joyce8/EMBER2024-capa huggingface dataset:
Function at 0x560a20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f8510
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov esi, ecx
push str.___:_:
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0
call fcn.005d5c95
push 0x675fc0
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.005d5c95
push 0x66b208
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 2
call fcn.005d5c95
push 0x675fc0
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 3
call fcn.005d5c95
lea edi, [esi + 0x144]
push 0x675fc0
mov ecx, edi
mov byte [esp + 0x2c], 4
call fcn.005d5db0
mov eax, dword [esp + 0x30]
xor esi, esi
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x560b2e
mov al, byte [esi + eax]
mov byte [esp + 0x1c], al
movsx eax, al
push eax
call fcn.00446d5a
add esp, 4
test eax, eax
je 0x560b16
push 0x675fc0
lea ecx, [esp + 0x14]
call fcn.005d5c95
push esi
lea ecx, [esp + 0x14]
push 0x644d68
push ecx
mov byte [esp + 0x34], 5
call fcn.005d34ef
add esp, 0xc
lea edx, [esp + 0x10]
lea ecx, [esp + 8]
push edx
call fcn.005d603f
mov eax, dword [esp + 0x1c]
mov ecx, edi
push eax
call fcn.005d602a
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 4
call fcn.005d5c27
jmp 0x560b24
mov ecx, dword [esp + 0x1c]
push ecx
lea ecx, [esp + 0x10]
call fcn.005d602a
mov eax, dword [esp + 0x30]
inc esi
cmp esi, dword [eax - 8]
jl 0x560aaf
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
push edx
push eax
call fcn.004462d6
add esp, 8
test eax, eax
pop edi
pop esi
je 0x560bb8
mov ecx, dword [esp]
mov edx, dword [esp + 0xc]
push ecx
push edx
call fcn.004462d6
add esp, 8
test eax, eax
je 0x560bb8
lea ecx, [esp]
mov byte [esp + 0x20], 3
call fcn.005d5c27
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.005d5c27
lea ecx, [esp + 4]
mov byte [esp + 0x20], 1
call fcn.005d5c27
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.005d5c27
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.005d5c27
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 4
lea ecx, [esp]
mov byte [esp + 0x20], 3
call fcn.005d5c27
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.005d5c27
lea ecx, [esp + 4]
mov byte [esp + 0x20], 1
call fcn.005d5c27
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.005d5c27
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.005d5c27
mov ecx, dword [esp + 0x18]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x563e70
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5f8983
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x656c68]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea edi, [esi + 0x18]
mov dword [edi], eax
mov ecx, dword [0x656c68]
mov dword [esp + 0x14], 0
mov dword [esi + 0x1c], ecx
mov edx, dword [0x656c68]
mov dword [esi + 0x20], edx
mov eax, dword [0x656c68]
mov dword [esi + 0x24], eax
mov ecx, dword [0x656c68]
mov dword [esi + 0x28], ecx
mov edx, dword [0x656c68]
mov dword [esi + 0x2c], edx
mov eax, dword [0x656c68]
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x14], 6
call fcn.005d4051
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 7
call fcn.005d4051
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x14], 8
push ecx
mov ecx, edi
mov dword [esi], 0x60b728
mov dword [esi + 4], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], 0x10
mov dword [esi + 0x10], 2
mov dword [esi + 0x14], 1
call fcn.005d5db0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x564100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f8ad3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x656c68]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 0x18]
mov dword [edi], eax
mov ecx, dword [0x656c68]
mov dword [esp + 0x1c], 0
mov dword [esi + 0x1c], ecx
mov edx, dword [0x656c68]
mov dword [esi + 0x20], edx
mov eax, dword [0x656c68]
lea ebp, [esi + 0x24]
mov dword [ebp], eax
mov ecx, dword [0x656c68]
lea ebx, [esi + 0x28]
mov dword [ebx], ecx
mov edx, dword [0x656c68]
mov dword [esi + 0x2c], edx
mov eax, dword [0x656c68]
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x1c], 6
