joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c4e10
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x30c
mov eax, dword [0x61fb00]
mov dword [esp + 0x308], eax
mov eax, dword [esp + 0x314]
test eax, eax
jne 0x5c4e38
mov dword [esp + 0x314], 0x5f365c
push ebp
mov ebp, dword [esp + 0x31c]
test ebp, ebp
jne 0x5c4e49
mov ebp, 0x5f365c
mov eax, dword [esp + 0x318]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5c4e53
sub eax, edx
cmp eax, 0x100
ja 0x5c4e78
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5c4e68
sub eax, edx
cmp eax, 0x100
jbe 0x5c4e91
mov eax, 6
pop ebp
mov ecx, dword [esp + 0x308]
call fcn.005ce175
add esp, 0x30c
ret
push edi
mov edi, dword [esp + 0x318]
call fcn.005c3b20
test eax, eax
jne 0x5c5014
push ebx
push esi
mov esi, dword [esp + 0x32c]
push edi
mov dword [edi + 0x5b4], esi
call fcn.005c3ca0
mov eax, dword [edi + 0x4a8]
mov dword [esp + 0x21], eax
lea ecx, [esp + 0x25]
add esp, 4
lea eax, [edi + 0xc]
lea ebx, [esp + 0x10]
lea edx, [esp + 0x14]
mov byte [esp + 0x1a], 0
mov byte [esp + 0x1b], 1
mov byte [esp + 0x1c], 3
mov dword [esp + 0x10], 9
mov dword [esp + 0x14], ecx
call fcn.005c3c60
lea eax, [edi + 0x2c]
call fcn.005c3c60
mov eax, dword [esp + 0x14]
lea edx, [edi + 0x6c]
mov ebx, dword [edx]
mov ecx, eax
mov dword [ecx], ebx
mov edx, dword [edx + 4]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x10]
add eax, 8
add edx, 8
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
lea ebx, [esp + 0x10]
mov eax, ebp
lea edx, [esp + 0x14]
call fcn.005c3c60
mov eax, dword [esp + 0x324]
call fcn.005c3c60
push esi
call sub.WSOCK32.dll_htonl
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov dword [ecx], eax
mov al, byte [edi + 0x5b4]
add esi, 4
add ecx, 4
test al, 8
je 0x5c4f6d
mov eax, dword [edi + 0x494]
mov dword [ecx], eax
add esi, 4
add ecx, 4
mov al, byte [edi + 0x5b4]
test al, al
jns 0x5c4f83
mov edx, dword [esp + 0x330]
mov dword [ecx], edx
add esi, 4
push esi
call sub.WSOCK32.dll_htons
mov ecx, dword [edi + 0x4a0]
xor ebx, ebx
push ebx
mov word [esp + 0x1c], ax
push esi
lea eax, [esp + 0x20]
push eax
push ecx
call sub.WSOCK32.dll_send
test eax, eax
jg 0x5c4fcc
push edi
call fcn.005c4610
add esp, 4
pop esi
pop ebx
pop edi
mov eax, 3
pop ebp
mov ecx, dword [esp + 0x308]
call fcn.005ce175
add esp, 0x30c
ret
cmp dword [edi + 0x74], ebx
mov dword [edi], 3
mov dword [edi + 0x5b8], ebx
jne 0x5c5010
push 0x1000
call fcn.005cde04
add esp, 4
cmp eax, ebx
mov dword [edi + 0x74], eax
jne 0x5c500d
pop esi
pop ebx
pop edi
mov eax, 5
pop ebp
mov ecx, dword [esp + 0x308]
call fcn.005ce175
add esp, 0x30c
ret
mov dword [edi + 0x78], ebx
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x310]
pop edi
pop ebp
call fcn.005ce175
add esp, 0x30c
ret
Function at 0x5c5030
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x20
mov eax, dword [0x61fb00]
push ebx
push esi
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
cmp dword [esi], 1
mov ebx, 2
mov dword [esp + 8], 1
mov byte [esp + 0xc], 0xfe
mov byte [esp + 0xd], 0xfd
mov byte [esp + 0xe], bl
mov byte [esp + 0xf], 0
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
je 0x5c5084
push esi
call fcn.005c4610
add esp, 4
push 0x11
push ebx
push ebx
call sub.WS2_32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x4a0], eax
je 0x5c50b0
push 4
lea ecx, [esp + 0xc]
push ecx
push 0x20
push 0xffff
push eax
call sub.WS2_32.dll_setsockopt
test eax, eax
je 0x5c50c4
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x1c]
call fcn.005ce175
add esp, 0x20
ret
mov eax, dword [esp + 0x30]
