joyce8/EMBER2024-capa huggingface dataset:
Function at 0x528c20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5a36a6
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [edi], vtable.CSkinEngine2.0
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x5c], eax
mov dword [edi + 0x60], eax
mov eax, dword [esp + 0x1c]
xor ebx, ebx
push 0x304
mov dword [edi + 0x50], eax
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
call fcn.00578e5f
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x528caa
push eax
call fcn.0053f550
jmp 0x528cac
xor eax, eax
mov dword [esp + 0x14], 0xffffffff
push 0x108
mov dword [edi + 0x44], eax
call fcn.00578e5f
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov dword [esp + 0x14], 1
je 0x528cde
push eax
call fcn.00540890
mov esi, eax
jmp 0x528ce0
xor esi, esi
cmp esi, ebx
mov dword [esp + 0x14], 0xffffffff
mov dword [edi + 0x4c], esi
je 0x528cfb
call fcn.00540ab0
push 9
call fcn.00540b80
push 0xac
call fcn.00578e5f
add esp, 4
cmp eax, ebx
je 0x528d15
mov esi, eax
call fcn.005413e0
jmp 0x528d17
xor eax, eax
mov dword [edi + 0x54], eax
mov dword [edi + 0x48], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x68], ebx
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x52db40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a3609
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
lea esi, [edi + 8]
call fcn.0052c320
xor ebp, ebp
lea esi, [edi + 0x30]
mov dword [esp + 0x1c], ebp
call fcn.0052c320
lea ebx, [edi + 0x60]
mov dword [ebx + 4], ebp
mov dword [ebx + 8], ebp
mov dword [ebx + 0xc], ebp
lea ebp, [edi + 0x70]
xor eax, eax
mov dword [ebp + 4], eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
fldz
fst qword [edi + 0x80]
fst qword [edi + 0x88]
fstp qword [edi + 0x90]
mov byte [esp + 0x1c], 4
lea esi, [edi + 8]
mov dword [edi], eax
mov dword [edi + 4], 0xff00ff
call fcn.0052c430
lea esi, [edi + 0x30]
call fcn.0052c430
mov eax, 0xff00ff
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], eax
mov eax, ebx
call fcn.00444740
mov eax, ebp
call fcn.00444740
fldz
fst qword [edi + 0x80]
mov eax, edi
fst qword [edi + 0x88]
fstp qword [edi + 0x90]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x5492f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59d248
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor edi, edi
mov dword [esp + 0x14], edi
mov eax, dword [esi + 0x38]
cmp eax, edi
je 0x54932f
push eax
call fcn.0057832c
add esp, 4
mov dword [esi + 0x38], edi
mov ecx, dword [esi + 0x3c]
cmp ecx, edi
je 0x549341
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0x3c], edi
mov eax, dword [esi]
cmp eax, edi
je 0x549352
push eax
call fcn.0057832c
add esp, 4
mov dword [esi], edi
mov dword [esi + 0x30], edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x5505e0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x59ed88
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
call fcn.00404460
mov esi, dword [esp + 0x20]
add esi, 0xc
mov edi, esi
mov dword [esp + 0x18], 0
call fcn.004035d0
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x55064b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi]
xor edi, edi
cmp dword [eax - 0xc], edi
je 0x550661
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, eax
test edi, edi
jne 0x550666
call fcn.00403f60
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x550e10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x59d216
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov dword [esi], vtable.CGroundCanvasCache.0
xor edi, edi
mov ebx, 2
mov ebp, 4
mov dword [esi + 4], edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov byte [esp + 0x1c], 1
mov ecx, dword [esi + 4]
cmp ecx, edi
je 0x550e89
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 4], edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov ecx, dword [esi + 0x1c]
cmp ecx, edi
je 0x550eaa
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x56c490
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x59d518
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov dword [esp + 0x18], 0
xor edi, edi
lea eax, [esp + 0xc]
push eax
push 0x20019
push edi
push str.SOFTWARETencentQQPinyin
mov dword [esp + 0x34], edi
push closesocket