call fcn.005d4051
lea ecx, [esi + 0x48]
mov byte [esp + 0x1c], 7
call fcn.005d4051
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov dword [esi + 0xc], ecx
push eax
mov ecx, edi
mov byte [esp + 0x20], 8
mov dword [esi], 0x60b728
mov dword [esi + 4], 0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], 1
call fcn.005d5db0
mov eax, dword [esp + 0x30]
test eax, eax
je 0x5641cf
push eax
mov ecx, ebx
call fcn.005d5db0
mov eax, dword [esp + 0x34]
test eax, eax
je 0x5641df
push eax
mov ecx, ebp
call fcn.005d5db0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x565b60
Capabilities:
Start service

Disassembly:
sub esp, 0x20
push edi
call fcn.0047add0
test eax, eax
je 0x565b7e
mov dword [0x67a760], 0x32
xor eax, eax
pop edi
add esp, 0x20
ret
mov eax, dword [esp + 0x28]
xor edi, edi
cmp eax, edi
jne 0x565b99
mov dword [0x67a760], 0x57
xor eax, eax
pop edi
add esp, 0x20
ret
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push esi
push 2
push edi
push edi
mov dword [0x67a760], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call ebp
mov esi, eax
cmp esi, edi
jne 0x565bc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
cmp esi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
je 0x565bea
mov eax, dword [esp + 0x34]
push 0x10
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x565c28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
test edi, edi
je 0x565c5f
jne 0x565c28
test esi, esi
jne 0x565c0e
push 2
push esi
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x565c0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
mov dword [esp + 0x14], eax
je 0x565c28
mov ecx, dword [esp + 0x34]
push 0x10
push ecx
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x565c28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push edx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ebp, eax
test ebp, ebp
jne 0x565c7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
mov dword [0x67a760], eax
jne 0x565c68
mov dword [esp + 0x10], 1
mov ebp, dword [esp + 0x10]
jmp 0x565c7f
mov eax, dword [0x67a760]
mov ebp, dword [esp + 0x10]
test eax, eax
jne 0x565c7f
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x565c7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x67a760], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x565c8c
push edi
call ebx
test esi, esi
je 0x565c93
push esi
call ebx
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x20
ret
Function at 0x565ea0
Capabilities:
Query service status

Disassembly:
sub esp, 0x20
call fcn.0047add0
test eax, eax
je 0x565ebc
mov dword [0x67a760], 0x32
xor eax, eax
add esp, 0x20
ret
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], ebp
push 1
rep stosd dword es:[edi], eax
push ebp
push ebp
mov dword [0x67a760], ebp
mov dword [esp + 0x1c], ebp
xor ebx, ebx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
cmp esi, ebp
jne 0x565efb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp esi, ebp
mov ebp, dword [esp + 0x34]
je 0x565f19
push 4
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x565f53
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test edi, edi
je 0x565f6f
jne 0x565f53
test esi, esi
jne 0x565f3d
push 1
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x565f3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x565f53
push 4
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x565f53
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebp, eax
test ebp, ebp
jne 0x565f8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x565f73
mov ebp, dword [esp + 0x10]
test ebx, ebx
je 0x565f7f
mov dword [0x67a760], ebx
jmp 0x565f96
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x67a760], eax
jmp 0x565f96
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov dword [ecx], edx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x565fa3
push edi
call ebx
test esi, esi
je 0x565faa
push esi
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x566870
Capabilities:
Modify service

Disassembly:
push 0xffffffffffffffff
push 0x5f8cfb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x624
push esi