mov word [esp + 0x14], bx
mov ebx, dword [esp + 0x34]
movzx edx, ax
movzx ecx, bx
sub ecx, edx
cmp ecx, 0x1f4
mov dword [esp + 0x18], 0xffffffff
jle 0x5c50ef
lea ebx, [eax + 0x1f4]
cmp ax, bx
push edi
mov edi, eax
ja 0x5c5143
push ebp
mov ebp, dword [esp + 0x40]
lea esp, [esp]
push edi
call sub.WSOCK32.dll_htons
cmp ebp, 1
push 0x10
lea edx, [esp + 0x20]
push edx
mov word [esp + 0x26], ax
push 0
jne 0x5c5129
mov ecx, dword [esi + 0x4a0]
push 8
lea eax, [esp + 0x24]
push eax
push ecx
jmp 0x5c5137
mov eax, dword [esi + 0x4a0]
push 0xa
push str.echo_test
push eax
call sub.WS2_32.dll_sendto
inc edi
cmp di, bx
jbe 0x5c5100
pop ebp
mov dword [esi], 0
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esp + 0x28]
pop edi
mov dword [esi + 0x4a4], eax
pop esi
xor eax, eax
pop ebx
call fcn.005ce175
add esp, 0x20
ret
Function at 0x5c5380
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x78]
xor ebx, ebx
cmp eax, 3
push edi
jl 0x5c528d
mov eax, dword [esi + 0x74]
movzx eax, word [eax]
push eax
call sub.WSOCK32.dll_ntohs
cmp ax, 0x1000
ja 0x5c5269
movzx edi, ax
cmp dword [esi + 0x78], edi
jl 0x5c5293
mov eax, dword [esi + 0x74]
movsx ecx, byte [eax + 2]
dec ecx
cmp ecx, 3
ja case.default.0x5c51b6
jmp dword [ecx*4 + 0x5c529c]
lea ecx, [edi - 3]
push ecx
add eax, 3
mov ecx, esi
call fcn.005c4b20
add esp, 4
mov ebx, eax
jmp case.default.0x5c51b6
lea edx, [edi - 3]
push edx
add eax, 3
push eax
call fcn.005c4bf0
add esp, 8
mov ebx, eax
jmp case.default.0x5c51b6
push 0
push edi
push eax
mov eax, dword [esi + 0x4a0]
push eax
call sub.WSOCK32.dll_send
test eax, eax
jg case.default.0x5c51b6
pop edi
pop esi
mov eax, 3
pop ebx
ret
lea ecx, [edi - 3]
cmp ecx, 6
jge 0x5c5212
mov ebx, 4
jmp case.default.0x5c51b6
mov ecx, dword [eax + 3]
movzx eax, word [eax + 7]
push eax
push ecx
push esi
call fcn.005c4140
add esp, 0xc
cmp eax, 0xffffffff
je 0x5c5233
push eax
push esi
call fcn.005c41b0
add esp, 8
xor ebx, ebx
mov eax, dword [esi + 0x78]
sub eax, edi
mov dword [esi + 0x78], eax
mov ecx, eax
je 0x5c5255
mov eax, dword [esi + 0x74]
test eax, eax
je 0x5c5255
push ecx
add edi, eax
push edi
push eax
call fcn.005c8800
add esp, 0xc
test ebx, ebx
jne 0x5c526e
cmp dword [esi + 0x78], 3
jge 0x5c5183
pop edi
pop esi
mov eax, ebx
pop ebx
ret
mov ebx, 4
mov edx, dword [esi + 0x484]
mov eax, dword [0x63d628]
push edx
push eax
push 4
push esi
call dword [esi + 0x480]
push esi
call fcn.005c4610
add esp, 0x14
pop edi
pop esi
mov eax, ebx
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
push esi
mov esi, eax
mov eax, dword [esi + 0x4a0]
push eax
call fcn.005c2450
add esp, 4
test eax, eax
jne 0x5c52c8
pop esi
ret
mov edx, dword [esi + 0x74]
mov eax, dword [esi + 0x4a0]
push edi
mov edi, dword [esi + 0x78]
push 0
mov ecx, 0x1000
sub ecx, edi
push ecx
add edx, edi
push edx
push eax
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
je 0x5c534c
test eax, eax
je 0x5c534c
mov edx, dword [esi + 0x78]
mov ecx, dword [esi]
add edx, eax
cmp ecx, 2
mov dword [esi + 0x78], edx
mov eax, edx
je 0x5c530c
mov ecx, dword [esi + 0x5b8]
test ecx, ecx
jle 0x5c5324
mov ecx, dword [esi + 0x74]
sub eax, edi
push eax
add ecx, edi
push ecx
lea edx, [esi + 0x4ac]
push edx
call fcn.005c8220
add esp, 0xc
cmp dword [esi], 3
jne 0x5c5332
call fcn.005c47b0
test eax, eax
jne 0x5c5371
cmp dword [esi], 2
jne 0x5c5347
mov eax, dword [esi + 0x78]
test eax, eax
jle 0x5c5347
pop edi
mov eax, esi
pop esi
jmp 0x5c5170
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x484]
mov ecx, dword [0x63d628]
push eax
push ecx
