joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57a9c8
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x57ab40
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
sete al
and al, byte [ebp + 0xc]
je 0x57aa41
xor edx, edx
mov eax, 0xff
call fcn.0057a6a0
mov dword [ebp - 8], eax
push 0xff
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
push 0x57ab54
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [ebp - 8]
push eax
push edi
push esi
push 0x57ab64
call sub.kernel32.dll_WritePrivateProfileStringA
jmp 0x57ab25
xor ebx, ebx
mov al, byte [ebp + 0x10]
or al, byte [ebp + 8]
je 0x57aa5f
cmp byte [ebp + 8], 0
je 0x57aa54
or ebx, 2
cmp byte [ebp + 0x10], 0
je 0x57aa6a
or ebx, 8
jmp 0x57aa6a
cmp byte [ebp + 0xc], 0
je 0x57aa6a
mov ebx, 4
cmp byte [ebp - 1], 0
je 0x57aa73
or ebx, 1
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x57aab5
push ebx
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.00573d20
mov eax, dword [ebp - 0xc]
call fcn.00573d8c
push eax
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.00573d20
mov eax, dword [ebp - 0x10]
call fcn.00573d8c
push eax
call sub.kernel32.dll_MoveFileExW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
jmp 0x57aac5
push ebx
push edi
push esi
call sub.kernel32.dll_MoveFileExA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
mov eax, ebx
xor al, 1
and al, byte [ebp + 0xc]
je 0x57ab25
mov ebx, 4
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x57ab15
push ebx
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00573d20
mov eax, dword [ebp - 0x14]
call fcn.00573d8c
push eax
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.00573d20
mov eax, dword [ebp - 0x18]
call fcn.00573d8c
push eax
call sub.kernel32.dll_MoveFileExW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
jmp 0x57ab25
push ebx
push edi
push esi
call sub.kernel32.dll_MoveFileExA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57ab47
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00573c28
ret
Function at 0x57ac28
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x57ad33
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00573d20
mov eax, dword [ebp - 0x10]
call fcn.00573d8c
xor ecx, ecx
xor edx, edx
call fcn.0057a6f4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x57ad1d
xor eax, eax
push ebp
push 0x57ad16
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 8], 0
jne 0x57ac9f
push 2
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer
mov dword [ebp - 4], eax
jmp 0x57aca5
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x57acff
cmp dword [esi], 0
jne 0x57acbc
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0057a6a0
mov dword [esi], eax
cmp dword [esi], 0
je 0x57acff
push 0
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x57acff
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
je 0x57acff
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [esi]
xor edx, edx
call fcn.0057a6c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57ad1d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57ad3a
lea eax, [ebp - 0x10]
call fcn.00573c10
ret
Function at 0x57ad48
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x57ae31
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x14]
mov edx, edi
call fcn.00573d20
mov eax, dword [ebp - 0x14]
call fcn.00573d8c
mov ecx, ebx
mov dl, 1
call fcn.0057a6f4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x57ae1b
xor eax, eax
push ebp
push 0x57ae14
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
jne 0x57add4
cmp dword [ebp + 8], 0
jne 0x57adc3
push 2
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer
jmp 0x57add4
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x10]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
cmp esi, dword [ebp - 0x10]
sete al
and al, byte [ebp - 5]
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57ae1b
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57ae38
lea eax, [ebp - 0x14]
call fcn.00573c10
ret

Function at 0x57ae44
Capabilities:
Parse pe header

Disassembly:
push esi
xor esi, esi
test eax, eax
je 0x57ae90
mov edx, eax
mov ecx, dword [edx + 0x3c]
add ecx, eax