push edi
lea ecx, [esp + 0x10]
xor esi, esi
call fcn.005d4051
mov eax, dword [esp + 0x65c]
mov dword [esp + 0x634], esi
test eax, eax
je 0x5668b4
push eax
lea ecx, [esp + 0x14]
call fcn.005d422d
mov eax, dword [esp + 0x660]
test eax, eax
je 0x5668c9
push eax
lea ecx, [esp + 0x14]
call fcn.005d422d
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x22d]
mov byte [esp + 0x22c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
mov dword [esp + 8], 0x400
test eax, eax
jle 0x566948
lea eax, [esp + 8]
lea ecx, [esp + 0x22c]
push eax
push ecx
lea edx, [esp + 0x18]
push 0
push edx
call fcn.00499160
add esp, 0x10
test eax, eax
jne 0x566941
lea ecx, [esp + 0x10]
mov dword [esp + 0x634], 0xffffffff
call fcn.005d4084
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x624]
mov dword fs:[0], ecx
add esp, 0x630
ret
lea esi, [esp + 0x22c]
mov eax, dword [esp + 0x64c]
mov ecx, dword [esp + 0x668]
mov edx, dword [esp + 0x664]
push ebx
push ebp
push eax
mov eax, dword [esp + 0x664]
push ecx
mov ecx, dword [esp + 0x664]
push edx
mov edx, dword [esp + 0x65c]
push esi
mov esi, dword [esp + 0x654]
push 0
push eax
mov eax, dword [esp + 0x664]
push ecx
mov ecx, dword [esp + 0x664]
push edx
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov ebp, eax
test ebp, ebp
je 0x566a01
mov ebx, dword [esp + 0x658]
test ebx, ebx
je 0x566a01
test esi, esi
je 0x566a01
call fcn.0043fc50
mov eax, dword [0x677348]
test eax, eax
je 0x566a01
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], 0
rep stosd dword es:[edi], eax
push 0
lea edx, [esp + 0x30]
push 0x104
push edx
push 0xffffffffffffffff
push ebx
stosw word es:[edi], ax
call fcn.00496760
add esp, 0x14
lea ecx, [esp + 0x14]
lea eax, [esp + 0x2c]
push ecx
push 1
push esi
mov dword [esp + 0x20], eax
call dword [0x677348]
lea ecx, [esp + 0x18]
mov dword [esp + 0x63c], 0xffffffff
call fcn.005d4084
mov ecx, dword [esp + 0x634]
mov eax, ebp
pop ebp
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x630
ret
Function at 0x567250
Capabilities:
Set registry value

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0xffffffff
je 0x56726d
cmp edi, 4
jbe 0x56726d
mov dword [0x67a764], 0x57
xor eax, eax
pop edi
ret
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
cmp eax, 0xffffffff
mov ebx, dword [esi]
je 0x56728c
push eax
mov eax, dword [str.Type]
push eax
mov ecx, esi
call fcn.0046da80
cmp edi, 0xffffffff
je 0x5672a0
mov ecx, dword [str.Start]
push edi
push ecx
mov ecx, esi
call fcn.0046da80
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x5672b8
mov edx, dword [str.ErrorControl]
push eax
push edx
mov ecx, esi
call fcn.0046da80
mov eax, dword [esp + 0x20]
test eax, eax
je 0x5672ce
push eax
mov eax, dword [0x66b340]
push eax
mov ecx, esi
call fcn.0046dc30
mov eax, dword [esp + 0x24]
test eax, eax
je 0x5672e5
mov ecx, dword [0x66b344]
push eax
push ecx
mov ecx, esi
call fcn.0046dc30
mov edx, dword [esp + 0x28]
test edx, edx
je 0x56730b
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [str.ImagePath]
push 2
push eax
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x567321
push eax
mov eax, dword [str.Group]
push eax
mov ecx, esi
call fcn.0046dc30
mov eax, dword [esp + 0x30]
test eax, eax
je 0x567338
mov ecx, dword [str.DependOnGroup]
push eax
push ecx
mov ecx, esi
call fcn.0046e0c0
mov eax, dword [esp + 0x34]
test eax, eax
je 0x56734f
mov edx, dword [str.DependOnService]
push eax
push edx
mov ecx, esi
call fcn.0046e0c0
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x5682f0
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5f8f40
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x568323
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
cmp byte [esi], 0
jne 0x56833a
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
lea ecx, [esp + 4]
call fcn.0046c820
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x20019
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.0046c940
test eax, eax
je 0x5683e6
push 1
push esi
lea ecx, [esp + 0xc]
call fcn.0046ee40
test eax, eax
jne 0x56839b
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0046c8c0