push 4
push esi
call dword [esi + 0x480]
push esi
call fcn.005c4610
add esp, 0x14
mov eax, 3
pop edi
pop esi
ret
push esi
mov esi, dword [esp + 8]
push esi
call fcn.005c4250
mov eax, dword [esi]
add esp, 4
test eax, eax
je 0x5c53aa
cmp eax, 1
jle 0x5c53a6
cmp eax, 3
jg 0x5c53a6
mov eax, esi
pop esi
jmp 0x5c52b0
xor eax, eax
pop esi
ret
push esi
call fcn.005c4cc0
add esp, 4
pop esi
ret
Function at 0x5c53c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, eax
mov ebp, 1
xor ebx, ebx
lea ecx, [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x4a0]
push ebx
push eax
push ecx
push edx
dec ebp
call sub.WSOCK32.dll_send
cmp eax, ebx
jg 0x5c5486
cmp ebp, ebx
jl 0x5c547c
mov eax, dword [esi + 0x74]
cmp eax, ebx
je 0x5c5408
push eax
call fcn.005cdbb7
add esp, 4
mov eax, dword [esi + 0x4a0]
or edi, 0xffffffff
cmp eax, edi
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
je 0x5c5421
push eax
call sub.WSOCK32.dll_closesocket
mov dword [esi + 0x4a0], edi
mov dword [esi], 1
call fcn.005c4570
mov dword [esi + 0x47c], edi
call fcn.005c44e0
push ebx
push 2
push ebx
push ebx
push esi
call fcn.005c4e10
mov edi, eax
add esp, 0x14
cmp edi, ebx
je 0x5c53d0
mov eax, dword [esi + 0x484]
mov ecx, dword [0x63d628]
push eax
push ecx
push 4
push esi
call dword [esi + 0x480]
push esi
call fcn.005c4610
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x5c5520
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x61fb00]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
cmp dword [esi], 1
jne 0x5c5561
push 0
push 2
push 0
push 0
push esi
call fcn.005c4e10
mov eax, dword [esi]
add esp, 0x14
cmp eax, 1
jne 0x5c5561
mov eax, 3
pop esi
mov ecx, dword [esp + 0x10]
call fcn.005ce175
add esp, 0x14
ret
push edi
mov edi, dword [esp + 0x30]
lea eax, [edi + 9]
push eax
call sub.WSOCK32.dll_htons
mov ecx, dword [esp + 0x24]
mov dx, word [esp + 0x28]
mov word [esp + 8], ax
lea eax, [esp + 8]
push 9
push eax
mov eax, esi
mov byte [esp + 0x12], 2
mov dword [esp + 0x13], ecx
mov word [esp + 0x17], dx
call fcn.005c53c0
add esp, 8
test eax, eax
jne 0x5c55c0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esi + 0x4a0]
push eax
push edi
push ecx
push edx
call sub.WSOCK32.dll_send
xor ecx, ecx
test eax, eax
setge cl
dec ecx
and ecx, 3
mov eax, ecx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
call fcn.005ce175
add esp, 0x14
ret

Function at 0x5c6020
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
push 0
push esi
call fcn.005c5eb0
call fcn.005c2360
push esi
call fcn.005c5f40
add esp, 0x10
test eax, eax
jne 0x5c6054
mov dword [esi + 0xc0], 1
mov dword [esi + 0x34], 3
pop esi
ret
push edi
mov edi, dword [0x6be3e8]
test edi, edi
jne 0x5c6062
mov edi, dword [esi + 0x18]
push edi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esi + 0x1c], eax
jne 0x5c6098
push edi
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x5c608e
pop edi
mov dword [esi + 0xc0], 1
mov dword [esi + 0x34], 4
pop esi
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [esi + 0x1c], edx
push 0
push 0
push esi
mov dword [esi + 0x10], 1
call fcn.005c5eb0
add esp, 0xc
pop edi
pop esi
ret
Function at 0x5c60b0
Capabilities:
Connect socket

Disassembly:
sub esp, 0x18
mov eax, dword [0x61fb00]
push esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x18], eax
cmp dword [esi + 0x44], 0xffffffff
push edi
mov edi, 1
jne 0x5c61ac
push 6
push edi
push 2
call sub.WS2_32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x44], eax
je 0x5c60f2
push 0
push eax
call fcn.005c23f0
add esp, 8
test eax, eax
jne 0x5c6104
