joyce8/EMBER2024-capa huggingface dataset:
Function at 0x551640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6c7838
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
call fcn.00542ad0
xor ecx, ecx
mov dword [esi], 0x6e7f28
mov dword [esi + 0x498], ecx
lea eax, [esi + 0x49c]
add eax, 0x38
add eax, 0x38
mov dword [eax - 0x70], ecx
mov dword [eax - 0x6c], ecx
mov dword [eax - 0x68], ecx
mov dword [eax - 0x64], ecx
mov dword [eax - 0x60], ecx
mov dword [eax - 0x5c], ecx
mov dword [eax - 0x58], ecx
mov dword [eax - 0x54], ecx
mov dword [eax - 0x50], ecx
mov dword [eax - 0x4c], ecx
mov dword [eax - 0x48], ecx
mov dword [eax - 0x44], ecx
mov dword [eax - 0x40], ecx
add eax, 0x38
mov dword [eax - 0x74], ecx
mov dword [eax - 0x70], ecx
mov dword [eax - 0x6c], ecx
mov dword [eax - 0x68], ecx
mov dword [eax - 0x64], ecx
mov dword [eax - 0x60], ecx
mov dword [eax - 0x5c], ecx
mov dword [eax - 0x58], ecx
mov dword [eax - 0x54], ecx
mov dword [eax - 0x50], ecx
mov dword [eax - 0x4c], ecx
mov dword [eax - 0x48], ecx
mov dword [eax - 0x44], ecx
mov dword [eax - 0x40], ecx
add eax, 0x38
mov dword [eax - 0x74], ecx
mov dword [eax - 0x70], ecx
mov dword [eax - 0x6c], ecx
mov dword [eax - 0x68], ecx
mov dword [eax - 0x64], ecx
mov dword [eax - 0x60], ecx
mov dword [eax - 0x5c], ecx
mov dword [eax - 0x58], ecx
mov dword [eax - 0x54], ecx
mov dword [eax - 0x50], ecx
mov dword [eax - 0x4c], ecx
mov dword [eax - 0x48], ecx
mov dword [eax - 0x44], ecx
mov dword [eax - 0x40], ecx
mov dword [eax - 0x3c], ecx
mov dword [eax - 0x38], ecx
mov dword [eax - 0x34], ecx
mov dword [eax - 0x30], ecx
mov dword [eax - 0x2c], ecx
mov dword [eax - 0x28], ecx
mov dword [eax - 0x24], ecx
mov dword [eax - 0x20], ecx
mov dword [eax - 0x1c], ecx
mov dword [eax - 0x18], ecx
mov dword [eax - 0x14], ecx
mov dword [eax - 0x10], ecx
mov dword [eax - 0xc], ecx
mov dword [eax - 8], ecx
mov dword [eax - 4], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
add eax, 0x38
mov dword [eax - 4], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [esi + 0x5f0], ecx
mov dword [esi + 0x5f4], ecx
mov dword [esi + 0x5f8], ecx
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x55a710
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x6c7cb4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.004fcbf0
mov dword [esi + 4], eax
mov bl, 1
mov byte [eax + 0x1d], bl
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [eax], eax
mov eax, dword [esi + 4]
xor ebp, ebp
mov dword [eax + 8], eax
mov dword [esi + 8], ebp
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 0x1c], ebp
call fcn.004fcbf0
mov dword [edi + 4], eax
mov byte [eax + 0x1d], bl
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
lea edi, [esi + 0x18]
mov ecx, edi
mov byte [esp + 0x1c], bl
call fcn.004fcbf0
mov dword [edi + 4], eax
mov byte [eax + 0x1d], bl
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
lea edi, [esi + 0x24]
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.004fcbf0
mov dword [edi + 4], eax
mov byte [eax + 0x1d], bl
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
lea edi, [esi + 0x30]
mov ecx, edi
mov byte [esp + 0x1c], 3
call fcn.004fcbf0
mov dword [edi + 4], eax
mov byte [eax + 0x1d], bl
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
mov ecx, esi
mov byte [esp + 0x1c], 4
call fcn.00559160
mov ecx, esi
call fcn.00559580
mov ecx, esi
call fcn.005599a0
mov ecx, esi
call fcn.00559dc0
mov ecx, esi
call fcn.0055a1a0
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x578920
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x57898c
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov edi, dword [esp + 0xc]
push edi
call fcn.0062f7d0
add esp, 4
inc eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x578976
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x57896d
push edi
push eax
call fcn.00630960
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
test esi, esi
je 0x578987
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov al, 1
pop esi
ret
xor al, al
ret