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x56c5d0
mov eax, dword [ebx]
mov ecx, dword [esp + 0xc]
sub eax, 0x10
mov edx, 1
sub edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, 0x402
or edx, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 0x400
jge 0x56c51f
mov ecx, 0x402
mov eax, ebx
call fcn.00403d50
mov esi, dword [ebx]
push str.ProxyServer
lea ecx, [esp + 0x18]
push ecx
lea edi, [esp + 0x18]
call fcn.0041adb0
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
jne 0x56c555
mov eax, dword [ebx]
test eax, eax
je 0x56c55d
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x56c546
sub eax, edx
sar eax, 1
test eax, eax
jl 0x56c5f3
mov ecx, dword [ebx]
cmp eax, dword [ecx - 8]
jg 0x56c5f3
mov dword [ecx - 0xc], eax
mov edx, dword [ebx]
mov word [edx + eax*2], 0
mov edx, dword [ebx]
test edx, edx
jne 0x56c57d
xor eax, eax
jmp 0x56c593
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x56c582
sub eax, esi
sar eax, 1
js 0x56c5f3
cmp eax, dword [edx - 8]
jg 0x56c5f3
mov dword [edx - 0xc], eax
mov ecx, dword [ebx]
mov word [ecx + eax*2], 0
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push str.ProxyEnable
push edx
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, dword [esp + 0x14]
test edi, edi
mov esi, dword [esp + 0x18]
je 0x56c5df
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
push 0x80070057
call fcn.00404550
int3
Function at 0x56c870
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x5a30f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
lea eax, [esp + 0x30]
push eax
call fcn.0056c7d0
add esp, 4
xor esi, esi
mov dword [esp + 0x24], esi
mov ecx, dword [esp + 0x30]
push esi
push ecx
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edx, dword [esp + 0x2c]
push edx
call dword [sym.imp.WS2_32.dll_htonl]
xor ecx, ecx
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
or eax, 1
or ecx, 0x701b8cd8
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
movzx edx, byte [esp + esi + 0x14]
push edx
push str._.2X
lea edi, [esp + 0x38]
call fcn.00403650
add esi, 1
add esp, 8
cmp esi, 5
jb 0x56c8e3
mov eax, dword [esp + 0x30]
mov ebx, dword [eax - 0xc]
push eax
mov eax, ebp
call fcn.00404050
push 4
push str..TMP
push ebp
call fcn.00403fc0
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x56c946
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x56ca70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a7eab
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x838]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], edx
xor ebx, ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x840], ebx
mov ecx, dword [eax + 4]
cmp dword [ecx - 0xc], ebx
lea edi, [eax + 4]
mov dword [esp + 0x20], ebx
jne 0x56cae5
mov edx, dword [eax]
push edi
push edx
call fcn.0056c870
add esp, 8
mov edi, dword [edi]
push ebx
push 0x80
push 3
push ebx
push 7
push closesocket
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x56cbcd
call fcn.004129d0
cmp eax, ebx
jl 0x56cbd4
mov eax, dword [ebp + 0xc]
push ebx
lea ecx, [esp + 0x1c]
push ecx
push eax
push esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x56cb37
call fcn.004129d0
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea edx, [esp + 0x18]
push edx
push 2
lea eax, [esp + 0x28]
push eax
push esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], ebx
call edi
test eax, eax
jne 0x56cb5e
call fcn.004129d0
mov eax, dword [esp + 0x1c]
cmp ax, 0x800
ja 0x56cbba
push ebx
movzx eax, ax
lea ecx, [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x38]
push edx
push esi
mov dword [esp + 0x28], ebx
call edi
test eax, eax
jne 0x56cb87
call fcn.004129d0
cmp esi, ebx
je 0x56cb94
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
movzx eax, word [esp + 0x1c]
mov edx, dword [esp + 0x24]
lea ecx, [ebp + 0x10]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push eax
lea edx, [esp + 0x38]
call fcn.00401f50
mov edi, dword [ebp + 0x10]
add esp, 0xc
test eax, eax
jne 0x56cbbe
mov edi, dword [esp + 0x20]
cmp esi, ebx
je 0x56cbc9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x56cbd8
mov esi, eax
jmp 0x56cb14
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x838]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x820]
xor ecx, esp