mov dword [esi + 0xc0], edi
mov dword [esi + 0x34], 5
jmp 0x5c620c
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x5c6120
mov eax, dword [0x61f394]
mov ecx, dword [esi + 0x44]
push eax
push ecx
call fcn.005c2420
add esp, 8
mov eax, dword [0x6be3e8]
xor edx, edx
test eax, eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
mov word [esp + 0xc], 2
je 0x5c614d
xor eax, eax
mov ax, word [0x6be3e4]
push eax
jmp 0x5c6154
xor ecx, ecx
mov cx, word [esi + 0x20]
push ecx
call sub.WSOCK32.dll_htons
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x1c]
mov word [esp + 0xe], ax
push 0x10
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x1c], edx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x5c61ac
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x5c61ac
cmp eax, 0x2734
je 0x5c61ac
mov dword [esi + 0xc0], edi
pop edi
mov dword [esi + 0x34], 6
mov dword [esi + 0x48], eax
pop esi
mov ecx, dword [esp + 0x14]
call fcn.005ce175
add esp, 0x18
ret
mov ecx, dword [esi + 0x44]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push ecx
call fcn.005c6e80
add esp, 0x10
test eax, eax
je 0x5c61fb
mov ecx, dword [esp + 0x24]
test ecx, ecx
jne 0x5c61fb
mov eax, dword [esp + 8]
test eax, eax
je 0x5c6214
push 0
push 0
push esi
mov dword [esi + 0x10], 2
call fcn.005c5eb0
add esp, 0xc
pop edi
pop esi
mov ecx, dword [esp + 0x14]
call fcn.005ce175
add esp, 0x18
ret
test eax, eax
mov dword [esi + 0xc0], edi
mov dword [esi + 0x34], 6
jne 0x5c6214
call sub.WS2_32.dll_WSAGetLastError
mov dword [esi + 0x48], eax
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
call fcn.005ce175
add esp, 0x18
ret
Function at 0x5c6e80
Capabilities:
Get socket status

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x314
push ebx
push ebp
xor edx, edx
push esi
cmp eax, edx
mov eax, dword [esp + 0x324]
push edi
mov ecx, 1
je 0x5c6eae
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
lea edi, [esp + 0x18]
jmp 0x5c6eb0
xor edi, edi
cmp dword [esp + 0x330], edx
je 0x5c6ed0
mov dword [esp + 0x120], eax
mov dword [esp + 0x11c], ecx
lea ebx, [esp + 0x11c]
jmp 0x5c6ed2
xor ebx, ebx
cmp dword [esp + 0x334], edx
je 0x5c6ef2
mov dword [esp + 0x224], eax
mov dword [esp + 0x220], ecx
lea ebp, [esp + 0x220]
jmp 0x5c6ef4
xor ebp, ebp
lea eax, [esp + 0x10]
push eax
push ebp
push ebx
push edi
push 0x40
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], edx
call sub.WSOCK32.dll_select
mov esi, eax
cmp esi, 0xffffffff
jne 0x5c6f1f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x314
ret
mov eax, dword [esp + 0x32c]
test eax, eax
je 0x5c6f5c
test esi, esi
jle 0x5c6f4f
mov ecx, dword [esp + 0x328]
push edi
push ecx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x5c6f4f
mov edx, dword [esp + 0x32c]
mov dword [edx], 1
jmp 0x5c6f5c
mov eax, dword [esp + 0x32c]
mov dword [eax], 0
mov edi, dword [esp + 0x330]
test edi, edi
je 0x5c6f8b
test esi, esi
jle 0x5c6f85
mov ecx, dword [esp + 0x328]
push ebx
push ecx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x5c6f85
mov dword [edi], 1
jmp 0x5c6f8b
mov dword [edi], 0
mov edi, dword [esp + 0x334]
test edi, edi
je 0x5c6fc8
test esi, esi
jle 0x5c6fc2
mov edx, dword [esp + 0x328]
push ebp
push edx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x5c6fc2
mov dword [edi], 1
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x314
ret
mov dword [edi], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x314
ret

Function at 0x5c6fe0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xf8]
push edi
mov edi, dword [ebx]
dec edi
test eax, eax
je 0x5c701e