cmp word [edx], 0x5a4d
jne 0x57ae90
cmp dword [ecx], 0x4550
jne 0x57ae90
mov eax, ecx
add eax, 4
add eax, 0x14
add eax, 0xe0
xor edx, edx
push edx
push eax
movzx eax, word [ecx + 6]
dec eax
shl eax, 3
lea eax, [eax + eax*4]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, eax
mov esi, dword [edx + 0x14]
add esi, dword [edx + 0x10]
mov eax, esi
pop esi
ret
Function at 0x57ae94
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x57afcc
xor eax, eax
push ebp
push 0x57afc5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetTokenInformation
cmp dword [ebp - 8], 0
je 0x57afae
mov eax, dword [ebp - 8]
add eax, eax
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_2
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
push 3
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
je 0x57afa8
lea eax, [ebp - 0x10]
push eax
push 0x57afd4
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x57af35
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
push 0x57afe8
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x57af57
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov esi, dword [ebx]
dec esi
test esi, esi
jl 0x57af94
inc esi
xor ecx, ecx
lea edi, [ecx + ecx*2]
mov eax, dword [ebx + edi*4 + 4]
mov edx, dword [ebx + edi*4 + 8]
cmp edx, dword [ebp - 0xc]
jne 0x57af74
cmp eax, dword [ebp - 0x10]
je 0x57af90
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x14]
jne 0x57af89
cmp eax, dword [ebp - 0x18]
je 0x57af90
or dword [ebx + edi*4 + 0xc], 2
inc ecx
dec esi
jne 0x57af61
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push ebx
call sub.kernel32.dll_LocalFree_2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57afcc
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x57affc
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x57b0eb
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x57b050
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x57b050
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x57b0eb
xor edx, edx
mov eax, 0x400
call fcn.0057a6a0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x57b0e2
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x58a35c
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x57b0d8
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x57b0d4
mov byte [esp], 1
jmp 0x57b0d8
inc edi
dec ebx
jne 0x57b0bb
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
xor edx, edx
mov eax, esi
call fcn.0057a6c8
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x57c0d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, eax
mov edi, dword [ebp + 0xc]
mov byte [ebp - 5], 0
xor eax, eax
mov dword [edi], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], ecx
mov eax, dword [ebp - 4]
push eax
push edx
push esi
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
je 0x57c131
push ebx
push esi
call sub.kernel32.dll_SizeofResource
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x57c131
push ebx
push esi
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
je 0x57c131
push ebx
call sub.kernel32.dll_LockResource
mov dword [edi], eax
cmp dword [edi], 0
setne byte [ebp - 5]
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x57c464
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x57c473
or edx, 0x200
test eax, 0x20000000
je 0x57c4a7
test eax, 0x40000000
je 0x57c492
test eax, 0x80000000
je 0x57c48d
or edx, 0x40
jmp 0x57c4ce
or edx, 0x20
jmp 0x57c4ce
test eax, 0x80000000
je 0x57c4a1
or edx, 0x80
jmp 0x57c4ce
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x57c4bf
test eax, 0x80000000
je 0x57c4ba
or edx, 4
jmp 0x57c4ce
or edx, 2
jmp 0x57c4ce
test eax, 0x80000000
je 0x57c4cb
or edx, 8
jmp 0x57c4ce
or edx, 1
mov eax, edx
ret
Function at 0x57f6d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x18]
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 5
mov byte [ebp - 0x21], 0xe9
mov eax, ebx
sub al, 1
jb 0x57f70b
dec al
jne 0x57f721
mov dword [ebp - 0xc], 6
mov byte [ebp - 0x16], 0x68
mov byte [ebp - 0x11], 0xc3
jmp 0x57f721
mov dword [ebp - 0xc], 6
mov byte [ebp - 0x1c], 0xff
mov byte [ebp - 0x1b], 0x25
mov dword [ebp - 0x10], 4
lea eax, [ebp - 8]
push eax