call fcn.005787fd
mov esp, ebp
pop ebp
ret 0xc
Function at 0x56cc00
Capabilities:
Access peb ldr_data
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5a7e66
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x818], eax
push ebp
push esi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x82c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x840]
push ecx
mov ecx, dword [esp + 0x848]
push ecx
push eax
lea ecx, [esp + 0x18]
lea edx, [esp + 0x30]
mov dword [esp + 0x18], 0x800
call fcn.00401c40
xor ebp, ebp
add esp, 0xc
mov dword [esp + 0x14], ebp
mov dword [esp + 0x834], ebp
mov edx, dword [0x5fcd20]
mov eax, dword [edx + 0xc]
mov ecx, 0x5fcd20
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x834], 1
mov ecx, dword [edi + 4]
cmp dword [ecx - 0xc], ebp
lea esi, [edi + 4]
jne 0x56cca5
mov edx, dword [edi]
push esi
push edx
call fcn.0056c870
add esp, 8
mov esi, dword [esi]
push 0
push 0x80
push 4
push 0
push 7
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x56cda2
call fcn.004129d0
test eax, eax
jl 0x56cd45
mov eax, dword [esp + 0x83c]
push 0
lea ecx, [esp + 0x24]
push ecx
push eax
push ebp
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x56ccfe
call fcn.004129d0
movzx edx, word [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x10]
push eax
push 2
lea ecx, [esp + 0x1c]
push ecx
push ebp
mov dword [esp + 0x24], edx
call esi
test eax, eax
jne 0x56cd27
call fcn.004129d0
movzx eax, word [esp + 0x10]
push 0
lea edx, [esp + 0x10]
push edx
push eax
lea eax, [esp + 0x30]
push eax
push ebp
call esi
test eax, eax
jne 0x56cd45
call fcn.004129d0
mov byte [esp + 0x834], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x56cd6d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebp, ebp
je 0x56cd78
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x82c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x818]
xor ecx, esp
call fcn.005787fd
add esp, 0x82c
ret 0xc
mov ebp, eax
mov dword [esp + 0x14], ebp
jmp 0x56ccd2
Function at 0x56d040
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, 0x200
lea esi, [edi + 0xc]
mov eax, dword [esi]
push eax
call fcn.00578327
xor eax, eax
add esp, 4
push 0x24
lea ecx, [esp + 0x14]
push ecx
push ebx
lea ecx, [esp + 0x40]
mov dword [esi], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call fcn.0056cc00
add ebx, 0x100
add esi, 4
cmp ebx, 0x600
jb 0x56d061
mov edx, dword [edi + 4]
cmp dword [edx - 0xc], 0
lea esi, [edi + 4]
jne 0x56d0ce
mov eax, dword [edi]
push esi
push eax
call fcn.0056c870
add esp, 8
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005787fd
mov esp, ebp
pop ebp
ret
Function at 0x56d690
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x59e7a1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x14], edi
mov dword [edi], vtable.CQQLoginHelperBase.0
mov dword [esp + 0x20], 6
mov eax, dword [edi + 0x150]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp eax, ebx
je 0x56d701
push 0xffffffffffffffff
push eax
mov dword [edi + 0x154], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [edi + 0x150]
cmp eax, ebx
je 0x56d701
push eax
call esi
mov dword [edi + 0x150], ebx
mov eax, dword [edi + 0x118]
cmp dword [eax - 0xc], ebx
lea ebp, [edi + 0x118]
jle 0x56d727
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x5bcc3c
xor ebx, ebx
mov eax, ebp
call fcn.00404050
mov eax, dword [edi + 0x150]
cmp eax, ebx
je 0x56d73a
push eax
call esi
mov dword [edi + 0x150], ebx
lea esi, [edi + 0x138]
call fcn.0056fbb0
mov byte [esp + 0x20], 3
mov eax, dword [edi + 0x134]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x56d76c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [edi + 0x12c]
push eax
call fcn.00578327
mov dword [edi + 0x12c], ebx
mov byte [esp + 0x24], 1
mov eax, dword [ebp]
sub eax, 0x10
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x56d7a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x20], bl
mov eax, dword [edi + 0x114]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x56d7cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x20], 0xffffffff
mov edi, dword [edi + 0x110]
sub edi, 0x10
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x56d7f5
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x56d910