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esi + 0xfc]
add ecx, dword [0x61f398]
cmp eax, ecx
jb 0x5c706b
mov dword [esi + 0xfc], eax
mov eax, dword [0x61f394]
cmp edi, eax
jl 0x5c701e
mov edi, eax
mov edx, dword [esi + 0x44]
push 0
push edi
mov edi, dword [esp + 0x1c]
push edi
push edx
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x5c7074
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x5c706b
cmp eax, 0x2734
je 0x5c706b
mov ecx, 1
pop edi
mov dword [esi + 0x48], eax
mov dword [esi + 0xc0], ecx
mov dword [esi + 0x34], 5
mov dword [esi + 0xf4], ecx
pop esi
mov eax, 3
pop ebx
ret
pop edi
pop esi
mov eax, 1
pop ebx
ret
test eax, eax
jne 0x5c708b
pop edi
mov dword [esi + 0xf4], 1
pop esi
mov eax, 2
pop ebx
ret
mov byte [eax + edi], 0
pop edi
mov dword [ebx], eax
pop esi
xor eax, eax
pop ebx
ret
Function at 0x5c70a0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
mov edx, dword [esi + 0x44]
push 0
push eax
push ecx
push edx
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x5c70e8
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x5c70cf
xor eax, eax
pop esi
ret
mov dword [esi + 0x48], eax
mov dword [esi + 0xc0], 1
mov dword [esi + 0x34], 5
or eax, 0xffffffff
pop esi
ret
cmp dword [esi + 0x10], 3
jne 0x5c70f4
add dword [esi + 0x10c], eax
pop esi
ret

Function at 0x5c9346
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x5c9366
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.005cb207
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x5c9389
test byte [esp + 8], 2
je 0x5c9389
call fcn.005cb1f5
mov dword [eax], 0xd
call fcn.005cb1fe
mov dword [eax], 5
jmp 0x5c9362
xor eax, eax
ret

Function at 0x5caf01
Capabilities:
Terminate process

Disassembly:
push 8
push 0x5ed250
call fcn.005cf2a0
push 8
call fcn.005cf26f
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x63e128], esi
jne 0x5caf35
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x63e124], esi
mov al, byte [ebp + 0x10]
mov byte [0x63e120], al
cmp dword [ebp + 0xc], edi
jne 0x5caf7f
cmp dword [0x6bec34], edi
je 0x5caf6f
mov eax, dword [0x6bec30]
sub eax, 4
mov dword [0x6bec30], eax
cmp eax, dword [0x6bec34]
jb 0x5caf6f
mov eax, dword [eax]
cmp eax, edi
je 0x5caf50
call eax
jmp 0x5caf50
push 0x615040
mov eax, 0x615034
call fcn.005cae7f
pop ecx
push 0x61504c
mov eax, 0x615044
call fcn.005cae7f
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x5cafb0
cmp dword [ebp + 0x10], edi
jne 0x5cafbe
mov dword [0x63e128], esi
push dword [ebp + 8]
call fcn.005cae3d
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x5cafbd
push 8
call fcn.005cf1ba
pop ecx
ret
call fcn.005cf2db
ret

Function at 0x5cb998
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
jne 0x5cb9b4
call fcn.005cb1f5
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x5cba26
push esi
push 0x8c
push 1
call fcn.005cfa00
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x5cba0c
push esi
call fcn.005cfb7c
mov eax, dword [esp + 0x1c]
pop ecx
push esi
push 4
push esi
push 0x5cb906
push dword [esp + 0x24]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x5cba04
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x5cba23
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.005cdbb7
test ebx, ebx
pop ecx
je 0x5cba1e
push ebx
call fcn.005cb207
pop ecx
or eax, 0xffffffff
jmp 0x5cba25
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x5cced5
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x5ed518
call fcn.005cf2a0
mov edi, 0x94
mov eax, edi
call fcn.005cd210
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x63e0e8], ecx