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
push edi
mov edi, dword [esp + 0x28]
test edi, edi
je 0x5683ce
lea ecx, [esp + 0x28]
push esi
push ecx
lea ecx, [esp + 0x10]
call fcn.0046cf70
push eax
mov ecx, edi
mov byte [esp + 0x1c], 1
call fcn.005d5d60
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 0
call fcn.005d5c27
mov eax, dword [esp + 0x24]
pop edi
test eax, eax
je 0x5684ad
mov dword [eax], 0x10
jmp 0x5684ad
mov edx, dword [0x656c68]
mov dword [esp + 0x1c], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push esi
push eax
lea ecx, [esp + 0x24]
push 0x638274
push ecx
mov byte [esp + 0x24], 2
call fcn.005d34ef
mov edx, dword [esp + 0x2c]
add esp, 0x10
lea ecx, [esp + 4]
push 0x20019
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0046c940
test eax, eax
jne 0x56845a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], al
call fcn.005d5c27
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0046c8c0
xor eax, eax
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov esi, dword [esp + 0x24]
test esi, esi
je 0x568491
mov eax, dword [str.StaticVxD]
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.0046cf70
push eax
mov ecx, esi
mov byte [esp + 0x18], 3
call fcn.005d5d60
lea ecx, [esp + 0x24]
mov byte [esp + 0x14], 2
call fcn.005d5c27
mov eax, dword [esp + 0x20]
test eax, eax
je 0x56849f
mov dword [eax], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call fcn.005d5c27
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0046c8c0
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x5684e0
Capabilities:
Persist via run registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5f8f68
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
xor ebx, ebx
cmp edi, ebx
je 0x5685ef
mov esi, dword [esp + 0x2c]
cmp esi, ebx
je 0x5685ef
cmp byte [edi], bl
je 0x5685ef
cmp byte [esi], bl
je 0x5685ef
lea ecx, [esp + 0xc]
call fcn.0046c820
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
cmp eax, 2
je 0x56858d
cmp eax, 1
je 0x56858d
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
call fcn.0046c940
test eax, eax
jne 0x56857b
mov ecx, dword [str.SoftwareMicrosoftWindowsCurrentVersionRunServices]
push 0x2001f
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
call fcn.0046c9b0
test eax, eax
je 0x5685de
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.0046dc30
mov esi, eax
jmp 0x568672
mov edx, dword [0x656c68]
mov dword [esp + 0x24], edx
mov eax, dword [str.SystemCurrentControlSetServicesVxD]
push edi
push eax
lea ecx, [esp + 0x2c]
push 0x638274
push ecx
mov byte [esp + 0x2c], 1
call fcn.005d34ef
mov edx, dword [esp + 0x34]
add esp, 0x10
lea ecx, [esp + 0xc]
push 0x2001f
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0046c940
test eax, eax
jne 0x568603
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.005d5c27
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0046c8c0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, dword [0x656c68]
mov dword [esp + 0x2c], eax
push 0x5c
push esi
mov byte [esp + 0x24], 2
call fcn.004441ae
add esp, 8
cmp eax, ebx
je 0x56862b
inc eax
lea ecx, [esp + 0x2c]
push eax
call fcn.005d5db0
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], ebx
jne 0x568644
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 1
call fcn.005d5c27
jmp 0x5685d1
mov ecx, dword [str.StaticVxD]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.0046dc30
lea ecx, [esp + 0x2c]
mov esi, eax
mov byte [esp + 0x1c], 1
call fcn.005d5c27
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call fcn.005d5c27
lea ecx, [esp + 0xc]
call fcn.0046c990
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0046c8c0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x569f80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5f936c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x656c68]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 8]
mov dword [edi], eax
mov ecx, dword [0x656c68]
lea ebp, [esi + 0x18]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [ebp], ecx
mov edx, dword [0x656c68]