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [esi + 4], 0
jne 0x56d91d
xor eax, eax
pop ecx
ret 4
mov eax, dword [esi + 0x150]
test eax, eax
je 0x56d955
push 0xffffffffffffffff
push eax
mov dword [esi + 0x154], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x150]
test eax, eax
je 0x56d955
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x150], 0
push ebx
push edi
lea edi, [esi + 0x134]
mov ebx, 0x5bcc3c
mov eax, edi
call fcn.00408510
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x56d978
mov eax, edi
call fcn.00408510
push 0x5bcc3c
lea eax, [esi + 0x110]
xor ebx, ebx
mov dword [esi + 0x10c], 0xffffffff
call fcn.00404050
push 0x5bcc3c
lea eax, [esi + 0x114]
call fcn.00404050
lea eax, [esp + 8]
push eax
push ebx
push esi
push 0x56d9e0
push ebx
push ebx
mov dword [esi + 0x154], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
test eax, eax
setne cl
pop edi
mov dword [esi + 0x150], eax
pop ebx
mov eax, ecx
pop ecx
ret 4

Function at 0x56da30
Capabilities:
Create thread
Delete file

Disassembly:
push ecx
push ebx
xor ebx, ebx
cmp dword [esi + 4], ebx
jne 0x56da3e
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [esi + 0x150]
cmp eax, ebx
je 0x56da72
push 0xffffffffffffffff
push eax
mov dword [esi + 0x154], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x150]
cmp eax, ebx
je 0x56da72
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x150], ebx
mov eax, dword [esi + 0x118]
cmp dword [eax - 0xc], ebx
push edi
lea edi, [esi + 0x118]
jle 0x56da95
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x5bcc3c
call fcn.004040f0
mov eax, dword [esi + 0x12c]
push eax
call fcn.00578327
add esp, 4
lea ecx, [esp + 8]
push ecx
push ebx
push esi
push 0x56dae0
push ebx
mov dword [esi + 0x12c], ebx
push ebx
mov word [esi + 0x130], bx
mov dword [esi + 0x154], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor edx, edx
cmp eax, ebx
setne dl
pop edi
mov dword [esi + 0x150], eax
pop ebx
mov eax, edx
pop ecx
ret

Function at 0x56db30
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push esi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x56db48
or eax, eax
pop esi
ret
mov eax, dword [esp + 8]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x56db65
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or esi, 0xffffffff
mov eax, esi
pop esi
ret
Function at 0x56fa60
Capabilities:
Create thread

Disassembly:
push ecx
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 0x11c], eax
mov dword [esi + 0x120], eax
mov dword [esi + 0x124], eax
mov dword [esi + 0x128], eax
mov eax, dword [esi + 0x150]
test eax, eax
je 0x56fab6
push 0xffffffffffffffff
push eax
mov dword [esi + 0x154], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x150]
test eax, eax
je 0x56fab6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x150], 0
lea ecx, [esp]
push ecx
push 0
push esi
push 0x56faf0
push 0
push 0
mov dword [esi + 0x154], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor edx, edx
test eax, eax
setne dl
mov dword [esi + 0x150], eax
mov eax, edx
pop ecx
ret

Function at 0x570190
Capabilities:
Create thread

Disassembly:
push ecx
push edi
mov edi, eax
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x5701c0
push 0xffffffffffffffff
push eax
mov dword [esi + 0x40], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x5701c0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x3c], 0
mov eax, dword [esp + 0xc]
mov dword [esi + 0x40], 1
mov dword [esi + 0x20], 0xfffffe0c
mov dword [esi + 4], eax
mov ecx, dword [edi]
mov dword [esi + 0x24], ecx
mov edx, dword [edi + 4]
mov dword [esi + 0x28], edx
mov eax, dword [edi + 8]
mov dword [esi + 0x2c], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x30], ecx
mov edx, dword [esi + 0x38]
push edx
call fcn.00578327
movzx edi, bl
push edi
mov dword [esi + 0x38], 0
call fcn.0057740a
add esp, 8
test bl, bl
mov dword [esi + 0x38], eax
je 0x570226
mov ecx, dword [esp + 0x10]
push edi
push ecx
push eax
call fcn.0057e7b0
movzx dx, bl
add esp, 0xc
mov word [esi + 0x34], dx
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x570260
push 0
push 0
mov dword [esi + 0x40], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esi + 0x3c], eax
pop edi
mov eax, ecx
pop ecx
ret 8