mov eax, dword [esi + 4]
mov dword [0x63e0f4], eax
mov edx, dword [esi + 8]
mov dword [0x63e0f8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x63e0ec], esi
cmp ecx, 2
je 0x5ccf35
or esi, 0x8000
mov dword [0x63e0ec], esi
shl eax, 8
add eax, edx
mov dword [0x63e0f0], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x5ccf70
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5ccf70
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x5ccf88
cmp eax, 0x20b
je 0x5ccf75
mov dword [ebp - 0x1c], esi
jmp 0x5ccf9c
cmp dword [ecx + 0x84], 0xe
jbe 0x5ccf70
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x5ccf96
cmp dword [ecx + 0x74], 0xe
jbe 0x5ccf70
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.005d6fb6
pop ecx
test eax, eax
jne 0x5ccfb0
push 0x1c
call fcn.005cceb1
pop ecx
call fcn.005cfd76
test eax, eax
jne 0x5ccfc1
push 0x10
call fcn.005cceb1
pop ecx
call fcn.005d3ed3
mov dword [ebp - 4], esi
call fcn.005cf802
test eax, eax
jge 0x5ccfda
push 0x1b
call fcn.005cce8c
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x6bec28], eax
call fcn.005d6e7a
mov dword [0x63e234], eax
call fcn.005d6dd8
test eax, eax
jge 0x5cd000
push 8
call fcn.005cce8c
pop ecx
call fcn.005d6ba5
test eax, eax
jge 0x5cd011
push 9
call fcn.005cce8c
pop ecx
push 1
call fcn.005cae97
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x5cd027
push eax
call fcn.005cce8c
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.005d6b48
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x5cd048
movzx eax, word [ebp - 0x40]
jmp 0x5cd04b
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00544940
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x5cd069
push edi
call fcn.005cafc4
call fcn.005cafe6
jmp 0x5cd09b
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.005cf2db
ret
Function at 0x5cede7
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x61fb00]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x5cee18
xor eax, eax
jmp 0x5cefa1
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x6beb20]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x5cee54
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.005db8f5
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x5cef2f
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x5cef6d
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x5ceeb8
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x5ceea9
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x5cee89
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5ceef8
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x5cef01
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x5cee7a
jmp 0x5cef03
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x5cef9c
cmp dword [ebp - 0x6c], edi
je 0x5cef6d
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x5cef62
call fcn.005cb1f5
mov dword [eax], 9
call fcn.005cb1fe
mov dword [eax], esi
jmp 0x5cef97
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x5cef57
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x5cef03
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x5cef03
push dword [ebp - 0x6c]
call fcn.005cb207
pop ecx
jmp 0x5cef97
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x5cef85
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x5cef85
xor eax, eax
jmp 0x5cef9f
call fcn.005cb1f5
mov dword [eax], 0x1c
call fcn.005cb1fe
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x5cef9f
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.005ce175
add ebp, 0x3a0
leave
ret