mov dword [esi + 0x20], edx
lea ecx, [esi + 0x28]
mov byte [esp + 0x1c], 2
call fcn.005d4fe0
mov eax, dword [esp + 0x24]
mov ecx, edi
push eax
mov byte [esp + 0x20], 3
mov dword [esi], 0x60b72c
mov dword [esi + 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], ebx
mov word [esi + 0x24], 0xffff
call fcn.005d5db0
mov eax, dword [esp + 0x28]
mov cx, word [esp + 0x30]
test eax, 0xffff0000
mov word [esi + 0x24], cx
mov dword [esi + 0x14], eax
je 0x56a023
push eax
mov ecx, ebp
call fcn.005d5db0
mov edx, dword [ebp]
mov dword [esi + 0x14], edx
mov eax, dword [esp + 0x2c]
test eax, 0xffff0000
mov dword [esi + 0x1c], eax
je 0x56a041
lea edi, [esi + 0x20]
push eax
mov ecx, edi
call fcn.005d5db0
mov eax, dword [edi]
mov dword [esi + 0x1c], eax
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x56daa0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60b778
push 0x4459d4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ecx, dword [ebp + 8]
xor edx, edx
cmp ecx, edx
je 0x56db32
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x56db2b
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
jne 0x56db2b
cmp word [eax + 0x14], dx
je 0x56db2b
cmp dword [ebp + 0xc], edx
je 0x56db05
cmp word [eax + 4], 0x14c
jne 0x56db2b
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x56dc20
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
push edi
je 0x56dc6d
mov edi, dword [esp + 0x18]
test edi, edi
je 0x56dc6d
mov eax, dword [ebx + 0x3c]
xor ecx, ecx
add eax, ebx
xor edx, edx
mov cx, word [eax + 0x14]
mov dx, word [eax + 6]
lea esi, [ecx + eax + 0x18]
xor ecx, ecx
test edx, edx
mov dword [esp + 0x14], esi
jbe 0x56dc6d
lea eax, [esi + 0x10]
mov esi, dword [eax - 4]
cmp edi, esi
jb 0x56dc65
mov ebp, dword [eax]
add ebp, esi
cmp edi, ebp
jb 0x56dc74
inc ecx
add eax, 0x28
cmp ecx, edx
jb 0x56dc56
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x14]
lea edx, [ecx + ecx*4]
mov esi, dword [eax + edx*8 + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [eax + edx*8 + 0x14]
sub eax, esi
add eax, ebx
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x56e540
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60b788
push 0x4459d4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
push eax
mov edi, dword [ebp + 0x14]
push edi
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0056dcc0
add esp, 0x10
mov esi, eax
cmp esi, ebx
je 0x56e5f3
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 0x20]
push eax
call edi
add esp, 8
mov dword [ebp - 0x24], eax
mov edi, dword [ebp + 0x10]
sub edi, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x30]
push ecx
push 0x40
push 4
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
test eax, eax
je 0x56e5ec
mov dword [esi], edi
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x30]
push eax
push 4
push esi
call ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5715d0
Capabilities:
Get file size

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push 0
lea eax, [esp + 8]
push 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
mov dword [esp + 0x30], 0
call fcn.0056fbb0
add esp, 0x2c
test eax, eax
je 0x5716b8
mov eax, dword [esp + 4]
cmp eax, 4
jne 0x571644
mov ecx, dword [esp + 0x10]
push ecx
push esi
call fcn.00589ab0
mov edx, dword [0x67b000]
mov ecx, dword [0x67b004]
add esp, 8
mov dword [0x67a7c0], edx
mov edx, dword [0x67b008]
mov dword [0x67a7c4], ecx
mov dword [0x67a7c8], edx
pop esi
pop ecx
ret
cmp eax, 3
jne 0x57167e
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.0057be30
mov ecx, dword [0x67a870]
mov edx, dword [0x67a874]
add esp, 8
mov dword [0x67a7c0], ecx
mov ecx, dword [0x67a878]
mov dword [0x67a7c4], edx
mov dword [0x67a7c8], ecx
pop esi
pop ecx
ret
mov edx, dword [esp + 0x10]
cmp eax, 6
push edx
push esi
jne 0x5716be
call fcn.0059a9f0
mov ecx, dword [0x67b618]
mov edx, dword [0x67b61c]
add esp, 8
mov dword [0x67a7c0], ecx
mov ecx, dword [0x67b620]
mov dword [0x67a7c4], edx
mov dword [0x67a7c8], ecx
pop esi
pop ecx
ret
mov eax, dword [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop esi
pop ecx
ret