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x57f864
push 0x40
push 0x3000
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 0x14]
add eax, dword [ebp - 0x10]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
je 0x57f864
xor edx, edx
push ebp
push 0x57f82b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
call fcn.005750d4
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov esi, dword [ebp + 8]
mov edx, esi
sub edx, eax
sub edx, 5
mov dword [ebp - 0x20], edx
lea edx, [ebp - 0x21]
mov ecx, dword [ebp + 0x10]
add eax, dword [ebp + 0x14]
mov ecx, 5
call fcn.005750d4
sub bl, 1
jb 0x57f7d1
je 0x57f7fc
dec bl
jne 0x57f81d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x15], eax
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 8]
call fcn.0057f6b0
lea edx, [ebp - 0x16]
mov ecx, dword [ebp - 0xc]
call fcn.005750d4
jmp 0x57f81d
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
add eax, dword [ebp + 0x14]
add eax, 5
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
mov dword [ebp - 0x1a], eax
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 8]
call fcn.0057f6b0
lea edx, [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
call fcn.005750d4
jmp 0x57f81d
mov eax, dword [ebp + 0xc]
sub eax, esi
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 8]
call fcn.0057f6b0
lea edx, [ebp - 0x21]
mov ecx, dword [ebp - 0xc]
call fcn.005750d4
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x57f84f
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_VirtualProtect
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x57f870
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov byte [ebp - 1], 0
cmp dword [esi], 0
je 0x57f95d
mov dword [ebp - 0xc], 6
cmp byte [ebp + 0x10], 1
jne 0x57f8a3
mov dword [ebp - 0xc], 5
mov eax, dword [ebp - 0xc]
add eax, edi
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x57f95d
test bl, bl
je 0x57f8c2
cmp bl, 1
jne 0x57f92b
mov edx, dword [esi]
add edx, edi
lea eax, [ebp - 0x15]
mov ecx, 5
call fcn.005750d4
cmp byte [ebp - 0x15], 0xe9
jne 0x57f95d
mov eax, dword [esi]
add eax, dword [ebp - 0x14]
add eax, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x57f95d
lea eax, [ebp - 8]
push eax
push 0x40
push edi
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x57f95d
mov edx, dword [esi]
mov ecx, edi
mov eax, dword [ebp - 0x10]
call fcn.005750d4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualProtect
test bl, bl
je 0x57f934
cmp bl, 2
jne 0x57f959
cmp byte [ebp + 0x10], 0
jne 0x57f941
mov eax, 4
jmp 0x57f943
xor eax, eax
push 0x8000
lea eax, [eax + edi + 5]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualFree_1
xor eax, eax
mov dword [esi], eax
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x57fcb8
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
push 0x40
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x57fe3d
cmp word [ebx], 0x5a4d
jne 0x57fe3d
mov eax, dword [ebx + 0x3c]
add eax, dword [ebp + 8]
mov ebx, eax
push 0xf8
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x57fe3d
cmp dword [ebx], 0x4550
jne 0x57fe3d
mov eax, dword [ebx + 0xa0]
test eax, eax
je 0x57fe3d
cmp dword [ebx + 0xa4], 0
je 0x57fe3d
add eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
add ebx, 8
jmp 0x57fe1a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
mov edi, eax
dec edi
test edi, edi
jl 0x57fe14
inc edi
push 2
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x57fe0a
mov ax, word [ebx]
xor ax, 0x3000
cmp ax, 0x1000
jae 0x57fe0a
movzx eax, word [ebx]
mov ecx, 0x3000
xor edx, edx
div ecx
mov esi, edx
mov eax, dword [ebp - 8]
add esi, dword [eax]
add esi, dword [ebp + 8]
push 6
mov eax, esi
sub eax, 2
push eax
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x57fe0a
mov eax, esi
sub eax, 2
cmp byte [eax], 0xff
jne 0x57fe0a
mov eax, esi
dec eax
cmp byte [eax], 0x25
je 0x57fdb0
mov eax, esi
dec eax
cmp byte [eax], 0x15
jne 0x57fe0a
push 4
mov eax, dword [esi]
push eax
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x57fe0a
push 4
mov eax, dword [esi]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x57fe0a
mov eax, dword [esi]
mov eax, dword [eax]
cmp eax, dword [ebp + 0xc]
