eax, eax
jne 0x10005511
push str._SessionMgr__Get_IsaHelp_Warden_Start_Command_fail
push 0x453
push str..SessionMgr.c
push 1
mov ecx, str.StartIsaHelpWarden
call fcn.1000be40
push str._SessionMgr__Get_IsaHelp_Warden_Start_Command_fail
push 0x453
push str..SessionMgr.c
push 1
mov ecx, str.StartIsaHelpWarden
call fcn.1000bb50
push esi
call fcn.1000a140
add esp, 0x24
push ebx
call fcn.1000c930
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push str._SessionMgr__Get_IsaHelp_Warden_Config_fail
push 0x44c
push str..SessionMgr.c
push 1
mov ecx, str.StartIsaHelpWarden
call fcn.1000be40
push str._SessionMgr__Get_IsaHelp_Warden_Config_fail
push 0x44c
push str..SessionMgr.c
push 1
mov ecx, str.StartIsaHelpWarden
call fcn.1000bb50
add esp, 0x20
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push str.True
push eax
call fcn.10019a8f
add esp, 8
test eax, eax
jne 0x1000556c
cmp dword [0x1006bef4], eax
jne 0x10005545
push eax
push eax
push eax
push 0x10005600
push eax
push eax
mov dword [0x1006befc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1006bef4], eax
push str._SessionMgr__Start_IsaHelp.exe_Warden
push 0x460
push str..SessionMgr.c
push 3
mov ecx, str.StartIsaHelpWarden
call fcn.1000be40
push str._SessionMgr__Start_IsaHelp.exe_Warden
push 0x460
jmp 0x100055b5
mov eax, dword [0x1006bef4]
test eax, eax
je 0x10005590
push eax
mov dword [0x1006befc], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1006bef4], 0
push str._SessionMgr__Stop_IsaHelp.exe_Warden
push 0x470
push str..SessionMgr.c
push 3
mov ecx, str.StartIsaHelpWarden
call fcn.1000be40
push str._SessionMgr__Stop_IsaHelp.exe_Warden
push 0x470
push str..SessionMgr.c
push 3
mov ecx, str.StartIsaHelpWarden
call fcn.1000bb50
add esp, 0x20
push esi
call fcn.1000a140
add esp, 4
push ebx
call fcn.1000c930
add esp, 4
push str._Reply__Result_True__Result__Msg___Msg___Reply_
push 0x1000
mov ecx, str.StartIsaHelpWarden
call fcn.10001420
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0x10
ret