Function at 0x579190
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x74ec58]
test al, al
jne 0x57919e
call fcn.005790f0
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
test esi, esi
jle 0x5791d3
push ebx
push edi
mov edi, dword [esp + 0x10]
xor edx, edx
mov dl, byte [ecx + edi]
xor edx, eax
and edx, 0xff
mov ebx, dword [edx*4 + 0x74ec60]
shr eax, 8
xor eax, ebx
inc ecx
cmp ecx, esi
jl 0x5791b3
pop edi
pop ebx
pop esi
ret

Function at 0x579880
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x14
push edi
mov ebx, ecx
ja 0x5798b1
je 0x5798a6
mov eax, esi
sub eax, 2
je 0x57989c
sub eax, 0xe
jne 0x5798d1
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x5798d1
pop edi
pop esi
mov eax, 1
pop ebx
ret 0xc
cmp esi, 0x104
jne 0x5798d1
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ax, ax
jl 0x5798ec
push 0x79
call edi
test ax, ax
jl 0x5798ec
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebx + 4]
push eax
push ecx
push esi
push edx
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop edi
pop esi
pop ebx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x57da20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x6c8d2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov ecx, dword [esp + 0x50]
push ebx
push ebp
push esi
push edi
lea esi, [esp + 0x34]
call fcn.0057c800
xor ebx, ebx
mov edi, 0xf
mov dword [esp + 0x58], ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov eax, dword [esp + 0x4c]
mov ebp, 0x10
cmp eax, ebp
mov eax, dword [esp + 0x38]
mov byte [esp + 0x58], 1
jae 0x57da7a
lea eax, [esp + 0x38]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
push ecx
call fcn.0057b8c0
add esp, 0xc
test al, al
jne 0x57db91
cmp dword [esp + 0x4c], ebp
mov eax, dword [esp + 0x38]
jae 0x57daa7
lea eax, [esp + 0x38]
cmp byte [eax], bl
je 0x57dac0
jmp 0x57dab0
cmp byte [eax], 0x2f
jne 0x57dab8
mov byte [eax], 0x5c
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x57dab0
cmp dword [esp + 0x4c], ebp
mov eax, dword [esp + 0x38]
jae 0x57dace
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x57db4a
test al, 0x10
jne 0x57db4a
push 0x34
call fcn.0062e875
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x58], 2
je 0x57db15
cmp dword [esp + 0x4c], ebp
mov ecx, dword [esp + 0x38]
jae 0x57db03
lea ecx, [esp + 0x38]
push 0x2000
push ebx
push ecx
mov ecx, eax
call fcn.005869a0
mov esi, eax
jmp 0x57db17
xor esi, esi
cmp dword [esp + 0x30], ebp
jb 0x57db2a
mov edx, dword [esp + 0x1c]
push edx
call fcn.00630114
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
jb 0x57dbde
mov eax, dword [esp + 0x38]
push eax
jmp 0x57dbd6
cmp dword [esp + 0x30], ebp
jb 0x57db5d
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00630114
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
jb 0x57db7c
mov edx, dword [esp + 0x38]
push edx
call fcn.00630114
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
add esp, 0x4c
ret
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
push 1
push eax
call fcn.0057d6d0
mov esi, eax
mov eax, dword [esp + 0x38]
add esp, 8
cmp eax, ebp
jb 0x57dbbb
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00630114
add esp, 4
cmp dword [esp + 0x4c], ebp
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
jb 0x57dbde
mov edx, dword [esp + 0x38]
push edx
call fcn.00630114
add esp, 4
mov ecx, dword [esp + 0x50]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x57ef80
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
mov al, byte [0x74f109]
sub esp, 0x24
test al, al
jne 0x57efd7
push 0x74f0f8
mov byte [0x74f109], 1
call fcn.0062f5bf
add esp, 4
rdtsc
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0x74f0f0
mov dword [0x74f0e8], eax
mov dword [0x74f0ec], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0x74f0e0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add esp, 0x24
ret
push esi
lea edx, [esp + 4]
push edi
push edx
call fcn.0062f5bf
add esp, 4
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
rdtsc
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov eax, dword [0x74f0e0]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov edi, dword [0x74f0e4]
sub ecx, eax
sbb edx, edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
fild qword [esp + 0x14]
mov eax, dword [0x74f0f8]
fild qword [0x74f0f0]
mov ecx, dword [esp + 8]
push eax
push ecx
fdivp st(1)
fst qword [esp + 0x1c]
fsub qword [0x6ec200]
fstp qword [esp + 0x2c]
call fcn.0063457c
fcomp qword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
add esp, 8
fnstsw ax
test ah, 0x41
jne 0x57f08d
mov eax, dword [0x74f0e8]
mov ecx, dword [0x74f0ec]
mov edx, edi
sub edx, eax
mov eax, esi
sbb eax, ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
fild qword [esp + 0x1c]
fdiv qword [esp + 0x14]
call fcn.0063199c
mov dword [0x74f100], eax
mov dword [0x74f104], edx
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [0x74f0e8], edi
pop edi
mov dword [0x74f0ec], esi
mov dword [0x74f0f8], ecx
mov dword [0x74f0e0], edx
mov dword [0x74f0e4], eax
pop esi
add esp, 0x24
ret