jne 0x57fe0a
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x57fe0a
mov edx, dword [ebp + 0x18]
mov eax, dword [esi]
mov dword [edx], eax
mov edx, dword [ebp + 0x10]
mov dword [eax], edx
inc dword [ebp - 4]
lea edx, [ebp - 0xc]
push edx
mov edx, dword [ebp - 0xc]
push edx
push 4
push eax
call sub.kernel32.dll_VirtualProtect
add ebx, 2
dec edi
jne 0x57fd4e
mov dword [ebp - 8], ebx
add ebx, 8
push 8
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x57fe35
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x57fd37
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x580138
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov byte [ebp - 1], 0
mov esi, dword [ebp + 8]
add esi, dword [ebp + 0xc]
push 0x14
push esi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x5801bb
jmp 0x5801af
mov ebx, dword [esi + 0x10]
add ebx, dword [ebp + 8]
jmp 0x58019b
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x580198
cmp edi, dword [ebx]
jne 0x580188
mov byte [ebp - 1], 1
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
mov eax, dword [ebp + 0x14]
mov dword [ebx], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
add ebx, 4
push 4
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x5801ac
cmp dword [ebx], 0
jne 0x580164
add esi, 0x14
cmp dword [esi + 0xc], 0
je 0x5801bb
cmp dword [esi + 0x10], 0
jne 0x58015c
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0x14

Function at 0x5801c8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov edi, dword [ebp + 8]
push 0x40
push edi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x58021d
cmp word [edi], 0x5a4d
jne 0x58021d
mov esi, edi
add esi, dword [edi + 0x3c]
push 0xf8
push esi
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
jne 0x58021d
cmp dword [esi], 0x4550
jne 0x58021d
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [esi + 0x80]
push eax
push edi
call fcn.00580138
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x580d98
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
xor edx, edx
push ebp
push 0x580ddd
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [eax], 0x5a4d
je 0x580dc1
pop dword fs:[0]
add esp, 8
jmp 0x580de9
lea edx, [eax + 0x3c]
movzx ebx, word [edx]
add ebx, eax
cmp dword [ebx], 0x4550
je 0x580dd3
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x580de9
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x580fd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x580fd8
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x58111c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [esi], eax
mov byte [ebp - 0xd], 0
xor ecx, ecx
push ebp
push 0x5810f6
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, ebx
call fcn.00580d98
mov eax, dword [eax + 0x7c]
test eax, eax
jne 0x581025
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x581100
mov eax, ebx
call fcn.00580df0
add ebx, dword [eax + 0x1c]
mov edx, ebx
shr edx, 0xc
mov dword [ebp - 8], edx
mov edx, ebx
and edx, 0xfff
mov ecx, edx
add ecx, dword [eax + 0x14]
mov eax, ecx
shl eax, 2
add eax, 0xfff
shr eax, 0xc
mov dword [ebp - 4], eax
sub ebx, edx
mov eax, dword [ebp - 4]
shl eax, 0xc
push eax
mov edi, ebx
push edi
call sub.kernel32.dll_IsBadWritePtr
cmp eax, 1
sbb eax, eax
neg eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x5810ec
lea eax, [ebp - 0x30]
call fcn.005775f0
cmp byte [ebp - 0x1e], 0
je 0x581095
push esi
push 0x40
mov eax, dword [ebp - 4]
shl eax, 0xc
push eax
push edi
call sub.kernel32.dll_VirtualProtect
jmp 0x5810d5
push 0x581130
call sub.kernel32.dll_GetModuleHandleA
mov edx, 1
call fcn.00580e38
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
test eax, eax
jne 0x5810bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x581100
push 0x20060000
push 0xffffffff
push dword [ebp - 4]
push dword [ebp - 8]
push 0x1000d
call dword [ebp - 0xc]
mov eax, dword [ebp - 4]
shl eax, 0xc
push eax
push ebx
call sub.kernel32.dll_IsBadWritePtr
cmp eax, 1
sbb eax, eax
neg eax
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x581100
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x581123
lea eax, [ebp - 0x30]
mov edx, dword [0x577500]
call fcn.00573f60
ret