Function at 0x57f300
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x57f328
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x57f325
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
pop esi
ret
or eax, 0xffffffff
pop esi
ret

Function at 0x57f330
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6c8ea1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x6ec210
mov dword [esp + 0x18], 0
lea edi, [esi + 0x74]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x28]
mov byte [esp + 0x18], 3
call fcn.005880d0
mov ecx, edi
mov byte [esp + 0x18], 2
call fcn.00586cc0
lea edi, [esi + 0x30]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x28]
mov byte [esp + 0x18], 4
call fcn.005880d0
mov ecx, edi
mov byte [esp + 0x18], 1
call fcn.00586cc0
lea ecx, [esi + 0x24]
mov byte [esp + 0x18], 0
call fcn.004231f0
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], 0xffffffff
call fcn.004231f0
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x57f3d0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_getsockopt]
push esi
mov esi, ecx
mov ecx, dword [esi + 0xc]
cmp ecx, 0xffffffff
lea eax, [esi + 0xc]
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
je 0x57f40c
push 4
push eax
mov eax, dword [esi + 4]
push 0x1002
push 0xffff
push eax
call edi
cmp eax, 0xffffffff
jne 0x57f42a
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
lea ecx, [esp + 0xc]
push ecx
push eax
push 0x1002
push 0xffff
push edx
mov dword [esp + 0x20], 4
call ebx
mov ecx, dword [esi + 8]
cmp ecx, 0xffffffff
lea eax, [esi + 8]
je 0x57f454
push 4
push eax
mov eax, dword [esi + 4]
push 0x1001
push 0xffff
push eax
call edi
cmp eax, 0xffffffff
jne 0x57f472
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret
mov edx, dword [esi + 4]
lea ecx, [esp + 0xc]
push ecx
push eax
push 0x1002
push 0xffff
push edx
mov dword [esp + 0x20], 4
call ebx
pop edi
pop esi
mov al, 1
pop ebx
pop ecx
ret

Function at 0x57f480
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6c8ee1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
or eax, 0xffffffff
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x18]
mov dword [esp + 8], esi
mov dword [esi], 0x6ec210
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
call fcn.00584d70
lea ecx, [esi + 0x24]
mov dword [esp + 0x18], 0
call fcn.00584d70
lea edi, [esi + 0x30]
mov ecx, edi
mov byte [esp + 0x18], 1
mov dword [esp + 0xc], edi
call fcn.00586ce0
lea ecx, [edi + 0x28]
mov byte [esp + 0x18], 2
call fcn.00588110
lea edi, [esi + 0x74]
mov ecx, edi
mov byte [esp + 0x18], 3
mov dword [esp + 0xc], edi
call fcn.00586ce0
lea ecx, [edi + 0x28]
mov byte [esp + 0x18], 4
call fcn.00588110
mov ecx, dword [esp + 0x10]
mov dword [esi + 0xb8], 0
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x586210
Capabilities:
Get file size

Disassembly:
mov al, byte [ecx + 0x30]
test al, al
je 0x586242
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x586242
push esi
lea esi, [ecx + 8]
mov ecx, dword [ecx + 0x2c]
push edi
lea edi, [ecx + 1]
mov ecx, esi
call fcn.0058b540
cmp eax, edi
jbe 0x58623d
pop edi
mov ecx, esi
pop esi
jmp fcn.0058b540
mov eax, edi
pop edi
pop esi
ret
add ecx, 8
jmp fcn.0058b540

Function at 0x586830
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6c9398
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0058b800
xor ebx, ebx
lea ecx, [esi + 8]
mov dword [esp + 0x14], ebx
mov dword [esi], 0x6ec39c
call fcn.0058b3c0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov byte [esi + 0x20], 1
mov dword [esi + 4], 4
mov dword [esi + 0x24], 0xffffffff
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x5869a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6c93c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0058b800
xor ebx, ebx
lea ecx, [esi + 8]
mov dword [esp + 0x14], ebx
mov dword [esi], 0x6ec39c
call fcn.0058b3c0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov al, 1
mov byte [esp + 0x14], al
mov byte [esi + 0x20], al
mov eax, dword [esp + 0x24]
push eax
push ecx
push edx
mov ecx, esi
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 4], 4
mov dword [esi + 0x24], 0xffffffff
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
call fcn.005868b0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc

Function at 0x588360
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
xor edi, edi
test esi, esi
mov ebx, ecx
je 0x5883a8
mov ebp, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
push 0
push esi
lea eax, [edi + ebp]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x5883a0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2734
je 0x5883a4
cmp eax, 0x2738
jne 0x5883a8
jmp 0x5883a4
add edi, eax
sub esi, eax
test esi, esi
jne 0x588374
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x58b460
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x58b4bf
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x58b4bf
push edi
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x58b480
lea edi, [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esi]
push 0
push edi
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x58b4b7
cmp dword [edi], ebx
je 0x58b4a8
mov eax, 2
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
ret 0xc
pop edi
mov dword [esi + 4], 0
pop esi
xor eax, eax
pop ebx
ret 0xc
mov ecx, esi
call fcn.0058b3f0
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x58b4d0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x58b4df
cmp eax, 2
jne 0x58b51d
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x58b51d
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x58b4f3
lea eax, [esp + 0xc]
push 0
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x58b516
mov dword [esi + 4], 0
xor eax, eax
pop esi
ret 0xc
mov ecx, esi
call fcn.0058b3f0
pop esi
ret 0xc

Function at 0x58b540
Capabilities:
Get file size

Disassembly:
push ecx
mov eax, dword [ecx + 4]
test eax, eax
je 0x58b551
cmp eax, 2
je 0x58b551
xor eax, eax
pop ecx
ret
mov ecx, dword [ecx]
lea eax, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop ecx
ret

Function at 0x58b730
Capabilities:
Get file size

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x58b73f
cmp eax, 2
jne 0x58b7b4
mov al, byte [esp + 0xc]
test al, al
push edi
je 0x58b756
mov eax, dword [esp + 0xc]
mov ecx, dword [esi]
push 0
push 0
push eax
push ecx
jmp 0x58b762
mov edx, dword [esp + 0xc]
mov eax, dword [esi]
push 1
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, eax
cmp edi, 0xffffffff
jne 0x58b77b
mov ecx, esi
call fcn.0058b3f0
pop edi
pop esi
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x58b787
cmp eax, 2
jne 0x58b799
mov edx, dword [esi]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp edi, eax
jb 0x58b7aa
pop edi
mov dword [esi + 4], 2
mov eax, 2
pop esi
ret 8
mov dword [esi + 4], 0
xor eax, eax
pop edi
pop esi
ret 8
Function at 0x5947b0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x597e00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6c9a28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
push str.null
push esi
mov dword [esp + 0x18], esi
call fcn.00630960
xor ebx, ebx
add esp, 8
lea ecx, [esi + 0x28]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
call fcn.00597f70
lea ecx, [esi + 0xf8]
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
mov byte [esi + 0xf4], 1
call fcn.00597fd0
push 0x5980a0
push 0x5980b0
push 4
push 0x54
lea eax, [esi + 0x128]
push eax
call fcn.00631025
lea edi, [esi + 0x2b8]
push str.null
push edi
mov dword [esp + 0x24], ebx
mov dword [esi + 0x278], 7
mov dword [esi + 0x284], ebx
mov dword [esi + 0x28c], ebx
mov dword [esi + 0x288], ebx
mov dword [esi + 0x290], ebx
mov dword [esi + 0x2b4], ebx
mov byte [esi + 0x294], bl
mov byte [esi + 0x2a4], bl
call fcn.00630960
mov eax, 1
or ebp, 0xffffffff
add esp, 8
lea ecx, [esi + 0x2fc]
mov dword [edi + 0x10], ebx
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], eax
mov dword [edi + 0x30], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x34], ebp
mov dword [edi + 0x2c], ebx
call fcn.00598010
lea ecx, [esi + 0x324]
call fcn.00598040
lea eax, [esi + 0x43c]
add eax, 0x28
mov dword [eax - 0x28], ebx
mov dword [eax - 0x24], ebx
mov dword [eax - 0x20], ebx
mov dword [eax - 0xc], ebp
mov dword [eax - 8], ebp
mov byte [eax - 0x1c], bl
mov dword [eax - 4], ebx
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0x1c], ebp
mov dword [eax + 0x20], ebp
mov byte [eax + 0xc], bl
mov ecx, dword [esp + 0x14]
mov dword [eax + 0x24], ebx
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret